Unit RegEvents;

Interface

{
  tento soubor obsahuje definice sturktur a kod funkci a procedur
  pro praci se zaznamy udalosti nad registrem, ktere aplikace
  ziskava z ovladace registrymon.sys.

  Definice typu udalosti - konstanty REG_EVENT_XXX - odpovidaji
  presne stejnojmennym konstantam z ovladace, nejsou tedy v tomto
  zdrojovem kodu znovu popisovany. To same plati i pro vsechny
  struktury REG_EVENT_XXX_INFO.
}

Uses
  Windows;

Const
  // 64bitova celociselna hodnota
  REG_QWORD = 11;

  REG_EVENT_POST_GENERAL = 1;
  REG_EVENT_DELETE_KEY = 2;
  REG_EVENT_DELETE_VALUE = 3;
  REG_EVENT_SET_VALUE = 4;
  REG_EVENT_SET_KEY = 5;
  REG_EVENT_RENAME_KEY = 6;
  REG_EVENT_ENUMERATE_KEY = 7;
  REG_EVENT_ENUMERATE_VALUE = 8;
  REG_EVENT_QUERY_KEY = 9;
  REG_EVENT_QUERY_VALUE = 10;
  REG_EVENT_QUERY_MULTIPLE_VALUES = 11;
  REG_EVENT_FLUSH_KEY = 12;
  REG_EVENT_CLOSE_KEY = 13;
  REG_EVENT_CREATE_KEY = 14;
  REG_EVENT_OPEN_KEY = 15;
  REG_EVENT_CREATE_KEY_EX = 16;
  REG_EVENT_OPEN_KEY_EX = 17;
  REG_EVENT_LOAD_HIVE = 18;
  REG_EVENT_UNLOAD_HIVE = 19;
  REG_EVENT_QUERY_SECURITY_KEY = 20;
  REG_EVENT_SET_SECURITY_KEY = 21;
  REG_EVENT_RESTORE_KEY = 22;
  REG_EVENT_SAVE_KEY = 23;
  REG_EVENT_REPLACE_KEY = 24;

Type
  // Prvni cast zaznamu udalosti, obsahuje obecne informace
  _UM_EVENT = Record
    // Typ udalosti (REG_EVENT_XXX)
    EventType : Integer;
    // Celkova velikost udalosti
    EventSize : Integer;
    // Cas vzniku udalosti
    EventTime : Int64;
    end;
  UM_EVENT = _UM_EVENT;
  PUM_EVENT = ^UM_EVENT;

  _REG_EVENT_GENERAL_INFO = Packed Record
    PID: Int64;
    TID : Int64;
    ResultStatus : Int64;
    Objekt : Int64;
    end;
  REG_EVENT_GENERAL_INFO = _REG_EVENT_GENERAL_INFO;
  PREG_EVENT_GENERAL_INFO = ^REG_EVENT_GENERAL_INFO;

  _REG_DATA_UNICODE_STRING = Packed Record
    Offset : Integer;
    Length : Integer;
    end;
  REG_DATA_UNICODE_STRING = _REG_DATA_UNICODE_STRING;
  PREG_DATA_UNICODE_STRING = ^REG_DATA_UNICODE_STRING;

  _REG_EVENT_DELETE_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_DELETE_KEY_INFO = _REG_EVENT_DELETE_KEY_INFO;
  PREG_EVENT_DELETE_KEY_INFO = ^REG_EVENT_DELETE_KEY_INFO;

  _REG_EVENT_DELETE_VALUE_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    ValueName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_DELETE_VALUE_INFO = _REG_EVENT_DELETE_VALUE_INFO;
  PREG_EVENT_DELETE_VALUE_INFO = ^REG_EVENT_DELETE_VALUE_INFO;

  _REG_EVENT_SET_VALUE_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    ValueName : REG_DATA_UNICODE_STRING;
    DataType : Int64;
    DataSize : Int64;
    DataOffset : Int64;
    end;
  REG_EVENT_SET_VALUE_INFO = _REG_EVENT_SET_VALUE_INFO;
  PREG_EVENT_SET_VALUE_INFO = ^REG_EVENT_SET_VALUE_INFO;

  _REG_EVENT_SET_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    DataType : Int64;
    DataSize : Int64;
    DataOffset : Int64;
    end;
  REG_EVENT_SET_KEY_INFO = _REG_EVENT_SET_KEY_INFO;
  PREG_EVENT_SET_KEY_INFO = ^REG_EVENT_SET_KEY_INFO;

  _REG_EVENT_RENAME_KEY_INFO = Packed Record
    Obence : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    NewKeyName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_RENAME_KEY_INFO = _REG_EVENT_RENAME_KEY_INFO;
  PREG_EVENT_RENAME_KEY_INFO = ^REG_EVENT_RENAME_KEY_INFO;

  _REG_EVENT_ENUMERATE_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    Index : Int64;
    DataType : Int64;
    DataSize : Int64;
    DataOffset : Int64;
    end;
  REG_EVENT_ENUMERATE_KEY_INFO = _REG_EVENT_ENUMERATE_KEY_INFO;
  PREG_EVENT_ENUMERATE_KEY_INFO = ^REG_EVENT_ENUMERATE_KEY_INFO;

  _REG_EVENT_ENUMERATE_VALUE_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    Index : Int64;
    DataType : Int64;
    DataSize : Int64;
    DataOffset : Int64;
    end;
  REG_EVENT_ENUMERATE_VALUE_INFO = _REG_EVENT_ENUMERATE_VALUE_INFO;
  PREG_EVENT_ENUMERATE_VALUE_INFO = ^REG_EVENT_ENUMERATE_VALUE_INFO;

  _REG_EVENT_QUERY_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    DataType : Int64;
    DataSize : Int64;
    DataOffset : Int64;
    end;
  REG_EVENT_QUERY_KEY_INFO = _REG_EVENT_QUERY_KEY_INFO;
  PREG_EVENT_QUERY_KEY_INFO = ^REG_EVENT_QUERY_KEY_INFO;

  _REG_EVENT_QUERY_VALUE_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    ValueName : REG_DATA_UNICODE_STRING;
    DataType : Int64;
    DataSize : Int64;
    DataOffset : Int64;
    end;
  REG_EVENT_QUERY_VALUE_INFO = _REG_EVENT_QUERY_VALUE_INFO;
  PREG_EVENT_QUERY_VALUE_INFO = ^REG_EVENT_QUERY_VALUE_INFO;

  _REG_EVENT_QUERY_MULTIPLE_VALUES_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    ValuesOffset : Integer;
    ValuesCount : Integer;
    DataOffset : Integer;
    DataSize : Integer;
    end;
  REG_EVENT_QUERY_MULTIPLE_VALUES_INFO = _REG_EVENT_QUERY_MULTIPLE_VALUES_INFO;
  PREG_EVENT_QUERY_MULTIPLE_VALUES_INFO = ^REG_EVENT_QUERY_MULTIPLE_VALUES_INFO;

  _REG_EVENT_FLUSH_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_FLUSH_KEY_INFO = _REG_EVENT_FLUSH_KEY_INFO;
  PREG_EVENT_FLUSH_KEY_INFO = ^REG_EVENT_FLUSH_KEY_INFO;

  _REG_EVENT_CLOSE_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_CLOSE_KEY_INFO = _REG_EVENT_CLOSE_KEY_INFO;
  PREG_EVENT_CLOSE_KEY_INFO = ^REG_EVENT_CLOSE_KEY_INFO;

  _REG_EVENT_CREATE_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_CREATE_KEY_INFO = _REG_EVENT_CREATE_KEY_INFO;
  PREG_EVENT_CREATE_KEY_INFO = ^REG_EVENT_CREATE_KEY_INFO;

  _REG_EVENT_OPEN_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_OPEN_KEY_INFO = _REG_EVENT_OPEN_KEY_INFO;
  PREG_EVENT_OPEN_KEY_INFO = ^REG_EVENT_OPEN_KEY_INFO;

  _REG_EVENT_CREATE_KEY_EX_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    SubkeyName : REG_DATA_UNICODE_STRING;
    RootkeyName : REG_DATA_UNICODE_STRING;
    DesiredAccess : Int64;
    GrantedAccess : Int64;
    Options : Int64;
    end;
  REG_EVENT_CREATE_KEY_EX_INFO = _REG_EVENT_CREATE_KEY_EX_INFO;
  PREG_EVENT_CREATE_KEY_EX_INFO = ^REG_EVENT_CREATE_KEY_EX_INFO;

  _REG_EVENT_OPEN_KEY_EX_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    SubkeyName : REG_DATA_UNICODE_STRING;
    RootkeyName : REG_DATA_UNICODE_STRING;
    DesiredAccess : Int64;
    GrantedAccess : Int64;
    end;
  REG_EVENT_OPEN_KEY_EX_INFO = _REG_EVENT_OPEN_KEY_EX_INFO;
  PREG_EVENT_OPEN_KEY_EX_INFO = ^REG_EVENT_OPEN_KEY_EX_INFO;

  _REG_EVENT_LOAD_HIVE_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    SubkeyName : REG_DATA_UNICODE_STRING;
    RootkeyName : REG_DATA_UNICODE_STRING;
    FileName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_LOAD_HIVE_INFO = _REG_EVENT_LOAD_HIVE_INFO;
  PREG_EVENT_LOAD_HIVE_INFO = ^REG_EVENT_LOAD_HIVE_INFO;

  _REG_EVENT_UNLOAD_HIVE_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_UNLOAD_HIVE_INFO = _REG_EVENT_UNLOAD_HIVE_INFO;
  PREG_EVENT_UNLOAD_HIVE_INFO = ^REG_EVENT_UNLOAD_HIVE_INFO;

  _REG_EVENT_QUERY_KEY_SECURITY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    SecurityOperationType : Int64;
    SecurityDescriptorLength : Integer;
    SecurityDescriptorOffset : Integer;
    end;
  REG_EVENT_QUERY_KEY_SECURITY_INFO = _REG_EVENT_QUERY_KEY_SECURITY_INFO;
  PREG_EVENT_QUERY_KEY_SECURITY_INFO = ^REG_EVENT_QUERY_KEY_SECURITY_INFO;

  _REG_EVENT_SET_KEY_SECURITY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    SecurityOperationType : Int64;
    SecurityDescriptorLength : Integer;
    SecurityDescriptorOffset : Integer;
    end;
  REG_EVENT_SET_KEY_SECURITY_INFO = _REG_EVENT_SET_KEY_SECURITY_INFO;
  PREG_EVENT_SET_KEY_SECURITY_INFO = ^REG_EVENT_SET_KEY_SECURITY_INFO;

  _REG_EVENT_RESTORE_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    FileHandle : Int64;
    Flags : Int64;
    end;
  REG_EVENT_RESTORE_KEY_INFO = _REG_EVENT_RESTORE_KEY_INFO;
  PREG_EVENT_RESTORE_KEY_INFO = ^REG_EVENT_RESTORE_KEY_INFO;

  _REG_EVENT_SAVE_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    FileHandle : Int64;
    end;
  REG_EVENT_SAVE_KEY_INFO = _REG_EVENT_SAVE_KEY_INFO;
  PREG_EVENT_SAVE_KEY_INFO = ^REG_EVENT_SAVE_KEY_INFO;

  _REG_EVENT_REPLACE_KEY_INFO = Packed Record
    General : REG_EVENT_GENERAL_INFO;
    KeyName : REG_DATA_UNICODE_STRING;
    FileName : REG_DATA_UNICODE_STRING;
    BackupFileName : REG_DATA_UNICODE_STRING;
    end;
  REG_EVENT_REPLACE_KEY_INFO = _REG_EVENT_REPLACE_KEY_INFO;
  PREG_EVENT_REPLACE_KEY_INFO = ^REG_EVENT_REPLACE_KEY_INFO;

Function RegEventTypeToStr(AType:Integer):WideString;
Function ParseRegUnicodeString(ARU:PREG_DATA_UNICODE_STRING; AStart:Pointer):WideString;
Function RegEventToInfo(AU:PUM_EVENT):WideString;
Function RegEventGetGeneralInfo(AU:PUM_EVENT):PREG_EVENT_GENERAL_INFO;
Function RegValueTypeToStr(AValueType:DWORD):WideString;

// Prevadi zaznamy jednotlivych udalosti na retezce pro zobrazeni
// do posledniho sloupecku v prvku ListView.
Function ParseDeleteKeyEvent(AU:PREG_EVENT_DELETE_KEY_INFO):WideString;
Function ParseDeleteValueKeyEvent(AU:PREG_EVENT_DELETE_VALUE_INFO):WideString;
Function ParseSetValueKeyEvent(AU:PREG_EVENT_SET_VALUE_INFO):WideString;
Function ParseSetInformationKeyEvent(AU:PREG_EVENT_SET_KEY_INFO):WideString;
Function ParseRenameKeyEvent(AU:PREG_EVENT_RENAME_KEY_INFO):WideString;
Function ParseEnumerateKeyEvent(AU:PREG_EVENT_ENUMERATE_KEY_INFO):WideString;
Function ParseEnumerateValueKeyEvent(AU:PREG_EVENT_ENUMERATE_VALUE_INFO):WideString;
Function ParseQueryKeyEvent(AU:PREG_EVENT_QUERY_KEY_INFO):WideString;
Function ParseQueryValueKeyEvent(AU:PREG_EVENT_QUERY_VALUE_INFO):WideString;
Function ParseQueryMultipleValueKeyEvent(AU:PREG_EVENT_QUERY_MULTIPLE_VALUES_INFO):WideString;
Function ParseFlushKeyEvent(AU:PREG_EVENT_FLUSH_KEY_INFO):WideString;
Function ParseKeyHandleCloseEvent(AU:PREG_EVENT_CLOSE_KEY_INFO):WideString;
Function ParseCreateKeyEvent(AU:PREG_EVENT_CREATE_KEY_INFO):WideString;
Function ParseOpenKeyEvent(AU:PREG_EVENT_OPEN_KEY_INFO):WideString;
Function ParseCreateKeyExEvent(AU:PREG_EVENT_CREATE_KEY_EX_INFO):WideString;
Function ParseOpenKeyExEvent(AU:PREG_EVENT_OPEN_KEY_EX_INFO):WideString;
Function ParseLoadKeyEvent(AU:PREG_EVENT_LOAD_HIVE_INFO):WideString;
Function ParseUnLoadKeyEvent(AU:PREG_EVENT_UNLOAD_HIVE_INFO):WideString;
Function ParseQueryKeySecurityEvent(AU:PREG_EVENT_QUERY_KEY_SECURITY_INFO):WideString;
Function ParseSetKeySecurityEvent(AU:PREG_EVENT_SET_KEY_SECURITY_INFO):WideString;
Function ParseRestoreKeyEvent(AU:PREG_EVENT_RESTORE_KEY_INFO):WideString;
Function ParseSaveKeyEvent(AU:PREG_EVENT_SAVE_KEY_INFO):WideString;
Function ParseReplaceKeyEvent(AU:PREG_EVENT_REPLACE_KEY_INFO):WideString;

Implementation

Uses
  SysUtils;

Type
  TParserFunction = Function (AE:Pointer):WideString;
  TParserFunctionArray = Array [2..24] Of TParserFunction;

Var
  // Toto pole slouzi jako rozcestnik ve funkci RegEventToInfo.
  // Podle indexu typu udalosti zajisti volani konkretni ParseXXX
  // rutiny.
  _ParserFunctionArray : TParserFunctionArray;

Function RegEventTypeToStr(AType:Integer):WideString;
{
  Prevadi konstantu typu udalosti na zobrazitelny retezec.
}
begin
Case AType Of
  REG_EVENT_DELETE_KEY : Result := 'Smazat klíč';
  REG_EVENT_DELETE_VALUE : Result := 'Smazat hodnotu';
  REG_EVENT_SET_VALUE : Result := 'Změnit hodnotu';
  REG_EVENT_SET_KEY : Result := 'Změnit klíč';
  REG_EVENT_RENAME_KEY : Result := 'Přejmenovat klíč';
  REG_EVENT_ENUMERATE_KEY : Result := 'Seznam podklíčů';
  REG_EVENT_ENUMERATE_VALUE : Result := 'Seznam hodnot';
  REG_EVENT_QUERY_KEY : Result := 'Číst klíč';
  REG_EVENT_QUERY_VALUE : Result := 'Číst hodnotu';
  REG_EVENT_QUERY_MULTIPLE_VALUES : Result := 'Číst hodnoty';
  REG_EVENT_FLUSH_KEY : Result := 'Flush klíče';
  REG_EVENT_CLOSE_KEY : Result := 'Zavřít handle';
  REG_EVENT_CREATE_KEY : Result := 'Vytvořit klíč';
  REG_EVENT_OPEN_KEY : Result := 'Otevřít klíč';
  REG_EVENT_CREATE_KEY_EX : Result := 'Vytvořit klíč';
  REG_EVENT_OPEN_KEY_EX : Result := 'Otevřít klíč';
  REG_EVENT_LOAD_HIVE : Result := 'Načíst hive';
  REG_EVENT_UNLOAD_HIVE : Result := 'Uvolnit hive';
  REG_EVENT_QUERY_SECURITY_KEY : Result := 'Číst zabezpečení';
  REG_EVENT_SET_SECURITY_KEY : Result := 'Změnit zabezpečení';
  REG_EVENT_RESTORE_KEY : Result := 'Obnovit klíč';
  REG_EVENT_SAVE_KEY : Result := 'Uložit klíč';
  REG_EVENT_REPLACE_KEY : Result := 'Přepsat klíč';
  Else Result := Format('Neznámý (%d)', [AType]);
  end;
end;

Function ParseRegUnicodeString(ARU:PREG_DATA_UNICODE_STRING; AStart:Pointer):WideString;
Var
  W : PWideChar;
begin
W := PWideChar(Cardinal(AStart) + ARU.Offset);
Result := Copy(W, 1, ARU.Length Div SizeOf(WideChar));
end;

Function ParseDeleteKeyEvent(AU:PREG_EVENT_DELETE_KEY_INFO):WideString;
begin
Result := ParseRegUnicodeString(@AU.KeyName, AU);
end;

Function ParseDeleteValueKeyEvent(AU:PREG_EVENT_DELETE_VALUE_INFO):WideString;
begin
Result := Format('%s\%s', [ParseRegUnicodeString(@AU.KeyName, AU), ParseRegUnicodeString(@AU.ValueName, AU)]);
end;

Function ParseSetValueKeyEvent(AU:PREG_EVENT_SET_VALUE_INFO):WideString;
begin
Result := Format('%s\%s (%s)', [ParseRegUnicodeString(@AU.KeyName, AU), ParseRegUnicodeString(@AU.ValueName, AU), 'Typ']);
end;

Function ParseSetInformationKeyEvent(AU:PREG_EVENT_SET_KEY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseRenameKeyEvent(AU:PREG_EVENT_RENAME_KEY_INFO):WideString;
begin
Result := Format('%s --> %s', [ParseRegUnicodeString(@AU.KeyName, AU), ParseRegUnicodeString(@AU.NewKeyName, AU)]);
end;

Function ParseEnumerateKeyEvent(AU:PREG_EVENT_ENUMERATE_KEY_INFO):WideString;
begin
Result := Format('%s (%d)', [ParseRegUnicodeString(@AU.KeyName, AU), AU.Index]);
end;

Function ParseEnumerateValueKeyEvent(AU:PREG_EVENT_ENUMERATE_VALUE_INFO):WideString;
begin
Result := Format('%s (%d)', [ParseRegUnicodeString(@AU.KeyName, AU), AU.Index]);
end;

Function ParseQueryKeyEvent(AU:PREG_EVENT_QUERY_KEY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseQueryValueKeyEvent(AU:PREG_EVENT_QUERY_VALUE_INFO):WideString;
begin
Result := Format('%s\%s', [ParseRegUnicodeString(@AU.KeyName, AU), ParseRegUnicodeString(@AU.ValueName, AU)]);
end;

Function ParseQueryMultipleValueKeyEvent(AU:PREG_EVENT_QUERY_MULTIPLE_VALUES_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseFlushKeyEvent(AU:PREG_EVENT_FLUSH_KEY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseKeyHandleCloseEvent(AU:PREG_EVENT_CLOSE_KEY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseCreateKeyEvent(AU:PREG_EVENT_CREATE_KEY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseOpenKeyEvent(AU:PREG_EVENT_OPEN_KEY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseCreateKeyExEvent(AU:PREG_EVENT_CREATE_KEY_EX_INFO):WideString;
begin
Result := Format('%s\%s', [ParseRegUnicodeString(@AU.RootkeyName, AU), ParseRegUnicodeString(@AU.SubkeyName, AU)]);
end;

Function ParseOpenKeyExEvent(AU:PREG_EVENT_OPEN_KEY_EX_INFO):WideString;
begin
Result := Format('%s\%s', [ParseRegUnicodeString(@AU.RootkeyName, AU), ParseRegUnicodeString(@AU.SubkeyName, AU)]);
end;

Function ParseLoadKeyEvent(AU:PREG_EVENT_LOAD_HIVE_INFO):WideString;
begin
Result := Format('%s\%s (%s)', [ParseRegUnicodeString(@AU.RootkeyName, AU), ParseRegUnicodeString(@AU.SubkeyName, AU), ParseRegUnicodeString(@AU.FileName, AU)]);
end;

Function ParseUnLoadKeyEvent(AU:PREG_EVENT_UNLOAD_HIVE_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseQueryKeySecurityEvent(AU:PREG_EVENT_QUERY_KEY_SECURITY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseSetKeySecurityEvent(AU:PREG_EVENT_SET_KEY_SECURITY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseRestoreKeyEvent(AU:PREG_EVENT_RESTORE_KEY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseSaveKeyEvent(AU:PREG_EVENT_SAVE_KEY_INFO):WideString;
begin
Result := Format('%s', [ParseRegUnicodeString(@AU.KeyName, AU)]);
end;

Function ParseReplaceKeyEvent(AU:PREG_EVENT_REPLACE_KEY_INFO):WideString;
begin
Result := Format('%s (%s, %s)', [ParseRegUnicodeString(@AU.KeyName, AU), ParseRegUnicodeString(@AU.FileName, AU), ParseRegUnicodeString(@AU.BackupFileName, AU)]);
end;

Function RegEventGetGeneralInfo(AU:PUM_EVENT):PREG_EVENT_GENERAL_INFO;
begin
Result := Pointer(Integer(AU) + SizeOf(UM_EVENT));
Result.ResultStatus := Cardinal(Result.ResultStatus);
end;

Function RegEventToInfo(AU:PUM_EVENT):WideString;
{
  Prevede libovolnou udalost o operaci nad registrem na retezec.
  Tento retezec se nasledne zobrazi v poslednim sloupci pole
  ListView.
}
begin
Result := _ParserFunctionArray[AU.EventType](RegEventGetGeneralInfo(AU));
end;

Function RegValueTypeToStr(AValueType:DWORD):WideString;
{
  Prevede konstantu urcujici typ registrove hodnoty na
  retezec
}
begin
Case AValueType Of
  REG_NONE : Result := 'REG_NONE';
  REG_BINARY : Result := 'REG_BINARY';
  REG_SZ : Result := 'REG_SZ';
  REG_MULTI_SZ : Result := 'REG_MULTI_SZ';
  REG_EXPAND_SZ : Result := 'REG_EXPAND_SZ';
  REG_DWORD : Result := 'REG_DWORD';
  REG_DWORD_BIG_ENDIAN : Result := 'REG_DWORD_BIG_ENDIAN';
  REG_QWORD : Result := 'REG_QWORD';
  REG_FULL_RESOURCE_DESCRIPTOR : Result := 'REG_FULL_RESOURCE_DESCRIPTOR';
  REG_LINK : Result := 'REG_LINK';
  REG_RESOURCE_LIST : Result := 'REG_RESOURCE_LIST';
  REG_RESOURCE_REQUIREMENTS_LIST : Result := 'REG_RESOURCE_REQUIREMENTS_LIST';
  Else Result :='<Unknown>';
  end;
end;


Initialization
_ParserFunctionArray[REG_EVENT_DELETE_KEY] := @ParseDeleteKeyEvent;
_ParserFunctionArray[REG_EVENT_DELETE_VALUE] := @ParseDeleteValueKeyEvent;
_ParserFunctionArray[REG_EVENT_SET_VALUE] := @ParseSetValueKeyEvent;
_ParserFunctionArray[REG_EVENT_SET_KEY] := @ParseSetInformationKeyEvent;
_ParserFunctionArray[REG_EVENT_RENAME_KEY] := @ParseRenameKeyEvent;
_ParserFunctionArray[REG_EVENT_ENUMERATE_KEY] := @ParseEnumerateKeyEvent;
_ParserFunctionArray[REG_EVENT_ENUMERATE_VALUE] := @ParseEnumerateValueKeyEvent;
_ParserFunctionArray[REG_EVENT_QUERY_KEY] := @ParseQueryKeyEvent;
_ParserFunctionArray[REG_EVENT_QUERY_VALUE] := @ParseQueryValueKeyEvent;
_ParserFunctionArray[REG_EVENT_QUERY_MULTIPLE_VALUES] := @ParseQueryMultipleValueKeyEvent;
_ParserFunctionArray[REG_EVENT_FLUSH_KEY] := @ParseFlushKeyEvent;
_ParserFunctionArray[REG_EVENT_CLOSE_KEY] := @ParseKeyHandleCloseEvent;
_ParserFunctionArray[REG_EVENT_CREATE_KEY] := @ParseCreateKeyEvent;
_ParserFunctionArray[REG_EVENT_OPEN_KEY] := @ParseOpenKeyEvent;
_ParserFunctionArray[REG_EVENT_CREATE_KEY_EX] := @ParseCreateKeyExEvent;
_ParserFunctionArray[REG_EVENT_OPEN_KEY_EX] := @ParseOpenKeyExEvent;
_ParserFunctionArray[REG_EVENT_LOAD_HIVE] := @ParseLoadKeyEvent;
_ParserFunctionArray[REG_EVENT_UNLOAD_HIVE] := @ParseUnLoadKeyEvent;
_ParserFunctionArray[REG_EVENT_QUERY_SECURITY_KEY] := @ParseQueryKeySecurityEvent;
_ParserFunctionArray[REG_EVENT_SET_SECURITY_KEY] := @ParseSetKeySecurityEvent;
_ParserFunctionArray[REG_EVENT_RESTORE_KEY] := @ParseRestoreKeyEvent;
_ParserFunctionArray[REG_EVENT_SAVE_KEY] := @ParseSaveKeyEvent;
_ParserFunctionArray[REG_EVENT_REPLACE_KEY] := @ParseReplaceKeyEvent;
End.

