)註冊表讀取程式

寫常用的註冊表讀取程式，查看幾個我非常關心的登錄機碼。

病毒通常訪問的登錄機碼如下

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

在VC++ SP6 和WINDOWS XP SP1下編譯通過。

QueryKey函數用來枚舉子鍵，QueryValue用來枚舉每個子鍵的索引值，

m_listValue是一個ListBox控制項。

代碼如下：

void CAutoRunReaderDlg::QueryKey(HKEY hKey)
{
    CHAR     achKey[MAX_PATH] = "";
 LPTSTR   lpName = achKey;
    CHAR     achClass[MAX_PATH] = "";
 LPTSTR   lpClass = achClass;  
    FILETIME ftLastWriteTime;
 DWORD dwIndex = 0;
    DWORD lpcName = MAX_PATH;
 DWORD lpcClass = MAX_PATH;
    DWORD i=0;
    DWORD retCode;   
    //CString strTemp; 
    SetCursor(LoadCursor(NULL, IDC_WAIT));
 retCode = ERROR_SUCCESS;
    do
    {
        retCode = RegEnumKeyEx(
            hKey,
                     dwIndex,
                     lpName,
                     &lpcName,
                     NULL,
                     lpClass,
                     &lpcClass,
                     &ftLastWriteTime);
        if (retCode == (DWORD)ERROR_SUCCESS)
        {     
            m_listValue.AddString(lpName);    
        }
  if(retCode == (DWORD) ERROR_INVALID_HANDLE)
  {
   SetCursor(LoadCursor(NULL, IDC_ARROW));
   m_listValue.AddString("invalid handle");
            return;
  }
  dwIndex++;
  lpcName = MAX_PATH;//每次迴圈都要給緩衝區重新設定大小，否則出錯
  lpcClass = MAX_PATH;
    } while(ERROR_NO_MORE_ITEMS != retCode);   
    SetCursor(LoadCursor(NULL, IDC_ARROW));
}

void CAutoRunReaderDlg::QueryValue(HKEY hKey)
{
 CHAR     ValueName[MAX_PATH] = "";
 LPTSTR   lpValueName = ValueName;
    BYTE     lpData[MAX_PATH];
 
    //FILETIME ftLastWriteTime;
 DWORD dwIndex = 0;
    DWORD lpcValueName = MAX_PATH;
 DWORD lpcbData = MAX_PATH;
    DWORD lpType;
    DWORD retCode;   
    CString strTemp;
 CString strTypename;
    SetCursor(LoadCursor(NULL, IDC_WAIT));
 retCode = ERROR_SUCCESS;
    do
    {
        retCode = RegEnumValue(
            hKey,
                     dwIndex,
                     lpValueName,
                     &lpcValueName,
                     NULL,
                     &lpType,
      lpData,
                     &lpcbData);
        if (retCode == (DWORD)ERROR_SUCCESS)
        {
   switch(lpType)
   {
   case REG_BINARY:
    strTypename = "REG_BINARY";
    break;
   case REG_DWORD:
    strTypename = "REG_DWORD";
    break;
    /*
   case REG_DWORD_LITTLE_ENDIAN:
    strTypename = "REG_DWORD_LITTLE_ENDIAN";
    break;
    */
   case REG_DWORD_BIG_ENDIAN:
    strTypename = "REG_DWORD_BIG_ENDIAN";
    break;
   case REG_EXPAND_SZ:
    strTypename = "REG_EXPAND_SZ";
    break;
   case REG_LINK:
    strTypename = "REG_LINK";
    break;
   case REG_MULTI_SZ:
    strTypename = "REG_MULTI_SZ";
    break;
   case REG_NONE:
    strTypename = "REG_NONE";
    break;
    /*
   case REG_QWORD:
    strTypename = "REG_QWORD";
    break;
   case REG_QWORD_LITTLE_ENDIAN:
    strTypename = "REG_QWORD_LITTLE_ENDIAN";
    break;
    */
   case REG_SZ:
    strTypename = "REG_SZ";
    break;
   default:
    strTypename = "Unknown type";
    break;
   }
   strTemp.Format("%s=%s,%s=%d", lpValueName, lpData, strTypename, lpType);
            m_listValue.AddString(strTemp);    
        }
  if(retCode == (DWORD) ERROR_INVALID_HANDLE)
  {
   SetCursor(LoadCursor(NULL, IDC_ARROW));
   m_listValue.AddString("Invalid handle");
            return;
  }
  dwIndex++;
  lpcValueName = MAX_PATH;//每次迴圈都要給緩衝區重新設定大小，否則出錯
  lpcbData = MAX_PATH;
    } while(ERROR_NO_MORE_ITEMS != retCode);   
    SetCursor(LoadCursor(NULL, IDC_ARROW));
}