void InitSelectedFilterRule()
{
if (null == selectedFilterRule)
{
selectedFilterRule = new RegistryFilterRule();
selectedFilterRule.AccessFlag = FilterAPI.MAX_REGITRY_ACCESS_FLAG;
selectedFilterRule.RegCallbackClass = 93092006832128; //by default only register post callback class
selectedFilterRule.ProcessNameFilterMask = "*";
selectedFilterRule.RegistryKeyNameFilterMask = "*";
}
if (selectedFilterRule.ProcessId.Length > 0 && selectedFilterRule.ProcessId != "0")
{
textBox_ProcessId.Text = selectedFilterRule.ProcessId;
radioButton_Pid_Click(null, null);
}
else
{
radioButton_Name_Click(null, null);
textBox_ProcessName.Text = selectedFilterRule.ProcessNameFilterMask;
}
textBox_RegistryKeyNameFilterMask.Text = selectedFilterRule.RegistryKeyNameFilterMask;
textBox_AccessFlags.Text = selectedFilterRule.AccessFlag.ToString();
textBox_RegistryCallbackClass.Text = selectedFilterRule.RegCallbackClass.ToString();
checkBox_isExcludeFilter.Checked = selectedFilterRule.IsExcludeFilter;
}
private void listView_FilterRules_SelectedIndexChanged(object sender, EventArgs e)
{
if (listView_FilterRules.SelectedItems.Count > 0)
{
selectedFilterRule = (RegistryFilterRule)listView_FilterRules.SelectedItems[0].Tag;
InitSelectedFilterRule();
}
}
public RegistryFilterRule Copy()
{
RegistryFilterRule dest = new RegistryFilterRule();
dest.ProcessId = ProcessId;
dest.ProcessNameFilterMask = ProcessNameFilterMask;
dest.UserName = UserName;
dest.AccessFlag = AccessFlag;
dest.RegCallbackClass = RegCallbackClass;
dest.IsExcludeFilter = IsExcludeFilter;
return(dest);
}
private void AddItem(RegistryFilterRule newRule)
{
string[] itemStr = new string[listView_FilterRules.Columns.Count];
itemStr[0] = listView_FilterRules.Items.Count.ToString();
itemStr[1] = newRule.ProcessId;
itemStr[2] = newRule.ProcessNameFilterMask;
itemStr[3] = newRule.RegistryKeyNameFilterMask;
itemStr[4] = newRule.AccessFlag.ToString();
itemStr[5] = newRule.RegCallbackClass.ToString();
ListViewItem item = new ListViewItem(itemStr, 0);
item.Tag = newRule;
listView_FilterRules.Items.Add(item);
}
private void button_DeleteFilter_Click(object sender, EventArgs e)
{
if (listView_FilterRules.SelectedItems.Count == 0)
{
MessageBoxHelper.PrepToCenterMessageBoxOnForm(this);
MessageBox.Show("There are no filter rule selected.", "Delete Filter Rule", MessageBoxButtons.OK, MessageBoxIcon.Error);
return;
}
foreach (System.Windows.Forms.ListViewItem item in listView_FilterRules.SelectedItems)
{
RegistryFilterRule filterRule = (RegistryFilterRule)item.Tag;
GlobalConfig.RemoveRegistryFilterRule(filterRule);
}
InitListView();
}
private void button_AddFilter_Click(object sender, EventArgs e)
{
try
{
selectedFilterRule = new RegistryFilterRule();
if (textBox_ProcessId.Text.Trim().Length > 0 && textBox_ProcessId.Text != "0")
{
//please note that the process Id will be changed when the process launch every time.
selectedFilterRule.ProcessId = textBox_ProcessId.Text;
selectedFilterRule.ProcessNameFilterMask = "";
}
else if (textBox_ProcessName.Text.Trim().Length > 0)
{
selectedFilterRule.ProcessId = "";
selectedFilterRule.ProcessNameFilterMask = textBox_ProcessName.Text;
}
else
{
MessageBoxHelper.PrepToCenterMessageBoxOnForm(this);
MessageBox.Show("The process name mask and Pid can't be null.", "Add Filter Rule", MessageBoxButtons.OK, MessageBoxIcon.Error);
return;
}
selectedFilterRule.RegistryKeyNameFilterMask = textBox_RegistryKeyNameFilterMask.Text;
//this is the key of the filter rule for registry filter rule
selectedFilterRule.IsExcludeFilter = checkBox_isExcludeFilter.Checked;
selectedFilterRule.AccessFlag = uint.Parse(textBox_AccessFlags.Text);
selectedFilterRule.RegCallbackClass = ulong.Parse(textBox_RegistryCallbackClass.Text);
GlobalConfig.AddRegistryFilterRule(selectedFilterRule);
InitListView();
}
catch (Exception ex)
{
MessageBoxHelper.PrepToCenterMessageBoxOnForm(this);
MessageBox.Show("Add registry filter rule failed." + ex.Message, "Add Filter Rule", MessageBoxButtons.OK, MessageBoxIcon.Error);
return;
}
}
public void InitListView()
{
//init ListView control
listView_FilterRules.Clear(); //clear control
//create column header for ListView
listView_FilterRules.Columns.Add("#", 20, System.Windows.Forms.HorizontalAlignment.Left);
listView_FilterRules.Columns.Add("ProcessId", 50, System.Windows.Forms.HorizontalAlignment.Left);
listView_FilterRules.Columns.Add("ProcessName", 100, System.Windows.Forms.HorizontalAlignment.Left);
listView_FilterRules.Columns.Add("KeyNameMask", 100, System.Windows.Forms.HorizontalAlignment.Left);
listView_FilterRules.Columns.Add("AccessFlags", 100, System.Windows.Forms.HorizontalAlignment.Left);
listView_FilterRules.Columns.Add("CallbackClass", 100, System.Windows.Forms.HorizontalAlignment.Left);
foreach (RegistryFilterRule rule in GlobalConfig.RegistryFilterRules.Values)
{
AddItem(rule);
selectedFilterRule = rule;
}
InitSelectedFilterRule();
}
public static void AddRegistryFilterRule(RegistryFilterRule registryFilterRule)
{
registryFilterRuleSection.Instances.Add(registryFilterRule);
return;
}
public void Remove(RegistryFilterRule RegistryFilterRule)
{
BaseRemove(RegistryFilterRule.ProcessId.ToString() + RegistryFilterRule.ProcessNameFilterMask);
}
public void Add(RegistryFilterRule RegistryFilterRule)
{
BaseAdd(RegistryFilterRule);
}
