Monitor kernel registry changes - c++

Could people please give me pointers (no pun intended) for topics I will need to research in order to be able to do this? I'm not really an expert on Windows, however I'm very quick at picking up new concepts.
I saw the process monitor program which Mark Russinovich and Bryce Cogswell wrote:
http://technet.microsoft.com/en-gb/sysinternals/bb896645
which can look at everything happening registry key-wise within the kernel. I've been able to do this sort of thing using C# and user-level registry accesses in the past, but i couldnt reach the kernel using the wrapper suite I got from codeproject.
Can people please help with me regards to where i should start? I guess i'm asking more for help on the Windows/OS aspect of this.
Reason for doing this:
(I'm more of a Java than C++ programmer, however I want to get into the latter. The best way to learn is to do something which interests you, so as i'm interested in real-time applications, this is the cheapest one I could think of (without having to pay for data).)

For kernel-mode, take a look at CmRegisterCallback.
I believe Process Monitor uses the Event Tracing for Windows functions, however; see, for example, EtwRegister.

Writing a kernel-mode driver to intercept registry reads/writes is extremely difficult. If you just want to see both user and kernel-mode registry accesses, the best way to do so is via a real-time ETW trace listener. With this, you get all of the monitoring you want, without the terrifying proposition of modifying a running kernel. Mark doesn't use this because at the time it didn't exist, but nowadays I'm sure he'd recommend you do this instead. If you're familiar with DTrace on Linux, ETW is Windows' closest equivalent (it's as performant as DTrace, but not nearly as user-friendly or scriptable)
Check out http://blogs.msdn.com/b/matt_pietrek/archive/2005/03/23/401080.aspx for an intro to ETW, and here's a question on SO related to real-time ETW consumers: How do I register as a real-time ETW consumer for NT Kernel Events?

Related

Is there a way to prevent keyboard macros from running on a program?

I've developed an online game, sadly there's a select few people who are using recorded keyboard macros using programs like Razer Synapse to automate part of the game process.
This is something I'd like to not allow.
So my question is, is there a way in C++ to determine if a macro is being used to preform input or to determine if the most recent key click triggered was triggered by a human input or programmed input?
My first guess is no... but I could be wrong.
You cannot prevent automation from any client you don't control. The study of algorithms is hundreds of years old, and computers are intended first to be devices of automation. Whatever novelty you come up with will be easily defeated simply because somebody was up to the challenge. That does not mean to say you should avoid solutions which assure bots aren't given a significant advantage, such as speed of input as suggested in the above comments, but if you hope to stop automation altogether you are climbing an endlessly steep hill.
Maybe you should evaluate and consider if rampant automation is an indicator that some aspect of your game mechanics are being viewed as, well, boring. We should strive to provide a player with enough stimulation to want to remain engaged in our games.

Unmanaged C++ BT/LE on RP/Win and pairing programmatically, possible?

I have an unmanaged c++ application that I'd like to port to Windows Raspberry Pi. It was originally developed on an embedded platform but was written to be highly portable using a pseudo-HAL to wall off the 10-15% of platform specific code. So it easily ports to / runs on windows desktop as well with zero changes to the common ~85%. It's currently written to support ANT+ sensors though we would like to add (or may possibly replace ANT with) BT/LE support. That said from looking at a ton of docs and examples online it's not super clear if it's even possible without a rewrite. If it comes to that though we would probably target linux instead. Anyway, three questions -
(1) Is it even possible?
(2) If so what is the best approach (i.e. what API's should I be looking at, and how should I wrap them for unmanaged use)?
(3) Is there a way to programatically pair the RP with our target sensors on the fly, i.e. scan for available sensors and pair by a predefined type and possibly ID (and again if so what API's should I look at)?
I hate to ask such open ended questions but it's just not clear from the examples I've been looking at online since everything is pretty much UWP oriented and I'm not really familiar with any of that at all. Just looking to get a yes/no on feasibility and a point in the right direction if so. Thanks for any input, chris
Figured I'd follow up on this for anyone else that goes down the same path... here's what I found eventually -
1) Is it even possible... Yes it's possible. I was able to get it working though due to the lack of documentation/examples what I came up with may not be the optimum solution. It does seem solid though from the limited testing I've done.
2) If so what is the best approach... Again, not sure this is the best approach but the very short answer is that do make it work you need to use WRL via COM. All the interfaces needed for both scanning and pairing are found in "windows.devices.enumeration.h" and you'll want to use the following namespaces - ABI::Windows::Foundation; Microsoft::WRL; Microsoft::WRL::Wrappers; ABI::Windows::Devices::Enumeration. Since many of the objects/interfaces you'll need are not documented at all (e.g. "IDeviceInformationStatics2") you'll need to use QueryInterface a good bit to find out what's available.
3) Is there a way to programatically pair... Yes, as noted above it's possible. It took me a few weeks to pick through it all and get it working but looking at the various related examples online and piecing it together it seems to work. One thing that I was concerned about was passing BLE pin codes where needed without a UI. That works too though again not really documented (see "AcceptWithPin")....

Realtime TCP/IP stack

I want to program (as efficiently as possible) a TCP/IP communication stack in C or C++. It really must run as fast as possible.
Does anyone have a good example or suggestion of where to start?
This is not meant as an insult, the guys who have developed the stacks for the well established operating systems have been doing this for years. This is what they do, unless you are in the business, I suggest you look at a different approach.
Different approach being, pick a stack that has decent performance (I hear that the latest tcp/ip stack in Solaris is nifty), then tune the hell out of it (there are lots of different flags and settings you can tune). If that fails to meet your needs, consider hardware solutions such as tcp offloading etc.
Writing your own stack, means you have to be confident enough to know that you can beat maybe 1000s of man years worth of effort in this field.
If this is for self development and learning, I suggest something simple like the source code for minix, it may have a simple to understand stack.
m2c.
This is a huge task. I would recommend the Contiki operating system as a possible starting point. It has a TCP/IP stack.
As Steve points out in the comments you do need quite a bit of experience to do this well. So rather than jumping directly to your end goal I recommend these possible steps:
Write a reliable transport using UDP as a normal user-land protocol.
Write a custom protocol using raw sockets in user-land.
Write a kernel level protocol module/driver
Write your stack on a FPGA network card
Linux is a good option as the details you need are easily accessible and documented.
And oh yeah, stop as soon as you realize you won't likely outperform the Linux kernel.
This may be worth looking at:
Implementing a High Performance Object Oriented TCP/IP Protocol Stack
Thesis for the Degree of Master of Science Peter Kjellerstedt and
Henrik Baard
lwip - A Lightweight TCPIP stack it's best to start learning about TCP/IP Stack
git clone git://git.savannah.nongnu.org/lwip.git

discrete event simulators for C++

I am currently looking for a discrete event simulator written for C++. I did not find much on the web written specifically in OO-style; there are some, but outdated. Some others, such as Opnet, Omnet and ns3 are way too complicated for what I need to do. And besides, I need to simulate agent-based algorithms capable of simulating systems of thousands of nodes.
Does anybody know anything suitable for my needs?
Others have good direct answers, but I'm going to suggest an alternative. If I understand you right, you want a system in C++ or such where you can post events that fire in the future, and code is run when those events fire.
I had a project to do like this, and I started out trying to write such an event system in C++ and then quickly realized I had a better solution.
Have you considered writing your program in behavioral Verilog? That may seem strange to write software in a hardware description language, but a Verilog simulator is an event-based system underneath, and behavioral Verilog is a very convenient way to express events, timing, triggers, etc. There is a free Verilog simulator (which is what I used) called Icarus Verilog. If you're not using Ubuntu or some Linux distro with Icarus already in a package, building from source is straightforward.
I would recommend having a second look to OmNet++. At first sight it may look quite complex, but if you look it into more detail you will find that most of the complexity is in the network add-on (the INET Framework). Unless you are going to do a detailed network simulation you do not need the INET.
Using OmNet++ core is not specially difficult and it may be simpler than other similar tools.
You may want to have a look to an intro.
One of the things that makes OmNet++ attractive to me is its scalability. Is possible to run large simulations in a desktop. Besides, it is possible to scale the same simulation to a cluster without rewriting the code.
You should consider SystemC, although I'd also recommend taking a second look at OmNet++.
We use SIMLIB at my school. It is very fast, easy to understand, object oriented, discrete and continuous simulator. It might look outdated but it is still maintained.
There is CSIM from Mesquite Software which supports developing models in C, C++ and Java. However, it is paid-commercial, AFAIK.
Take a look at GBL library. It's written in modern C++ and even supports C++0x features like move semantics and lambda functions. It offers several modeling mechanisms: synchronous and asynchronous event handlers, preemptive threads, and fibers. You can create purely behavioral, cycle accurate, and real-time models, or any mixture of those.

Where can I find documentation for publishing data to perfmon in C++?

Years ago I wrote some code to "publish" data for perfmon to consume. Using those counters is pretty well documented, but I found it challenging to find (at the time) good documentation and sample code to publish the data for perfmon.
Does anyone know where I can get this documentation? I also seem to recall some class wrappers, but I may be mistaken.
EDIT:
I did find this, and I will keep looking for "custom application performance counters".
You're bringing back old memories!
From 1998, Jeffrey Richter wrote an article in Microsoft Systems Journal describing how to create your own perfmon counters, its very easy (after cutting and pasting his template code just add shared-memory variables in a dll, and update them as needed).
Are you looking for Managed or native wrappers? The link you posted is managed, but your question is native (c++).
In managed world things are fairly easy and straight forward to publish counters using the PerformanceCounter and it relatives http://msdn.microsoft.com/en-us/library/system.diagnostics.performancecounter.aspx. For moderate volumes they can also be used for reading counters, for high volumes though you must use the PDH.DLL as the overhead of the managed counters reading one counter at a time will be overwhelming in my experience.
Personally I developed XSLT transformations to generate all prfmon counters in my apps, I blogged about this here: http://rusanu.com/2009/04/11/using-xslt-to-generate-performance-counters-code/ and I have more upcoming material to blog down the pipe.
If your question is about the unmanaged API, I don't have any pointer handy, but me personally I would go down the path of using again XSLT to generate all my perfmon code, as so much of it is repetitive.