The CmRegisterCallback routine registers a RegistryCallback routine.



NTSTATUS

  CmRegisterCallback(

    IN PEX_CALLBACK_FUNCTION  Function,

    IN PVOID  Context,

    OUT PLARGE_INTEGER  Cookie

    );



Parameters

Function

Pointer to the RegistryCallback routine to register.

Context

Specifies the value to pass as the CallbackContext parameter to

 RegistryCallback.

Cookie

Pointer to a LARGE_INTEGER variable that receives the value identifying the

 callback routine. When you unregister the callback routine, pass this value

 as the Cookie parameter to CmUnRegisterCallback.



This routine is available only on Microsoft Windows XP and later operating

 systems.



A driver calls this routine to register a RegistryCallback routine, which is

 called every time a thread performs an operation on the registry.



Call CmUnRegisterCallback to unregister a callback routine that was registered

 by CmRegisterCallback.

The RegistryCallback routine runs every time a thread performs a registry

 operation.



NTSTATUS

  RegistryCallback(

    IN PVOID  CallbackContext,

    IN REG_NOTIFY_CLASS  Argument1,

    IN PVOID  Argument2

    );



Parameters

CallbackContext

Supplies the value that was passed as the Context parameter to

 CmRegisterCallback when you registered this RegistryCallback routine.

Argument1

Supplies the REG_NOTIFY_CLASS value for the registry operation. This value

 specifies two pieces of information: the type of registry operation, and 

whether the call to RegistryCallback is pre-notification or post-notification.

Argument2

Pointer to a structure that contains parameters specific to the type of

 registry operation. The type of the structure depends on the 

REG_NOTIFY_CLASS value in Argument1, as shown in the following table.



REG_NOTIFY_CLASS Value	Structure Type	

RegNtDeleteKey	REG_DELETE_KEY_INFORMATION	

RegNtPreDeleteKey	REG_DELETE_KEY_INFORMATION	

RegNtPostDeleteKey	REG_POST_OPERATION_INFORMATION	

RegNtSetValueKey	REG_SET_VALUE_KEY_INFORMATION	

RegNtPreSetValueKey	REG_SET_VALUE_KEY_INFORMATION	

RegNtPostSetValueKey	REG_POST_OPERATION_INFORMATION	

RegNtDeleteValueKey	REG_DELETE_VALUE_KEY_INFORMATION	

RegNtPreDeleteValueKey	REG_DELETE_VALUE_KEY_INFORMATION	

RegNtPostDeleteValueKey	REG_POST_OPERATION_INFORMATION	

RegNtSetInformationKey	REG_SET_INFORMATION_KEY_INFORMATION	

RegNtPreSetInformationKey	REG_SET_INFORMATION_KEY_INFORMATION	

RegNtPostSetInformationKey	REG_POST_OPERATION_INFORMATION	

RegNtRenameKey	REG_RENAME_KEY_INFORMATION	

RegNtPreRenameKey	REG_RENAME_KEY_INFORMATION	

RegNtPostRenameKey	REG_POST_OPERATION_INFORMATION	

RegNtEnumerateKey	REG_ENUMERATE_KEY_INFORMATION	

RegNtPreEnumerateKey	REG_ENUMERATE_KEY_INFORMATION	

RegNtPostEnumerateKey	REG_POST_OPERATION_INFORMATION	

RegNtEnumerateValueKey	REG_ENUMERATE_VALUE_KEY_INFORMATION	

RegNtPreEnumerateValueKey	REG_ENUMERATE_VALUE_KEY_INFORMATION	

RegNtPostEnumerateValueKey	REG_POST_OPERATION_INFORMATION	

RegNtQueryKey	REG_QUERY_KEY_INFORMATION	

RegNtPreQueryKey	REG_QUERY_KEY_INFORMATION	

RegNtPostQueryKey	REG_POST_OPERATION_INFORMATION	

RegNtQueryValueKey	REG_QUERY_VALUE_KEY_INFORMATION	

RegNtPreQueryValueKey	REG_QUERY_VALUE_KEY_INFORMATION	

RegNtPostQueryValueKey	REG_POST_OPERATION_INFORMATION	

RegNtQueryMultipleValueKey	REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION	

RegNtPreQueryMultipleValueKey	REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION	

RegNtPostQueryMultipleValueKey	REG_POST_CREATE_KEY_INFORMATION	

RegNtPreCreateKey	REG_PRE_CREATE_KEY_INFORMATION	

RegNtPreCreateKeyEx	REG_CREATE_KEY_INFORMATION	

RegNtPostCreateKey	REG_POST_CREATE_KEY_INFORMATION	

RegNtPostCreateKeyEx	REG_POST_OPERATION_INFORMATION	

RegNtPreOpenKey	REG_PRE_OPEN_KEY_INFORMATION	

RegNtPreOpenKeyEx	REG_OPEN_KEY_INFORMATION	

RegNtPostOpenKey	REG_POST_OPEN_KEY_INFORMATION	

RegNtPostOpenKeyEx	REG_POST_OPERATION_INFORMATION	

RegNtKeyHandleClose	REG_KEY_HANDLE_CLOSE_INFORMATION 	

RegNtPreKeyHandleClose	REG_KEY_HANDLE_CLOSE_INFORMATION 	

RegNtPostKeyHandleClose	REG_POST_OPERATION_INFORMATION	



Return Value



If the system made a pre-notification call to this routine, RegistryCallback

 returns the NTSTATUS value that the system should return for the registry

 operation. If the system made a post-notification call, the return value is

 ignored.



To be notified of registry operations, a kernel-mode component (such as the

 driver component of an anti-virus software package) can register a

 RegistryCallback routine.



The system provides two types of notifications:



A pre-notification call to RegistryCallback indicates that a registry operation

 has been requested. The system passes both the parameters for the

 operation and the result of the operation in the Argument2 parameter to

 RegistryCallback. The callback routine can modify the result, and the system

 will use the callback routine's return value as the NTSTATUS value of the

 operation.



A post-notification call to RegistryCallback indicates that the system has

 attempted the registry operation. The system will ignore the callback

 routine's return value. (If RegistryCallback returned an NTSTATUS error code

 after a pre-notification call, the system will not attempt the registry

 operation, nor will it make a post-notification call).



For Windows XP, the system only makes post-notification calls only when a

 registry key is created or opened. For Microsoft Windows Server 2003 and

 later operating systems, the system makes post-notification calls for every

 registry operation.