LONG WINAPI Mine_RegDeleteKeyW(HKEY a0, LPCWSTR a1) { if (CFilterMapper2::m_pFilterMapper2 && (a0 == FAKEHKEY || (INT_PTR)a0 < 0)) { return ERROR_SUCCESS; } return Real_RegDeleteKeyW(a0, a1); }
// RegDeleteKeyW替换 LONG WINAPI Replace_RegDeleteKeyW(HKEY hKey,LPCWSTR lpSubKey ) { LONG nRet; __try { nRet = Real_RegDeleteKeyW(hKey, lpSubKey); if(!HOOK_RegDeleteKey) return nRet; if(GetCurrentProcessId() == ExplorerPID) return nRet; if(GetCurrentProcessId() == RegMonPID) return nRet; if((PID == 0) || ((GetCurrentProcessId() == PID) && (PID>0)) ) { if(lpSubKey == NULL) return nRet; COPYDATASTRUCT data; PARAMS params; memset(¶ms,0,sizeof(PARAMS)); params.PID = GetCurrentProcessId(); params.hKey = hKey; memcpy(params.buf1, lpSubKey, wcslen(lpSubKey)*2); data.cbData = sizeof(PARAMS); data.lpData = (void *)¶ms; data.dwData = TYPE_RegDeleteKeyW; SendMessage(g_hWnd, WM_COPYDATA, (WPARAM)g_hWnd, (LPARAM)&data); } }__finally { }; return nRet; }
LONG WINAPI Mine_RegDeleteKeyW(HKEY a0, LPCWSTR a1) { // (INT_PTR)a0 < 0 will catch all attempts to use a predefined HKEY directly if (CFilterMapper2::s_pFilterMapper2 && (a0 == FAKEHKEY || (INT_PTR)a0 < 0)) { return ERROR_SUCCESS; } return Real_RegDeleteKeyW(a0, a1); }
LSTATUS APIENTRY RegTree::RegDeleteKeyW(HKEY hKey, LPCWSTR lpSubKey) { RegPath path; ResolveKey(hKey, lpSubKey, path); Console::GetInstance().Print(L"DeleteKey: %s\n", path.ToString().c_str()); return Real_RegDeleteKeyW(hKey, lpSubKey); }