Intercepting/Modifying Registry Reads

[colttaylor]

I am working with a commercial program (with no source) that gets its SQL connection information from the registry. The program does not provide any means of overriding these connection settings and there is only one location in the registry for the settings.
My goal is to run the program two or more times, on my terminal server, each with a different set of SQL connection settings.
Also, NTREGMON reports that the program goes to the registry for these settings at various points in its operation, not just at program startup.
Is there any way to "catch" the registry read attempt and provide my own response which is different from that actually stored in the registry.
For example, if the registry says that the program should connect to a sql database called DATA1, could I write a service to catch all of the registry read attempts and based on the reading program's terminal server session number, send different responses. When the program reads the registry from TS-Session 2, it would get back DATA2..., TS-Session 5 would get DATA5..., etc.
If anyone has any experience with this kind of issue (or any ideas about other solutions to the problem), I would greatly appreciate your replies.
Thanks in advance!
Peace,
Colt

If it's stupid but it works, it isn't stupid

 

[buho]

Things are pretty difficult; all depends on how the target app works. If it is writing the registry only one time and reading the values at a *sensible* later time, you can ask Win for a notification on change (with RegNotifyChangeKeyValue) and rewrite the key.

But I'll not bet on such approach, as you can not synch both apps to be sure your app have time enough to rewrite the key before the first one started reading it.

Take a look at what Solomon & Russinovich have to say at

http://www.sysinternals.com/ntw2k/source/regmon.shtml

NTREGMON is a really demoniacal piece of code

buho (A).