Laguna Seca Day

It was a bit of a surprise but the folks from HOD managed to get a date at Laguna Seca. I received the email about 3 weeks ago and a few hours later, I had bought my spot. Good thing I didn't wait since they pretty much sold out that date within 48 hours.

There were a bunch of people coming from the Apple Auto Club but I haven't met any. I just noticed that one dude who has a blue Ferrari with the Apple logo on the doors.

Once again, I took my sister and since it was her last day in California (before flying back to France) it became somewhat of a farewell gift.

We loaded up the Lotus on the newly painted trailer - I wanted to put some bed liner on it to make it more resistant to bad weather and bird poop - and we put the tools, helmets and my gloves in the Bee. We went to bed fairly early on Sunday night since we had to leave by 6:30 on Monday.

Monday the 23rd, 6:30AM: We basically left by 6:27AM and went down highway 1 towards Monterey. The good thing about Laguna Seca is that it's less than one hour away from home, which is very appreciable.

We got to the track by 7:30AM and proceeded to unload all the stuff after looking for a place to park. There had been an event over the week-end and there were a ton of 18 wheelers in the paddocks. After finding a decent looking spot, I parked the Bee, unloaded the Lotus and we went for a recon mission. The goal of our mission was to spot the bathrooms and also the gift shop.

9:00AM: Finally, it's time for the C group to get on the track. For some odd reason, our group is always the group that goes first and dries the track for the others, grrrrr....

The track was cold and so were my tires so, I did that session in slow motion. I think that I got lapped during my last lap by the guy you went out first. Unless, he went in the hot pits to wait for the track to be less congested. According to the dude in the Cayman parked next to me, people were slooooow. He told me that perhaps he should follow me. I answered that perhaps he shouldn't because I always start last. I usually pass a few people during a session but once that's done, the track is super clear in front of me. I can't catch the faster guys or guys that are as fast or a tad slower than me since the gap can be of several seconds between cars when we start out.

The second session was a lot better and I was feeling a bit more confident. The car felt pretty good and the tires warmed up a bit quicker too. My sister was impressed by the Corkscrew, which is understandable since it's a very unique turn.

The sun finally came up around 11AM and that was a welcome event since we were kind of cold in the paddocks. Our 3rd session was right before lunch, around noon. At that point the sky was all blue and the track was nice and warm. My lap times seemed a lot faster than in the morning although I wouldn't be able to tell since I don't have any lap timer.

I was feeling pretty good in turn 4 and I could feel that the car was telling me that it had a ton of grip as I was going across the apex. I also started to push harder in the straight/turn 1 and I would keep on the gas until a few yards of turn 2, which is a double apex turn (first time I tried to take that turn that way but I liked it).

I had to let an Atom by coming off turn 11 and my sister was amazed by the fact that the little car would let me in its dust going up the start/finish line. For a couple laps, I would catch up by turn 2 and be on the Atom's ass until T11 and finally, the driver let me pass her going up between T5 and T6. Never saw her again :)

In retrospect, I think that Sears Point is still better suited for the Lotus than Laguna Seca is but Laguna is still way better than Thunderhill, which benefits high HP cars.

All in all, this was a very good day. The only blemish is that my exhaust (which I had to revert to stock) got so hot that a small part of the rear shell started to bubble up, screwing up the paint in the process. It's a little difficult to see but I know it's there :(

Round and round around Infineon Raceway (Sears Point)

Monday 8th.

Finally got to go to Sears Point. Last time I was there was in 2005 for the AFM races, in which I crashed during the Formula IV race, in turn 2. Obviously, I know the layout of the track but, the lines are quite different in a car and on a motorcycle.

I loaded up the truck on Sunday and we left (my sister and I) on Monday at about 5:25AM (yikes!).
As we arrived in Oakland, I missed the 580 West exit and I ended up being forced to take the bay bridge. I turned around on Treasure Island, which was a tad hairy since there is only one road and I had to make a U-turn in a very tight spot with the following setup:

Definitely interesting (not counting the wasted $14 for the extra toll).

We got to the track at 7:50 and I went directly to the registration which was in the garage #1. I had to get a number for some reason, which I assumed was because of the sound limit, and I picked #13. Since there was no more #13, I got 43 and April (a lady member of the staff there) who's an awesome lady by the way, cut the 4 to make it a 1 :)

It was foggy to begin the day but it was more like low clouds. No humidity, but the track was cold and so were my tires. The car fish tailed in turn 4 a little, although it was nothing too serious, my sister did tell me about it. Finally, around 11AM and right before my 3rd session, the sky cleared up and the weather was just glorious!

Coming off turn 11.

We went 3 more sessions (there are 4 groups, so you do 3 sessions in the morning and 2 in the afternoon in the C group) and we reached the end of our day at about 4:30PM.

It took me a while to figure out the turns and I made a little list of spots where I sucked:

• Turn 4. I just can't hit it properly even though I know it's a late apex.
• The end of the esses, where I slow down too much.
• I'm a chicken in turn 9
• And so am I in turn 10

Overall, it turned out to be an great day and I hope that I can go there again sometimes soon.

Installing a Fuel Surge Tank on an Elise

Well, it's a pain if, like me, you're not mechanically inclined. Although, installing in itself isn't really the problem, it's more about removing stuff that's tough.

The FST I chose is made by Radium (Radium is actually an element in the periodic table), and it looks like this:

Very pretty design.
Anyway, it comes with a bunch more stuff, likes hoses and wires for controlling the pump that's inside.

What does a FST do will you ask? In short, it's to prevent fuel starvation. The problem is that the fuel tank on the Elise/Exige as a crappy design in the sense that the fuel pickup is on the left hand side so, when turning left, hard, if the tank isn't 3/4 full, the fuel shifts on the right side and therefore, the fuel pump sucks air instead of gasoline, which as you might expect really isn't that good because air + air doesn't really detonate that well.

So, the FST basically acts as a 'proxy' so to speak. It contains a reserve of about 1Qt and when the stock fuel pump is sucking air, the FST can still provide gas to the engine for a short amount of time.

My troubles started at step 1...
I had to disconnect the stock fuel line so, I bought a tool at the auto shop. Problem is that I bought somewhat of a generic tool and of course, the Lotus won't accept that. Ended up going online and buy the proper tool:

Now, that worked a whole lot better. This tiny little thing is designed for Toyota and some other brand I can't recall. $13 and it works very well. Although, I had to unscrew the fuel rail because the line is too close to the engine block and the wider part of the tool was too big and would not fit. Ugh.

Step 2, I had to take out the filler hose. That took me a couple of hours.
I forgot to mention that I had to get the AC removed in order to be able to install the FST. I didn't use it and it's pretty crappy anyway, so I got rid of it and its 50 some lbs.

Back to the darn hose. Taking it out took a while because it was hard to push it down towards the tank, just to be able to bend it enough to remove it from the filler neck (where you insert the fuel nozzle). I lost a nut in the overflow hose too. Ugh (and it never came out, R.I.P).

Finally, I got it out and I had to cut about 1" off it to insert some gizmo that does something that escapes me. Putting it back in was a bit easier as I put a tiny bit of grease on the inside perimeter of the hose, so that it would slide onto the aluminum pipes easily. Then, I had to tighten the metal collars and that was no sinecure either. Ugh.

Step 3. Started in the morning around 11AM. I connected one hose that goes to the aforementioned gizmo. Wasn't too bad. Then I had to remove the under panels (diffuser and under tray) because that's the only way to connect the power cable that will feed the FST. Plugged the cable in the FST and re-routed it until the little black box, next to the ECU.

It was a pain to open the plastic box but I got it figured out and I connected the cable. I also screwed the fuse assembly and the other little box on the FST holder, which was simple enough.

I had then to remove the seats, the black plastic thing behind them and the foam. Annoying but it didn't take all that long and I took advantage of that to get rid of the grills that cover the speakers (they vibrate, which is irritating).

Connected the white jumpers and put the remaining connector through the little hole.
I had then to cut the fuel line, which was surprisingly easy and then connect it to the hose that I ran by the firewall, on the back of the car. When I pulled that hose, I also pulled the other hose that connects to the fuel rail, and then I connected them both.

I checked for loose stuff and didn't see any, so I primed the FST and started the car. Initially, everything looked fine but when I looked at the FST, one fitting was not tight enough and gas was leaking out. I tightened it a bit and when it seemed alright, I started the car again.

So far, nothing to report. I still have to put everything back (foam, plastic panel, seats, wheels, etc) but that's relatively easy. It will have taken me about 4-5 hours to do everything basically, and I work very slowly.

I'll run some more leak tests during the week and hopefully, I'll be good to go by next week-end!

First 'Oops' at Thunderhill

Went to Thunderhill on Thursday the 26th.

I had a lot of things to put my mind on that day though, because I haven't gone to the track for a while and the last time, it was raining and I was unable to test stuff.

Since the last dry track day, I have added the following:

• 2 way Nitron Suspensions (2 way means compression and rebound settings)
• Canards (little air flow fins on the front of the car)
• 5 elements diffuser
• Race mounts
• G-Pan (baffled oil pan)

Obviously, the most important additions were the suspensions, canards and race mounts as they all contribute to a different ride behavior.

I added a couple clicks to the compression and rebound damping as I had them set up half way for street driving. Being on the track also means that one can use a more aggressive setup.

That seemed to work pretty well and I don't have anything to complain about regarding the handling. With the new suspensions, the ride height is also lower (118mm/123mm compared to the stock settings that were at 130mm/140mm or so).

The motor mounts are a very nice addition as they allow for crispier shifts and they also help a bit with the handling and the motor doesn't move as much under load.

Anyway, the first session was interesting as my tires were a little too inflated and cold. The track was a little slick but that's always like this and the C group always goes first for some reason. In the first lap, some lady spun her Ferrari in Turn 14 because her 'pit crew' forgot to put the gas cap on and fuel spewed all over and onto her right side tires, sending her spinning.

Where it got very interesting was in my second session. I had adjusted my tire pressure a bit and it felt better. The track was warmer, which helped as well. I was trying to work on Turn 5 and Turn 9 because they are fairly similar, being both blind corners that go up and come down on the right side. Turn 5 is not much of a corner but most people steer too much on the left going up, thus leaving 3 or 4 feet worth of track on the right side.

In my 3rd or 4th lap (I can't quite remember which was it was), I came out of Turn 3 and was going into 4 at a pretty good speed. I usually turn in earlier than a lot of people, skim the curb on the inside and track out (turns out that I wasn't tracking out wide enough, which I worked on in my last session).

This time around though, I cut it a tad short and I ended up hitting the curb a bit too much while turning left. The curb is quite high in that spot and that unsettled the car. Pretty much at the apex, the car started over steering and I initially thought that perhaps I could save it and I counter steered. It corrected itself but kicked back and over steered on the left side a lot quicker. By then I realized that I lost it and went both feet in (brakes + clutch).

The car ended up spinning to almost 180 degree but not quite. As I stopped, the car stalled because I released the clutch without thinking about it, killing the engine. A couple of cars went by as I was trying to start the car again. It resisted a bit and finally cranked over. I backed up a couple feet, waited for another car to go by and turned around to finish my lap.

Of course, by Turn 11 I got black flagged, which means that I would have to pit in. I was expecting it anyway so, it wasn't much of a surprise. I stopped in the hot pits and the group leader came to talk to me. He asked what happened and I told him that I was a little too happy going into 4 and I bit the curb, which punted me and caused the spin.

He checked the car quickly, but since I didn't go off track, there was not mud or anything nasty. The car was fine and so was I. It's easy to get rattled but I found myself pretty calm, considering the circumstances. I was just happy that I kept it on the track and I knew that even though it was 100% my fault, it wasn't a horrible mistake but rather a bad decision of cutting it to close to the curb. Better stay OFF the curb really.

The rest of the day went pretty smoothly and the group leader came along in my last session. He was quite happy with Turn 5 and 9, which always cause me problems and gave me some advices regarding Turn 4 and 8. Turn 8 in particular as I would turn too late, sacrificing too much entry speed and therefore, killing my exit. By turning earlier (a few feet) I was able to come out at about 100mph, compared to the 90mph or so that I would see before. Good stuff.

I still need to work on Turn 1 because I feel that I could carry a lot more speed in there. I just chicken out on the entry and I come out going into the short straight a some 85mph. I know that I can exit the turn doing 100mph easily but for some reason, I haven't been able to do it for a while now.

Mini-Filter messaging

Recently I have been working on some OS monitoring and, as a mean to communicate with my user mode application, I ended up resorting to the Mini-filter Messaging.

What is it?
Well, when you write a mini-filter (like a file mini filter) Windows provides you with a set of API that can be used to send messages to an user mode application. The API are as follows:

On the driver side:

• FltCreateCommunicationPort
• FltSendMessage

And on the user mode side:

• FilterConnectCommunicationPort
• FilterGetMessage
• FilterReplyMessage
• CreateIoCompletionPort

With all of those, you should be able to make your own communication channel.

First, on the driver side, you will need to create the communication port with FltCreateCommunication port. You can use a default security descriptor to pass as a parameter because it's a little easier and it does not have to be super secure either.

To create the descriptor, just use something like this:

PSECURITY_DESCRIPTOR sd;

NTSTATUS status = FltBuildDefaultSecurityDescriptor(&sd, FLT_PORT_ALL_ACCESS);

Then, pick a name for your port like (L\\MyCommunicationPort) and create the communication port.
There are some parameters passed to the API that are callback functions. You must use the pfnConnect and the pfnDisconnect callback (meaning that setting them to NULL would be useless) but you may leave pfnMessageNotify empty.

Once the user mode application will connect to the port, the pfnConnect function will be called and you will be able to start sending out messages.

The 'Connect' callback will provide you with a [inClientPort] that you must save (in a global variable for example) as you will need it to send messages.

Now, to send a message, that's easy, just use FltSendMessage().
By looking at the documentation, you will notice that it requires a PFLT_FILTER parameter that is your handle that came from the FltRegisterFilter() call that you made in your DriverEntry() function.

The next argument is the clientPort that you have saved earlier from the pfnConnect callback (you did, right?)

You need to provide a buffer to send, as well as its length. Personally, I keep the buffer size below 1KB because I don't know what the maximum size is and 1K is most of what I would need anyway.

You may provide a reply buffer as well, in case you want the user mode application to reply to your messages. I use it to make sure that the messages were delivered properly.

The timeout is a little tricky to figure out because the length is a multiple of 100 nanoseconds and it can be absolute or relative. So, if you want to set a 1 second timeout, you would need to enter a number such as this: -10000000. To make it easier I wrote a couple of macros:

#define K_NANOSECOND  10000000

#define K_MILLISECOND  10000

#define K_RELATIVE_WAIT_S(a)  -((LONGLONG) a * K_SECOND)

#define K_RELATIVE_WAIT_MS(a)  -((LONGLONG) a * K_MILLISECOND)

The code to use would look like: timeout.QuadPart = K_RELATIVE_WAIT_S(1) to wait for 1 second.

There is a very good example of the whole messaging system that comes with the DDK, which is under <drive:>\WINDDK\<release version>\src\filesys\minifilter\scanner\

What I should point out are a few little quirks that are not that trivial to figure out.
First, after you connect to the port, you will need to 'prime' the messaging by doing a few FilterGetMessage() calls. You will create a buffer per call and those buffers will be re-used during the life time of you application.

The buffer will be filled with data when GetQueuedCompletionStatus() returns in your thread(s). it will be followed by a FilterReplyMessage() and a FilterGetMessage().

One thing about the FilterReplyMessage() call though, you will pass your structure which must contain a FILTER_REPLY_HEADER structure. Before sending the reply, you must fill up the fields contained in there like this:

reply.ReplyHeader.Status = 0;

reply.ReplyHeader.MessageId = mystruct.fltHeader.MessageId;

the mystuct.fltHeader is the FILTER_MESSAGE_HEADER that must be included in the structure used to receive message like this:

typedef struct myStruct {

  FILTER_MESSAGE_HEADER fltHeader;

  MY_DATA  data;

} MY_STRUCT, *LPMY_STRUCT;

I would advise you to reply to the kernel messages in order to verify that the delivery went right. Otherwise, as I experienced it, some messages may get lost and some may get duplicated.

Happy messaging!

Track Day Preparation

Terrorizing my sister at Thunderhill Raceway (2010)

So, you've decided that you try to attend a track day with your (cool) car but you don't know how to go about it.

First, you need to know who hosts track days. There are a bunch of organizations that do so, nothing to worry about, you'll get your shot. For a quick reference you can go here. This is calendar for 2011 which contains a lot of events hosted by a bunch of different people.



Personally, I like Hooked On Driving because while they tend to be more expensive than most, their events are very well organized. They have a pretty big staff and always provide coaching (coaches are either part of the staff or are C group drivers that volunteer to help out). They also provide a decent lunch and free water during the day. They also have group download and classroom sessions for the A & B groups.

Most organizations will split the day in different groups (3 or 4 groups are the most common).

Groups: Well, depending on the host you will have a Group A, B, C or 1, 2, 3 or HPDE1,2,3 etc... Sometimes the A group is the beginner group and the C is experienced, sometimes it's reversed.

But the host will let you know in advance as this is usually described on their web site. If it's your very first time on the track, choosing the beginner group is the best thing to do as it will provide you with invaluable coaching (when available) and experience. Also, those groups tend to run at a much slower pace, which help bringing your car back home in one piece.

Car: Well, not everyone owns a Ferrari. So, you ride what you bring.
I must say that there usually is a large ratio of BMW and Porshe, and since a couple years or so, Nissan GT-R, Audi R8. Occasionally though, you will spot some Ferraris, Lambos, Aston Martin and a few nut cases who bring some Lotus (me included). Actually, there is almost always one or two Elise/Exige  present.

I have also seen a bunch of Minis, Subaru WRX, Evo7, VW Bug, Mustangs, Challengers (seldom) so no matter what your car is, you can attend a track day. Of course, if you bring a Smart car you'll want to slit your wrists before lunch...

The things that are important, regardless of the car are at least those few things:

• Tires. Make sure yours are in good shape and if you can afford sports tires, do it. I usually run Toyo R888.
• Oil. You should get an oil change and verify that the drain plug is tight (losing oil on the track is uncool)
• Tire gauge. Always good to have one even if there's tire service on track.
• Shape. You car needs to be in good shape, without stuff hanging, flapping, loose, etc.
• Brakes. It's kind of nice when you can actually brake instead of plowing into a wall.

Gear: You should not need anything really, besides a helmet. Then again, tracks like Thunderhill have skull protectors for rent. It's still better to have your own stuff though. There's a catch, most likely, your lid will have to be on par with the current helmet norms (SA Snell certified).

You can also bring driving gloves which are nice because they prevent potential blisters or having the steering wheel slip out of your sweaty little hands.

Before D-Day: Your track day is on Friday and it's Thursday evening. By now you should be ready to head to the motel for the night (assuming you go to a race track that's two or more hours from your home).

Here's my own checklist as I leave to work in the morning:

• Good tires
• Tire gauge
• Couple tools (just in case)
• Wheel lock (in case your wheels bolts/nuts have a funky shape or require a lock)
• Back pack with necessary stuff (tooth brush/paste, clean clothes, make-up if you're into that sort of things)
• Helmet
• Gloves
• ODBII scanner (cos' my Lotus loves to throw some CEL at me every so often, but you won't need that)
• Ice chest
• Gatorade (or whatever you want to drink)
• Cookies (I love cookies!)
• Car key (in case you're towing your fancy sports car)
• Phone
• Wallet

I usually don't bring much more than that because I don't have another vehicle to tow my car to the track. Towing your car is something I would strongly suggest for different reasons:

• You drive a car that can get uncomfortable after a couple of hours
• A truck or SUV is easier to drive at the end of the day and you'll feel more relax and not in track mode anymore
• You could wreck your car and thus, get stuck 3.5 hours from home, which would suck donkey balls.
• You could puncture a tire on the way there which could ruin your day if you have a car that (like the Elise) doesn't have a spare tire.
• Your new tires are still brand spanking new when you get to the track
• You want to put racing slicks or semi-slicks on your car

D-Day: Finally, it's about 7:30AM and you and the love of your life (no, not your spouse...) made it to the race track and you are enjoying the paddocks for the first time in your life. It's a pretty special moment to tell the truth (for you and your baby).

You start starring at some of the other cars in there, Lambos, Porshe, R8, proper race cars, and my Lotus just because it does look really cool ^_^. A lot of people wander in the paddocks and snap pictures of cool cars, I do it from time to time when I spot some fancy cars (Aston Martins for instance).

Usually, there is a drivers meeting at 8:00AM or so that is mandatory. They talk about being safe and also the fact that track days are NOT race days. You don't win anything besides driving your car back home in one piece. They also explain the meaning of the flags that you will see on track (White, Yellow, Black, Meatball, Checkered, Red, etc) and they will also tell you where the corner worker stations are.

The track usually goes hot at 8:30 or 9:00 depending if it's Winter or Summer and will close at about 5PM.
Usually the faster groups go first (pretty sure that they do that to dry the track if it's a little wet :)

People are usually very friendly, drivers, staff, track people, etc. Most likely because we all share the same passion and sometimes drive similar cars. Lotus guys talk to Lotus guys so on so forth. It's nice to mingle because sometimes you get to talk to seasoned drivers that will share tips with you.

Track is hot!: It's finally your turn to go on track.

If you go with HOD, they will assign a coach to you. They are all qualified and very nice. The coach will drive the first two laps at some 40mph with you as a passenger. They do this to show you the track layout and they will point out the turning points, braking zones, etc.

You should use that first session to figure out the way the track goes and try to remember the more difficult turns (for instance, Turn 5 and 9 at Thunderhill as they are blind turns). You can also feel how the car responds to your driving.

As you come out of the track, you should immediately go check with the tire guys (assuming they are there) for your air pressure and temperature of the rubber. They will be able to set you up correctly.

Well, I'm not going to go into details about what happens during the day because this post really is about the preparation for the track day. Hope that you'll give it a try and enjoy it.

Registry Monitoring sans Context

So, you've been asked to monitor the Windows registry with your driver and as you are a good programmer you've decided to do it by using the proper API and not by hooking the SSDT like every other coder does.

Very cool, problem is, you have no clue on how to go about it.
Fear not programmer friend! Here are 4 steps to help you out.

Step 1: CmRegisterCallbackEx

This is an API you can used in order to have Windows notify you whenever something happens with the registry. You can register pre-operation or post-operation callbacks, depending on your need, although monitoring will use post-operation callbacks.

Step 2: Creating a dispatch function

NTSTATUS RegistryMonitoringCallbackDispatch(
  __in      PVOID CallbackContext,
  __in_opt  PVOID Argument1,
  __in_opt  PVOID Argument2
)
{
  USHORT Class = (USHORT)Argument1;
  if (NULL == g_pCallbackFcns[Class])
  {
    return STATUS_SUCCESS;
  }
  return (*(g_pCallbackFcns[Class]))(CallbackContext, Argument1, Argument2);
}


As we can see above, this is a very simple function. All it does is check Argument1, which gives the type of notification and use it as an index for calling the appropriate callback.

The callbacks are defined like this:


NTSTATUS RegNtDeleteKeyCallback(__in PVOID CallbackContext, __in_opt PVOID Argument1, __in_opt PVOID Argument2);

They basically all follow the same prototype (which is the same as the dispatch function) and we can therefore, store them in a simple table which I have defined as such:


PEX_CALLBACK_FUNCTION g_pCallbackFcns[MaxRegNtNotifyClass] = {0};

The initialization of the monitoring module contains code such as this:


// Set the callbacks
//
g_pCallbackFcns[RegNtDeleteKey] = RegNtDeleteKeyCallback;

Now that this is done, we can go to the next step.

Step 3: Answering the call

Now that we have registered our driver with the system, whenever a registry change happens, our code will be called upon.

In that code, we don't have to do much. For example, we can merely output the name of a value that's being deleted.

If we read the documentation from Microsoft (and we always do, of course), we notice that each structure contained as Argument2 contains a pointer to a user defined context. Usually in that context you will want to store stuff like the name of the key that's being opened and its handle. This way, when a value gets added, modified, deleted etc, you will be able to know its location (under which key it's at).

But, because we're lazy and that's the point of this blog, we don't have to go through the whole context handling stuff as there's an easier way to remember what the key name is.

Step 4: Obtaining the name of a registry object.

Well, here the function that you'll need:


NTSTATUS GetObjectName(PUNICODE_STRING ObjectName, USHORT ccbLength, PVOID Object)
{
  NTSTATUS status = STATUS_SUCCESS;
  ULONG len = sizeof(OBJECT_NAME_INFORMATION) + sizeof(WCHAR) * ccbLength;
  PUCHAR Buffer = memalloc(len);
  POBJECT_NAME_INFORMATION ObjectNameInfo = (POBJECT_NAME_INFORMATION) Buffer;
  if (Buffer == NULL)
      return STATUS_NO_MEMORY;
  ObjectName->MaximumLength = ccbLength * sizeof(WCHAR);
  __try {
      // Make sure that the object is not null
      //
      if (NULL != Object)
      {
          RtlZeroMemory(Buffer, len);
          status = ObQueryNameString(Object, ObjectNameInfo, len, &len);
          if (NT_SUCCESS(status))
          {
              RtlCopyUnicodeString(ObjectName, &ObjectNameInfo->Name);
          }
      }
  }
  __except (EXCEPTION_EXECUTE_HANDLER)
  {
      // Object may have been invalid (This can happen when
      // dealing with registry notification)
      //
      status = GetExceptionCode();
  }

  memfree(Buffer);
  return status;
}


Not that hard now, was it?

Note: the 'memalloc' and 'memfree' are placeholders for proper allocation functions.

Then, for example, let's say that we are monitoring a value that's being deleted, here's a possible callback code for it:


NTSTATUS RegNtDeleteValueKeyCallback(__in PVOID CallbackContext, __in_opt PVOID Argument1, __in_opt PVOID Argument2)
{
    NTSTATUS status = 0;
    PREG_DELETE_VALUE_KEY_INFORMATION infoDeleteKey = (PREG_DELETE_VALUE_KEY_INFORMATION) Argument2;
    UNICODE_STRING ObjectName = {0};
    WCHAR* Buffer = (WCHAR*) memalloc(sizeof(WCHAR) * BUFFER_SIZE);
    HANDLE Pid = PsGetCurrentProcessId();
    RtlUnicodeStringInit(&ObjectName, Buffer);
    GetObjectName(&ObjectName, BUFFER_SIZE, infoDeleteKey->Object);
    SendRegistryDeleteValueNotification(ObjectName.Buffer, infoDeleteKey->ValueName->Buffer, Pid);
    DBGPRINT("Deleting value: %p [%ws\\%ws]\r\n", infoDeleteKey->Object, ObjectName.Buffer, infoDeleteKey->ValueName->Buffer);

    memfree(Buffer);
    return STATUS_SUCCESS;
}

In the code above, we get the name of the value from the structure we get in Argument2 but the name of the key is unknown. Fortunately, we have that nifty little function written above that will help us out.

So there you have it, registry monitoring made painless (kinda).