عدم برگرداندن نام کلید در رویدادهای تغییرات در یک کلید از رجیستری

[ROSTAM2]

سلام
من می خوام با WMI رویداد تغییر کلید رجیستری رو متوجه بشم ولی آدرس کلیدی که ایجاد یا حذف می شه رو به من نمی ده و فقط همون آدرسی که خودم به Query دادم برمی گردونه:
اگ اطلاعاتی در این زمینه دارید راهنمایی کنید لطفا:



Imports System.Management
Public Class RegistryEventWatcher


''' <summary>
''' HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall
''' </summary>
Shared [Event] As New EventQuery("SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVers ion\\Uninstall'")
' Dim WatcherOptions As New EventWatcherOptions()
Shared WithEvents EventWatch As New ManagementEventWatcher([Event])
Public Shared Sub WaitForNext()
Try
With EventWatch
.Options.Timeout = New TimeSpan(0, 0, 5)
.Start()
End With
Catch ex As Exception
Debug.Print(ex.Message)
End Try


End Sub


Private Shared Sub EventWatch_EventArrived(sender As Object, e As EventArrivedEventArgs) Handles EventWatch.EventArrived
Dim Coll As ManagementNamedValueCollection = e.Context


For Each P As PropertyData In e.NewEvent.Properties
Debug.Print("{0}: {1}", P.Name, P.Value)
For Each Q As QualifierData In P.Qualifiers
Debug.Print("{0}: {1}", Q.Name, Q.Value)
Next
Next
For Each P As PropertyData In e.NewEvent.SystemProperties
Debug.Print("{0}: {1}", P.Name, P.Value)
For Each Q As QualifierData In P.Qualifiers
Debug.Print("{0}: {1}", Q.Name, Q.Value)
Next
Next
For Each Item In Coll
Debug.Print(Item.ToString)
Next
End Sub
End Class

[ROSTAM2]

چیزی که من بهش رسیدم:


Imports System.Management
Imports Microsoft.Win32
Public Class RegistryEventWatcher
Private Shared KeysValue As New List(Of String)
Public Shared ReadOnly Property Keys() As List(Of String)
Get
Return KeysValue
End Get
End Property
''' <summary>
''' HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall
''' </summary>
''' <returns></returns>
Public Shared ReadOnly Property RootKey() As RegistryKey
Get
Return Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal l")
End Get
End Property
''' <summary>
''' HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall
''' </summary>
Shared [Event] As New EventQuery("SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVers ion\\Uninstall\\'")
Shared WithEvents EventWatch As New ManagementEventWatcher([Event])
Public Shared Sub WaitForNext()
'add registry Keys of parent....
Keys.Clear()


For Each KeyName As String In RootKey.GetSubKeyNames
If Keys.Contains(KeyName) = True Then Continue For
Keys.Add(KeyName)
Next
Try
With EventWatch
.Options.Timeout = New TimeSpan(0, 0, 5)
.Start()
End With
Catch ex As Exception
Debug.Print(ex.Message)
End Try


End Sub
Public Shared Sub KeyAdded(RootKey As RegistryKey, KeyName As String)
Debug.Print("RegistryKey Added: {0} to {1}", KeyName, RootKey.Name)
End Sub
Public Shared Sub KeyRemoved(RootKey As RegistryKey, KeyName As String)
Debug.Print("RegistryKey Deleted: {0} from {1}", KeyName, RootKey.Name)
End Sub
Shared List As New List(Of String)
Private Shared Sub EventWatch_EventArrived(sender As Object, e As EventArrivedEventArgs) Handles EventWatch.EventArrived
Dim Coll As ManagementNamedValueCollection = e.Context
List.Clear()
List.AddRange(RootKey.GetSubKeyNames())
Research:
For Each KeyName As String In Keys
If List.Contains(KeyName) = False Then
KeyRemoved(RootKey, KeyName)
Keys.Remove(KeyName)
GoTo Research
End If
Next
For Each KeyName As String In List
If Keys.Contains(KeyName) = True Then Continue For
Keys.Add(KeyName)
KeyAdded(RootKey, KeyName)
Next
Debug.Print(e.NewEvent.GetText(TextFormat.Mof))
End Sub
End Class