注册表观察器c#实现RegistryKeyChangeEvent

本文关键字：实现 RegistryKeyChangeEvent 观察 注册表 | 更新日期: 2023-09-27 18:16:55

好的，我试了一下，看了看这个。我遵循我的代码-

// Construct the query string:HKEY_LOCAL_MACHINE
string queryString = string.Format(@"SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE' AND KeyPath = 'SOFTWARE''Microsoft''Windows''CurrentVersion''Uninstall' ");
WqlEventQuery query = new WqlEventQuery();
query.QueryString = queryString;
query.EventClassName = "RegistryKeyChangeEvent";
query.WithinInterval = new TimeSpan(0, 0, 0, 1);
this.Query = query;
this.EventArrived += new EventArrivedEventHandler(RegistryWatcher_EventArrived);

不幸的是，当我调用Start()时，它会引发一个异常- ManagementException，并说"不可解析的查询。"

注册表观察器c#实现RegistryKeyChangeEvent

经过一些变通，我找到了用ManagementScope代替WqlEventQuery一劳永逸地解决它的方法:

ManagementScope Scope = new ManagementScope("''''.''root''default");
EventQuery Query = new EventQuery(@"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE''Microsoft''Windows''CurrentVersion''Uninstall'");
ManagementEventWatcher watcher = new ManagementEventWatcher(Scope, Query);
m_watcher.EventArrived += new EventArrivedEventHandler(RegistryWatcher_EventArrived);
m_watcher.Start();

它解析查询的方式似乎有问题，但现在它很好。

相关文章：