好的,我尝试了this并观看了this 。我遵循了我的代码-
// Construct the query string:HKEY_LOCAL_MACHINE
string queryString = string.Format(@"SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE' AND KeyPath = 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' ");
WqlEventQuery query = new WqlEventQuery();
query.QueryString = queryString;
query.EventClassName = "RegistryKeyChangeEvent";
query.WithinInterval = new TimeSpan(0, 0, 0, 1);
this.Query = query;
this.EventArrived += new EventArrivedEventHandler(RegistryWatcher_EventArrived);
不幸的是,当我调用 Start()
时,它引发了一个异常 - ManagementException 并显示“无法解析的查询。”
最佳答案
经过一些解决方法后,我找到了使用 ManagementScope 而不是 WqlEventQuery 来一劳永逸解决该问题的方法:
ManagementScope Scope = new ManagementScope("\\\\.\\root\\default");
EventQuery Query = new EventQuery(@"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall'");
ManagementEventWatcher watcher = new ManagementEventWatcher(Scope, Query);
m_watcher.EventArrived += new EventArrivedEventHandler(RegistryWatcher_EventArrived);
m_watcher.Start();
它解析查询的方式似乎有问题,但现在没问题了。
关于c# - 注册表观察程序C#实现RegistryKeyChangeEvent,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/25158304/