/*++ Copyright (c) 1999-2000 Microsoft Corporation Module Name: reflectr.c Abstract: This module will register reflector thread and do necessary action while awake up. Author: ATM Shafiqul Khalid (askhalid) 16-Feb-2000 Revision History: --*/ #include #include #include #include #include "wow64reg.h" #include #include #include "reflectr.h" REFLECTOR_EVENT eReflector[ISN_NODE_MAX_NUM]; REFLECTR_STATUS ReflectrStatus = Stopped; HANDLE hRegistryEvent[ISN_NODE_MAX_NUM]; HANDLE hReflector; DWORD TotalEventCount = 0; VOID DbgPrint( PCHAR FormatString, ... ); REFLECTR_STATUS GetReflectorThreadStatus () /*++ Routine Description: Return current thread status; Arguments: None. Return Value: REFLECTR_STATUS --*/ { return ReflectrStatus; } BOOL NotifyKeyChange ( HKEY hKey, HANDLE hEvent ) /* Routine Description: Register an event to be fired when something get changed on a key. Arguments: hKey - handle to a key that need to be watched. hEvent event that need to be triggered. Return Value: TRUE if the event registration succeed, FALSE otherwise. --*/ { DWORD Ret; ResetEvent (hEvent); Ret = RegNotifyChangeKeyValue( hKey, // need to change to the ISN node TRUE, // Watch the whole sub-tree REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET, // Don't watch for anything hEvent, // Event Handle TRUE // Async ); if ( ERROR_SUCCESS != Ret) DbgPrint ("\nWow64.exe:Error!! Couldn't register events:%x on handle %x",hEvent, hKey); return Ret == ERROR_SUCCESS; } VOID RefreshWaitEventTable () /*++ Routine Description: Just copy all event object and we can wail for new event to trigger. Arguments: None. Return Value: None. --*/ { DWORD k; for (k=0;k TotalEventCount ) { //right index Wow64RegDbgPrint ( ("\nWaitMultiple object failed!!.. %d LastError:%d", Ret, GetLastError ()) ); Sleep (1000*10); //wait 10 sec before reregistering events continue; //break; } // // Checkspecial case like shared memory write // if ( (Ret-WAIT_OBJECT_0) == 0){ PeocessHiveLoadUnload (); ResetEvent (eReflector[0].hRegistryEvent); // reset the event that triggered this RefreshWaitEventTable (); continue; } // // set timeout to 10 second, Mark the hive dirty, reset event, and back to sleep // LocalWaitTime = 5*1000; // poll the event every 5 second. Sleep (1000* 3);// Sleep 3 second to reregister the event. eReflector[Ret-WAIT_OBJECT_0].bDirty = TRUE; ResetEvent (eReflector[Ret-WAIT_OBJECT_0].hRegistryEvent); // // watch for the event again // if (!NotifyKeyChange ( eReflector[Ret-WAIT_OBJECT_0].hKey, eReflector[Ret-WAIT_OBJECT_0].hRegistryEvent)){ // // if the node get deleted you need to unload the events and everything // ValidateOpenHandleEventTable (Ret-WAIT_OBJECT_0); RefreshWaitEventTable (); //ReflectrStatus = Abnormal; //break; //set thread state } } if (ReflectrStatus == PrepareToStop) break; // // Now process all dirty hive. // for (k=0;k60*5) break; // 5min timeout going to stop anyway. } for (i=1;i