CBRegistry Class
Properties Methods Events Configuration Settings Errors
The CBRegistry class allows applications to intercept and control registry requests.
Syntax
class cbfsfilter.CBRegistry
Remarks
The CBRegistry class gives applications the ability to intercept and registry requests, allowing them to be altered, handled, blocked, etc. Applications use standard filter rules to specify which requests they're interested in intercepting; and special filter rules to enforce access restrictions.
To learn more about the class's capabilities, please refer to the product's General Information topics.
Getting Started
- If the class's system driver hasn't been installed yet, call the install method to do so. This only needs to be done once.
- In production, the driver can be installed (or updated) ahead-of-time by the application's installation script using the Installer DLL. Please refer to the Driver Installation topic for more information.
- Call the initialize method to initialize the CBRegistry class. This must be done each time the application starts.
- Add one or more filter rules using methods like add_filter_rule. (Rules can also be added/removed after the filter is started.)
- Call the start_filter method to start filtering filesystem requests.
- When finished, call the stop_filter method to stop filtering filesystem requests.
- To uninstall the class's system driver, call the uninstall method. This should not be done as part of the driver upgrade process.
- In production, the driver can be uninstalled by the application's uninstallation script using the Installer DLL. Please refer to the Driver Installation topic for more information.
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
| active | Whether the class is active and processing requests. |
| altitude | The altitude the class's system driver should use. |
| default_rule_count | The number of records in the DefaultRule arrays. |
| default_rule_access_flags | The access restrictions enforced by the rule. |
| default_rule_mask | A registry key mask that determines which registry keys match the rule. |
| filter_rule_count | The number of records in the FilterRule arrays. |
| filter_rule_access_flags | The access restrictions enforced by the rule. |
| filter_rule_control_flags | Which control events the rule causes the class to fire. |
| filter_rule_mask | A registry key mask that determines which registry keys match the rule. |
| passthrough_rule_count | The number of records in the PassthroughRule arrays. |
| passthrough_rule_access_flags | The access restrictions lifted by the rule. |
| passthrough_rule_control_flags | Which control events the rule prevents the class from firing. |
| passthrough_rule_mask | A registry key mask that determines which registry keys match the rule. |
| serialize_events | Whether events should be fired on a single worker thread, or many. |
| tag | Stores application-defined data specific to this instance of the class. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
| add_default_rule | Adds a default rule. |
| add_filtered_process_by_id | Adds a process, by PID, to the list of filtered processes. |
| add_filtered_process_by_name | Adds a process, by name, to the list of filtered processes. |
| add_filter_rule | Adds a standard filter rule or access rule. |
| add_ignored_process_by_id | Adds a process, by PID, to the list of ignored processes. |
| add_ignored_process_by_name | Adds a process, by name, to the list of ignored processes. |
| add_passthrough_rule | Adds a passthrough rule. |
| close_default_rules_snapshot | Closes the previously-created default rules snapshot. |
| config | Sets or retrieves a configuration setting. |
| create_default_rules_snapshot | Creates a snapshot of information about the default rules that have been added. |
| delete_all_filter_rules | Deletes all standard filter rules. |
| delete_all_passthrough_rules | Deletes all passthrough rules. |
| delete_default_rule | Deletes a particular default rule. |
| delete_filter_rule | Deletes a particular standard filter rule or access rule. |
| delete_passthrough_rule | Deletes a particular passthrough rule. |
| get_driver_status | Retrieves the status of the class's system driver. |
| get_driver_version | Retrieves the version of the class's system driver. |
| get_originator_process_id | Retrieves the Id of the process (PID) that initiated the operation. |
| get_originator_process_name | Retrieves the name of the process that initiated the operation. |
| get_originator_thread_id | Retrieves the Id of the thread that initiated the operation. |
| get_originator_token | Retrieves the security token associated with the process that initiated the operation. |
| initialize | Initializes the class. |
| install | Installs (or upgrades) the class's system driver. |
| remove_filtered_process_by_id | Removes a process, by PID, from the list of filtered processes. |
| remove_filtered_process_by_name | Removes a process, by name, from the list of filtered processes. |
| remove_ignored_process_by_id | Removes a process, by PID, from the list of ignored processes. |
| remove_ignored_process_by_name | Removes a process, by name, from the list of ignored processes. |
| reset_timeout | Resets the timeout duration for the current event handler. |
| shutdown_system | Shuts down or reboots the operating system. |
| start_filter | Start filtering registry operations. |
| stop_filter | Stop filtering registry operations. |
| suspend_default_rules | Suspends all default rules until the application exits. |
| uninstall | Uninstalls the class's system driver. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
| on_after_close_key | Fires after a registry key is closed. |
| on_after_create_key | Fires after a registry key is created. |
| on_after_delete_key | Fires after a registry key is deleted. |
| on_after_delete_value | Fires after a registry value is deleted. |
| on_after_enumerate_key | Fires after a subkey's information is retrieved during key enumeration. |
| on_after_enumerate_value | Fires after a registry value's information is retrieved during key value enumeration. |
| on_after_open_key | Fires after a registry key is opened. |
| on_after_query_key | Fires after a registry key's information is retrieved. |
| on_after_query_value | Fires after a registry value's information is retrieved. |
| on_after_rename_key | Fires after a registry key is renamed. |
| on_after_set_key | Fires after a registry key's information is updated. |
| on_after_set_value | Fires after a registry value is set or updated. |
| on_before_close_key | Fires before a registry key is closed. |
| on_before_create_key | Fires before a registry key is created. |
| on_before_delete_key | Fires before a registry key is deleted. |
| on_before_delete_value | Fires before a registry value is deleted. |
| on_before_enumerate_key | Fires before a subkey's information is retrieved during key enumeration. |
| on_before_enumerate_value | Fires before a registry value's information is retrieved during key value enumeration. |
| on_before_open_key | Fires before a registry key is opened. |
| on_before_query_key | Fires before a registry key's information is retrieved. |
| on_before_query_value | Fires before a registry value's information is retrieved. |
| on_before_rename_key | Fires before a registry key is renamed. |
| on_before_set_key | Fires before a registry key's information is updated. |
| on_before_set_value | Fires before a registry value is set or updated. |
| on_cleanup_key_context | Fires when the application-defined data stored in a registry key context needs be cleaned up. |
| on_close_key_handle | Fires when an application-provided registry key handle should be closed. |
| on_error | Fires if an unhandled error occurs during an event. |
| on_worker_thread_creation | Fires just after a new worker thread is created. |
| on_worker_thread_termination | Fires just before a worker thread is terminated. |
Configuration Settings
The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.
| FilterOwnRequests | Whether the class's system driver should filter requests made by the application itself. |
| ForceAdminRightsForDefaultRules | Specifies whether default rules can be added or deleted only by administrators. |
| LoggingEnabled | Whether extended logging is enabled. |
| MaxWorkerThreadCount | The maximum number of worker threads to use to fire events. |
| MinWorkerThreadCount | The minimum number of worker threads to use to fire events. |
| ResolveNtNameToWin32Name | Whether key names in NT native format are translated to common Win32 format. |
| WorkerInitialStackSize | The initial stack size to create worker threads with. |
| BuildInfo | Information about the product's build. |
| LicenseInfo | Information about the current license. |