Writing a function to monitor for registry changes is fairly easy in Windows CE.   What isn’t easy is to find out what changed, I will cover that in a different article and focus on what does work here.
Starting with Windows CE 4.2, Windows CE includes CeFindFirstRegChange(), CeFindNextRegChange() and CeFindCloseRegChange(). These functions can be used to set up an event that will be signaled when changes occur in the registry. Then, your application code uses WaitForSingleObject() or WaitForMultipleObjects() to wait for the event to be signaled.
CeFindFirstRegChange() takes a few parameters and returns an event handle to wait on:
1.       A handle to an open registry key, or one of the root keys like HKEY_LOCAL_MACHINE
2.       A Boolean that determines if the wait is for changes to just the key, or the key and all of its child keys and subkeys.   Note that I defined some macros to use for this so that the function call is more readable. The macros are MONITOR_TREE and MONITOR_KEY.
3.       Finally, the type of changes we are interested in knowing about.
CeFindNextRegChange() takes the handle returned by CeFindFirstRegChange() as its only parameter.
The following code uses CeFindFirstRegChange(), CeFindNextRegChange() and WaitForSingleObject() to monitor for changes to HKEY_LOCAL_MACHINE\Drivers. When it finishes, which actually it never does, it calls CeFindCloseRegChange() to close the open handle. When this code is notified of a registry change, all it does is output a message on the debug port. I will leave it to you to implement something cool instead.
#include <Windows.h>
#include <winreg.h>
#define MONITOR_TREE              TRUE
#define MONITOR_KEY                FALSE
int WINAPI WinMain(     HINSTANCE hInstance,
                                                                                HINSTANCE hPrevInstance,
                                                                                LPTSTR    lpCmdLine,
                                                                                int       nCmdShow)
                HKEY hkDrivers;
                HANDLE hFind;
                DWORD Status;
                RETAILMSG( 1, (TEXT("RegMon Started\r\n")));
                if( ERROR_SUCCESS != RegOpenKeyEx( HKEY_LOCAL_MACHINE, TEXT("Drivers"), 0, 0, &hkDrivers ) )
                                RETAILMSG( 1, (TEXT("Failed to open HKLM\\Drivers\r\n")));
                                return 0;
                                hFind = CeFindFirstRegChange( hkDrivers, MONITOR_TREE, REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET );
                                if( hFind != INVALID_HANDLE_VALUE )
                                                                Status = WaitForSingleObject( hFind, INFINITE );
                                                                if( Status == WAIT_OBJECT_0 )
                                                                                RETAILMSG( 1, (TEXT("Found reg change\r\n")));
                                                                                CeFindNextRegChange( hFind );
                                                                else if( Status == WAIT_FAILED )
                                                } while( 1 );
                                                CeFindCloseRegChange( hFind );
                RETAILMSG( 1, (TEXT("RegMon Done\r\n")));
                return 1;
Copyright © 2009 – Bruce Eitman
All Rights Reserved