How to identify registry operations are redirected/reflected?

247 views Asked by At

When we register registry callbacks using CmRegisterCallbackEx, how to identify callbacks we receive for registry operation are redirected/reflected?

1

There are 1 answers

0
lordjeb On BEST ANSWER

CmRegisterCallbackEx will call your function for every operation. It is your functions responsibility to handle the operations it needs to and to return STATUS_SUCCESS for operations that it doesn't handle so that Windows knows to call the next filter in the stack. You can read a bit more about this at this link: Registry Filter Drivers (Part 1).