Registry monitoring, including kernel-mode registry accesses?

Question

I remember for my final year university project i wrote a C# registry monitor, however, when i compared it with the Microsoft ProcessMonitor application (i cant remember its exact name, but was a company bought by MSoft), i wasnt capturing as many registry calls.

Was this because i was using a C# wrapper and as such, it would only have been catching user-mode registry accesses?

I used this wrapper: http://www.codeproject.com/KB/DLL/EasyHook64.aspx

To catch the kernel mode registry accesses would i have to write in C++?

Answer 1

Process Monitor is either using a kernel driver or ETW (see below) to capture registry events. I do know that Process Monitor uses ETW for some of its data (like networking information).

An API hooking or detouring mechanism like EasyHook typically operates at the Win32 API level (e.g. RegSetValue or RegCreateKeyEx in ADVAPI32.dll). Because of this, it has the limitation you mention: only user-mode registry accesses are captured. Additionally, API hooking is usually done on a per-process basis, so you have to inject yourself into each process that you want to collect data on. You would also have to monitor for process creation if you wanted to really capture all accesses across the system.

Event Tracing for Windows (ETW) would be an easy way (relatively speaking) to capture all registry accesses. The basic idea behind ETW is that OS, runtime, library, and even everyday application developers can add specific instrumentation to their code to log data about interesting events and scenarios. This tracing is low overhead and can be easily collected. ETW has been around for a while, but it has really gained traction throughout the kernel starting with Vista. Almost all major kernel subsystems are now instrumented with ETW. It is also now the basis for the Windows Event Log.

ETW has its fair share of baggage and lacks substantial documentation in some areas, but if you are interested, you can check out the following:

• ETW MSDN documentation
• ETW and Event Log
• Xperf (part of the Windows Performance Toolkit), used for collecting and analyzing traces
• logman.exe and tracerpt.exe for collecting and analyzing traces
• TraceEvent, a .NET library for collecting and analyzing ETW events
• Using an NT Kernel Logger from native code

To catch the kernel mode registry accesses would i have to write in C++?

No, using the TraceEvent library mentioned above, you could use C# to capture and analyze kernel- and user-mode registry accesses across the system.

Answer 2

To capture kernel-mode registry access you have to write a driver in C++, there isn't any other way to do it. Process Monitor is a driver, that's why it can capture both user and kernel accesses.

You can download old versions of Regmon and Filemon here:

http://www.decuslib.com/decus/vmslt00a/nt/filemon.htm

http://www.decuslib.com/decus/vmslt00a/nt/regmon.htm