Registry item value monitoring method and device, equipment and storage medium
By loading the registry keys into the preset tree structure and generating a monitoring process, comprehensive monitoring of all registry keys is achieved, and omissions and cumbersome problems in the existing technology are solved, improving monitoring efficiency and comprehensiveness.
Patent Information
- Application Number
- CN202411085804.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-08
- Publication Date
- 2024-12-13
AI Technical Summary
The prior art is prone to missing important registry key values in registry key value monitoring, and the monitoring process is cumbersome and lacks full monitoring tools.
By loading the target registry key into the preset tree structure, the corresponding monitoring process is generated, and the monitoring process compares the current registry key value with the target registry key value to achieve comprehensive monitoring of all registry keys and avoids subsequent Add a specific registry key action.
Improve the efficiency and comprehensiveness of registry key value monitoring, ensure effective monitoring of all registry keys, avoid missing important items, and achieve efficient real-time monitoring.
Smart Images
Figure CN119127332A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment and storage medium for monitoring registry key values. Background Art
[0002] The registry is a core database in the Windows operating system, which stores various parameters and directly controls the startup of Windows, the loading of hardware drivers, and the operation of some Windows applications, thus playing a core role in the entire system. In system maintenance and operation, the changes in some registry key values are particularly important, so it is very important to be able to monitor the changes in these registry key values in real time.
[0003] In the related art, when monitoring the registry key value, it is usually necessary to manually add the path to be monitored, so as to monitor the corresponding registry key value. However, when monitoring the registry key value in the above manner, there is a problem of missing important registry key values to be monitored. Summary of the invention
[0004] The present application aims to at least solve the technical problems existing in the prior art. To this end, the first aspect of the present application proposes a registration item value monitoring method, the method comprising:
[0005] Load each target registry key into the preset tree structure;
[0006] For each target registry entry loaded in the preset tree structure, a monitoring process corresponding to the target registry entry is generated;
[0007] Monitoring the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through the monitoring process;
[0008] When the monitoring process detects that the current registry key has changed, the current registry key value is compared with the target registry key value, and the monitoring result of the current registry key is obtained according to the comparison result.
[0009] In a possible implementation, loading each target registry entry into a preset tree structure includes:
[0010] Obtain all target registry entries in the operating system; wherein each target registry entry includes at least one target registry sub-entry;
[0011] All target registry entries are assembled according to a preset tree structure, and each target registry entry is loaded into the preset tree structure.
[0012] In a possible implementation, for each target registry entry loaded in a preset tree structure, generating a monitoring process corresponding to the target registry entry includes:
[0013] For each target registry entry loaded in the preset tree structure, obtain the name information of the target registry entry;
[0014] A monitoring process corresponding to the target registry entry is generated based on the name information of the target registry entry through a preset interface.
[0015] In a possible implementation, the method further includes:
[0016] For the monitoring process corresponding to each target registry entry, identification information corresponding to the monitoring process is generated, wherein the identification information corresponds to the monitoring process one by one.
[0017] In a possible implementation, monitoring the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through the monitoring process includes:
[0018] Obtaining a current registry key value corresponding to the current registry key, and searching for identification information of a target registry key corresponding to the current registry key in a preset tree structure, and obtaining a target registry key value of the target registry key;
[0019] According to the first hash value corresponding to the current registry entry value and the second hash value corresponding to the target registry entry value, changes of the current registry entry are monitored.
[0020] In a possible implementation, the method further includes:
[0021] If the first hash value is inconsistent with the second hash value, it is determined that the current registry entry has changed.
[0022] In a possible implementation, the current registry key value is compared with the target registry key value, and a monitoring result of the current registry key is obtained according to the comparison result, including:
[0023] Compare the current registry key value with the target registry key value in terms of numerical value and data type through a preset interface to generate a comparison result;
[0024] The monitoring result of the current registry key is obtained based on the comparison result.
[0025] The second aspect of the present application provides a registration item value monitoring device, the device comprising:
[0026] A loading module is used to load each target registry entry into a preset tree structure;
[0027] A generation module, for generating a monitoring process corresponding to each target registry entry loaded in a preset tree structure;
[0028] A monitoring module, used for monitoring a current registry key value corresponding to the current registry key and a target registry key value of a target registry key corresponding to the current registry key in a preset tree structure through a monitoring process;
[0029] The comparison module is used to compare the current registry key value with the target registry key value when the monitoring process monitors that the current registry key has changed, and obtain the monitoring result of the current registry key according to the comparison result.
[0030] In a possible implementation manner, the above-mentioned loading module is specifically used for:
[0031] Obtain all target registry entries in the operating system; wherein each target registry entry includes at least one target registry sub-entry;
[0032] All target registry entries are assembled according to a preset tree structure, and each target registry entry is loaded into the preset tree structure.
[0033] In a possible implementation manner, the generation module is specifically used to:
[0034] For each target registry entry loaded in the preset tree structure, obtain the name information of the target registry entry;
[0035] A monitoring process corresponding to the target registry entry is generated based on the name information of the target registry entry through a preset interface.
[0036] In a possible implementation manner, the above-mentioned registry key value monitoring device is further used for:
[0037] For the monitoring process corresponding to each target registry entry, identification information corresponding to the monitoring process is generated, wherein the identification information corresponds to the monitoring process one by one.
[0038] In a possible implementation manner, the monitoring module is specifically used to:
[0039] Obtaining a current registry key value corresponding to the current registry key, and searching for identification information of a target registry key corresponding to the current registry key in a preset tree structure, and obtaining a target registry key value of the target registry key;
[0040] According to the first hash value corresponding to the current registry entry value and the second hash value corresponding to the target registry entry value, changes of the current registry entry are monitored.
[0041] In a possible implementation manner, the above-mentioned registry key value monitoring device is further used for:
[0042] If the first hash value is inconsistent with the second hash value, it is determined that the current registry entry has changed.
[0043] In a possible implementation, the comparison module is specifically used for:
[0044] Compare the current registry key value with the target registry key value in terms of numerical value and data type through a preset interface to generate a comparison result;
[0045] The monitoring result of the current registry key is obtained based on the comparison result.
[0046] A third aspect of the present application proposes an electronic device, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the registry key value monitoring method as described in the first aspect.
[0047] In a fourth aspect, the present application proposes a computer-readable storage medium, in which at least one instruction, at least one program, a code set or an instruction set is stored. The at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the registry key value monitoring method as described in the first aspect.
[0048] The embodiments of the present application have the following beneficial effects:
[0049] The embodiment of the present application provides a method for monitoring the value of a registry key, the method comprising: loading each target registry key into a preset tree structure, generating a monitoring process corresponding to the target registry key for each target registry key loaded in the preset tree structure, monitoring the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through the monitoring process, and when the monitoring process monitors that the current registry key has changed, comparing the current registry key value with the target registry key value, and obtaining the monitoring result of the current registry key according to the comparison result. This scheme can realize comprehensive and full monitoring of all registry keys through the monitoring process corresponding to each target registry key, and after the registry key value monitoring method is started once, no other operations are required to be performed subsequently, and no specific registry keys need to be added, thereby improving the efficiency of monitoring the value of the registry key, ensuring the comprehensiveness and effectiveness of the monitoring, and not missing important registry keys; in addition, by creating a monitoring process for each target registry key separately, the changes of a single target registry key can be monitored efficiently and in real time. BRIEF DESCRIPTION OF THE DRAWINGS
[0050] Figure 1A block diagram of a computer device provided in an embodiment of the present application;
[0051] Figure 2 A flowchart of the steps of the method for monitoring the value of a registry key provided in an embodiment of the present application;
[0052] Figure 3 A flowchart of the steps of loading a target registry entry provided in an embodiment of the present application;
[0053] Figure 4 A flowchart of the steps for generating a monitoring process provided in an embodiment of the present application;
[0054] Figure 5 A flowchart of the steps for monitoring the current registration item provided in an embodiment of the present application;
[0055] Figure 6 A flowchart of steps for comparing a current registry key value with a target registry key value provided in an embodiment of the present application;
[0056] Figure 7 A structural block diagram of a registration item value monitoring device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0058] The registry is a core database in the Windows operating system, which stores various parameters and directly controls the startup of Windows, the loading of hardware drivers, and the operation of some Windows applications, thus playing a core role in the entire system. These functions include the relevant configuration and status information of software and hardware. For example, the registry stores the initial conditions, preferences, and uninstall data of applications and resource manager shells, the settings and various permissions of the entire system of networked computers, the association between file extensions and applications, the description, status and properties of hardware components, performance records and other underlying system status information, and other data. Changes in some registry key values are particularly important in system maintenance and operation, so it is very important to be able to monitor these registry key value changes in real time.
[0059] There are basically two types of monitoring methods that have emerged. One is to specify the registry items that need to be monitored. This method requires specifying the registry items to be monitored, and to add new monitoring items, you need to find the entry. Adding new registry items is too cumbersome, and some special items are not added, and they are tampered with without knowing it. The other is that it cannot monitor the changes in specific registry item values or data types. It only notifies that some values in the registry items have changed. If you want to get the specific changes, you need to manually compare and query them one by one; in addition, if you need to obtain the specific value changes while monitoring all registry items, from the current tools, you have not found a tool that is compatible with these two methods.
[0060] In view of this, the present application proposes a method, device, equipment and storage medium for monitoring the value of a registry key, the method comprising: loading each target registry key into a preset tree structure, generating a monitoring process corresponding to the target registry key for each target registry key loaded in the preset tree structure, monitoring the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through the monitoring process, and when the monitoring process monitors that the current registry key has changed, comparing the current registry key value with the target registry key value, and obtaining the monitoring result of the current registry key according to the comparison result. This scheme can realize comprehensive and full monitoring of all registry keys through the monitoring process corresponding to each target registry key, and after the registry key value monitoring method is started once, no other operations are required to be performed subsequently, and no specific registry keys need to be added, thereby improving the efficiency of monitoring the value of the registry key, ensuring the comprehensiveness and effectiveness of the monitoring, and not missing important registry keys; in addition, by creating a monitoring process for each target registry key separately, the changes of a single target registry key can be monitored efficiently and in real time.
[0061] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "multiple" means two or more. In addition, the use of "based on" or "according to" means openness and inclusiveness, because the process, steps, calculations or other actions "based on" or "according to" one or more of the conditions or values may be based on additional conditions or values beyond the described values in practice.
[0062] The registry key value monitoring method provided in the present application can be applied to a computer device (electronic device), which can be a server or a terminal, wherein the server can be a single server or a server cluster composed of multiple servers. The embodiments of the present application do not specifically limit this. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices.
[0063] Take the computer device as a server as an example. Figure 1 A block diagram of a server is shown, such as Figure 1 As shown, the server may include a processor and a memory connected via a system bus. The processor of the server is used to provide computing and control capabilities. The memory of the server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. When the computer program is executed by the processor, a method for monitoring a registry key value is implemented.
[0064] Those skilled in the art will understand that Figure 1 The structure shown in the figure is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the server to which the solution of the present application is applied. Optionally, the server may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.
[0065] It should be noted that the execution subject of the embodiment of the present application can be a computer device or a registry key value monitoring device. The following method embodiment will be described using a computer device as the execution subject.
[0066] Figure 2 The following is a flowchart of the steps of the method for monitoring the value of a registry key provided in the embodiment of the present application. Figure 2 As shown, the method comprises the following steps:
[0067] Step 202: Load each target registry entry into a preset tree structure.
[0068] The registry is a core database in the Windows operating system, which stores various parameters and directly controls the startup of Windows, the loading of hardware drivers, and the operation of some Windows applications. The registry is usually a cascading structure, consisting of configuration units, items, sub-items, and values. Changing the corresponding items, sub-items, and values in the registry can solve some system problems.
[0069] When monitoring each target registry entry in the Windows operating system, each target registry entry needs to be loaded into a preset tree structure first. In some optional embodiments, such as Figure 3 As shown, Figure 3 A flowchart of steps for loading a target registry entry provided in an embodiment of the present application includes:
[0070] Step 302: Obtain all target registry entries in the operating system.
[0071] Step 304: assemble all target registry entries according to the preset tree structure, and load each target registry entry into the preset tree structure.
[0072] Among them, all target registry items in the operating system may be obtained first, each target registry item including at least one target registry sub-item. Then, all target registry items may be assembled according to a preset tree structure, and each target registry item may be loaded into the preset tree structure.
[0073] Since the preset tree structure includes root nodes and child nodes, the target registry items and target registry sub-items can be assembled correspondingly according to this structural relationship, that is, the root node in the preset tree structure can be corresponded to the target registry item, and the child node can be corresponded to the target registry sub-item, so that all target registry items can be loaded into the preset tree structure.
[0074] Step 204: for each target registry entry loaded in the preset tree structure, generate a monitoring process corresponding to the target registry entry.
[0075] After each target registry item is loaded into the preset tree structure, that is, after the target registry item is loaded successfully, a monitoring process corresponding to the target registry item can be generated for each target registry item loaded in the preset tree structure. It should be noted that, usually, each target registry item can be successfully loaded into the preset tree structure.
[0076] In some optional embodiments, Figure 4 As shown, Figure 4 A flowchart of the steps of generating a monitoring process provided in an embodiment of the present application includes:
[0077] Step 402: For each target registry entry loaded in the preset tree structure, obtain the name information of the target registry entry.
[0078] Step 404: Generate a monitoring process corresponding to the target registry entry based on the name information of the target registry entry through a preset interface.
[0079] Among them, when generating a monitoring process, it is necessary to first obtain the name information of the target registry item for each target registry item loaded in the preset tree structure, and then add corresponding monitoring events based on the name information of the target registry item through the preset interface, that is, the windows api, so that the monitoring process corresponding to the target registry item can be obtained.
[0080] Optionally, identification information corresponding to the monitoring process may be generated for the monitoring process corresponding to each target registry entry, wherein the identification information corresponds to the monitoring process one-to-one, that is, a unique corresponding monitoring process needs to be generated for each target registry entry.
[0081] Optionally, when generating identification information corresponding to the monitoring process, it can also be randomly generated. The identification information can be ID information or other types of identification information. As long as it can distinguish each monitoring process, the embodiment of the present application does not make specific limitations on this.
[0082] Step 206: Monitor the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through the monitoring process.
[0083] After the corresponding monitoring process is generated, the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure can be monitored through the monitoring process.
[0084] In some optional embodiments, Figure 5 As shown, Figure 5 A flowchart of the steps for monitoring the current registration item provided in the embodiment of the present application includes:
[0085] Step 502: Obtain a current registry key value corresponding to the current registry key, search for identification information of a target registry key corresponding to the current registry key in a preset tree structure, and obtain a target registry key value of the target registry key.
[0086] Step 504: Monitor changes of the current registry entry according to the first hash value corresponding to the current registry entry value and the second hash value corresponding to the target registry entry value.
[0087] Among them, the current registry key value corresponding to the current registry key and the target registry key value of the target registry key in the preset tree structure can be stored in a MAP structure, and the MAP structure can be implemented by a hash table. The MAP structure is an associative array data structure that stores key-value pairs and allows the corresponding values to be directly accessed using the keys. The keys in the MAP structure are unique, each key appears at most once, and each key is associated with a value. This data structure is very useful when it is necessary to quickly find and retrieve data.
[0088] Therefore, when monitoring the current registry item, the current registry item value corresponding to the current registry item can be obtained, and the identification information of the target registry item corresponding to the current registry item can be searched in the preset tree structure to obtain the target registry item value of the target registry item.
[0089] Then, the change of the current registry item can be monitored according to the first hash value corresponding to the current registry item value and the second hash value corresponding to the target registry item value. Among them, after calculating the first hash value corresponding to the current registry item value and calculating the second hash value corresponding to the target registry item value, it can be determined whether the current registry item has changed by comparing the first hash value with the second hash value.
[0090] In this embodiment, an efficient data storage structure is designed to support real-time monitoring and fast query, that is, the target registry item value of the target registry item in the preset tree structure is stored in a MAP structure, and the target registry item value of the target registry item can be quickly obtained by searching the preset tree structure for the identification information of the target registry item corresponding to the current registry item, thereby improving the real-time and efficiency of subsequent monitoring of the current registry item.
[0091] Step 208: When the monitoring process detects that the current registry entry has changed, the current registry entry value is compared with the target registry entry value, and a monitoring result of the current registry entry is obtained according to the comparison result.
[0092] When monitoring whether the current registry entry has changed, by comparing the first hash value with the second hash value, if the first hash value is inconsistent with the second hash value, it is determined that the current registry entry has changed.
[0093] When the current registry key changes, the current registry key value may be specifically compared with the target registry key value, and the monitoring result of the current registry key may be obtained according to the comparison result.
[0094] In some optional embodiments, Figure 6 As shown, Figure 6 A flowchart of steps for comparing a current registry key value with a target registry key value provided in an embodiment of the present application includes:
[0095] Step 602: compare the current registry key value with the target registry key value in terms of numerical value and data type through a preset interface to generate a comparison result.
[0096] Step 604: Obtain monitoring results of the current registry entry based on the comparison results.
[0097] The current registry key value and the target registry key value are compared in terms of numerical value and data type through a preset interface, thereby obtaining a comparison result, which may include specific changes in numerical value and data type.
[0098] Therefore, the monitoring result of the current registry item can be obtained based on the comparison result, that is, the comparison result can be directly returned as the monitoring result of the current registry item.
[0099] In this embodiment, by comparing the current registry item value with the target registry item value in terms of numerical value and data type, changes in the specific value of the current registry item and changes in the data type can be accurately detected. This is not limited to notifications of changes in the current registry item, thereby improving the precision and accuracy of monitoring.
[0100] The embodiment of the present application provides a method for monitoring the value of a registry key, the method comprising: loading each target registry key into a preset tree structure, generating a monitoring process corresponding to the target registry key for each target registry key loaded in the preset tree structure, monitoring the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through the monitoring process, and when the monitoring process monitors that the current registry key has changed, comparing the current registry key value with the target registry key value, and obtaining the monitoring result of the current registry key according to the comparison result. This scheme can realize comprehensive and full monitoring of all registry keys through the monitoring process corresponding to each target registry key, and after the registry key value monitoring method is started once, no other operations are required to be performed subsequently, and no specific registry keys need to be added, thereby improving the efficiency of monitoring the value of the registry key, ensuring the comprehensiveness and effectiveness of the monitoring, and not missing important registry keys; in addition, by creating a monitoring process for each target registry key separately, the changes of a single target registry key can be monitored efficiently and in real time.
[0101] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0102] Figure 7 A structural block diagram of a registration item value monitoring device provided in an embodiment of the present application.
[0103] like Figure 7 As shown, the registration key value monitoring device 700 includes:
[0104] The loading module 702 is used to load each target registry entry into a preset tree structure.
[0105] The generating module 704 is used to generate a monitoring process corresponding to each target registry entry loaded in the preset tree structure.
[0106] The monitoring module 706 is used to monitor the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through a monitoring process.
[0107] The comparison module 708 is used to compare the current registry entry value with the target registry entry value when the monitoring process monitors that the current registry entry has changed, and obtain the monitoring result of the current registry entry according to the comparison result.
[0108] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be described in detail here. Each module in the above registry key value monitoring device can be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations of each of the above modules.
[0109] In one embodiment of the present application, a computer device is provided, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:
[0110] Load each target registry key into the preset tree structure;
[0111] For each target registry entry loaded in the preset tree structure, a monitoring process corresponding to the target registry entry is generated;
[0112] Monitoring the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through the monitoring process;
[0113] When the monitoring process detects that the current registry key has changed, the current registry key value is compared with the target registry key value, and the monitoring result of the current registry key is obtained according to the comparison result.
[0114] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:
[0115] Obtain all target registry entries in the operating system; wherein each target registry entry includes at least one target registry sub-entry;
[0116] All target registry entries are assembled according to a preset tree structure, and each target registry entry is loaded into the preset tree structure.
[0117] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:
[0118] For each target registry entry loaded in the preset tree structure, obtain the name information of the target registry entry;
[0119] A monitoring process corresponding to the target registry entry is generated based on the name information of the target registry entry through a preset interface.
[0120] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:
[0121] For the monitoring process corresponding to each target registry entry, identification information corresponding to the monitoring process is generated, wherein the identification information corresponds to the monitoring process one by one.
[0122] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:
[0123] Obtaining a current registry key value corresponding to the current registry key, and searching for identification information of a target registry key corresponding to the current registry key in a preset tree structure, and obtaining a target registry key value of the target registry key;
[0124] According to the first hash value corresponding to the current registry entry value and the second hash value corresponding to the target registry entry value, changes of the current registry entry are monitored.
[0125] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:
[0126] If the first hash value is inconsistent with the second hash value, it is determined that the current registry entry has changed.
[0127] In one embodiment of the present application, when the processor executes the computer program, the processor further implements the following steps:
[0128] Compare the current registry key value with the target registry key value in terms of numerical value and data type through a preset interface to generate a comparison result;
[0129] The monitoring result of the current registry key is obtained based on the comparison result.
[0130] The computer device provided in the embodiment of the present application has similar implementation principles and technical effects to those of the above-mentioned method embodiment, and will not be described in detail here.
[0131] In one embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:
[0132] Load each target registry key into the preset tree structure;
[0133] For each target registry entry loaded in the preset tree structure, a monitoring process corresponding to the target registry entry is generated;
[0134] Monitoring the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure through the monitoring process;
[0135] When the monitoring process detects that the current registry key has changed, the current registry key value is compared with the target registry key value, and the monitoring result of the current registry key is obtained according to the comparison result.
[0136] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:
[0137] Obtain all target registry entries in the operating system; wherein each target registry entry includes at least one target registry sub-entry;
[0138] All target registry entries are assembled according to a preset tree structure, and each target registry entry is loaded into the preset tree structure.
[0139] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:
[0140] For each target registry entry loaded in the preset tree structure, obtain the name information of the target registry entry;
[0141] A monitoring process corresponding to the target registry entry is generated based on the name information of the target registry entry through a preset interface.
[0142] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:
[0143] For the monitoring process corresponding to each target registry entry, identification information corresponding to the monitoring process is generated, wherein the identification information corresponds to the monitoring process one by one.
[0144] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:
[0145] Obtaining a current registry key value corresponding to the current registry key, and searching for identification information of a target registry key corresponding to the current registry key in a preset tree structure, and obtaining a target registry key value of the target registry key;
[0146] According to the first hash value corresponding to the current registry entry value and the second hash value corresponding to the target registry entry value, changes of the current registry entry are monitored.
[0147] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:
[0148] If the first hash value is inconsistent with the second hash value, it is determined that the current registry entry has changed.
[0149] In one embodiment of the present application, when the computer program is executed by a processor, the following steps are further implemented:
[0150] Compare the current registry key value with the target registry key value in terms of numerical value and data type through a preset interface to generate a comparison result;
[0151] The monitoring result of the current registry key is obtained based on the comparison result.
[0152] The computer-readable storage medium provided in this embodiment has similar implementation principles and technical effects to those of the above method embodiments, and will not be described in detail here.
[0153] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
[0154] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.
[0155] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.
Claims
1. A method for monitoring a registry key value, characterized in that: The method comprises: Load each target registry key into the preset tree structure; For each target registry entry loaded in the preset tree structure, generating a monitoring process corresponding to the target registry entry; Monitoring, by the monitoring process, a current registry key value corresponding to the current registry key and a target registry key value of the target registry key corresponding to the current registry key in the preset tree structure; When the monitoring process monitors that the current registry entry has changed, the current registry entry value is compared with the target registry entry value, and a monitoring result of the current registry entry is obtained according to the comparison result.
2. The method according to claim 1, characterized in that The step of loading each target registry entry into a preset tree structure includes: Acquire all target registry entries in the operating system; wherein each of the target registry entries includes at least one target registry sub-entry; All the target registry entries are assembled according to the preset tree structure, and each of the target registry entries is loaded into the preset tree structure.
3. The method according to claim 1 or 2, characterized in that: The step of generating a monitoring process corresponding to each target registry entry loaded in the preset tree structure includes: For each target registry entry loaded in the preset tree structure, obtaining name information of the target registry entry; A monitoring process corresponding to the target registry entry is generated based on the name information of the target registry entry through a preset interface.
4. The method according to claim 1, characterized in that: The method further comprises: For the monitoring process corresponding to each of the target registry entries, identification information corresponding to the monitoring process is generated, wherein the identification information corresponds to the monitoring process one by one.
5. The method according to claim 4, characterized in that The monitoring of the current registry key value corresponding to the current registry key and the target registry key value of the target registry key corresponding to the current registry key in the preset tree structure by the monitoring process includes: Acquire a current registry key value corresponding to the current registry key, and search the preset tree structure for identification information of the target registry key corresponding to the current registry key to acquire a target registry key value of the target registry key; According to the first Hash value corresponding to the current registry entry value and the second Hash value corresponding to the target registry entry value, changes of the current registry entry are monitored.
6. The method according to claim 5, characterized in that The method further comprises: If the first hash value is inconsistent with the second hash value, it is determined that the current registry entry has changed.
7. The method according to claim 1 or 2, characterized in that: The comparing the current registry key value with the target registry key value, and obtaining the monitoring result of the current registry key according to the comparison result, includes: Compare the current registry entry value with the target registry entry value in terms of numerical value and data type through a preset interface to generate a comparison result; A monitoring result of the current registration item is obtained based on the comparison result.
8. A device for monitoring a registry key value, characterized in that: The device comprises: A loading module is used to load each target registry entry into a preset tree structure; A generating module, for generating a monitoring process corresponding to each target registry entry loaded in the preset tree structure; A monitoring module, configured to monitor, through the monitoring process, a current registry key value corresponding to the current registry key and a target registry key value of the target registry key corresponding to the current registry key in the preset tree structure; The comparison module is used to compare the current registry entry value with the target registry entry value when the monitoring process monitors the current registry entry to change, and obtain the monitoring result of the current registry entry according to the comparison result.
9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the method described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the method described in any one of claims 1 to 7.