Regwrite/FileWrapper

[LeftclicK]

Hello all, this is my first post - my apologies if my question is to broad. I have only been working with AutoIT for a few months now, before that did VBS... dont even know how to get started with this script.

Is it possible to intercept regwrite events and filewrite events and redirect the location's they are written to?

I'm looking to author a script that will do the following logic

Redirect a processes HKLM RegWrite(s) to HKCU

If that particular key is requested via a RegRead event, redirect it to its new home

Likewise for file modifications of ini's etc, redirecting them from locked down folders to a users home directory.

Is this possible? Can somone give me some direction to get started, I've never done any intercepting like this...

There is a program called "RegSpy" that intercepts regwrites to HKLM /HKCU , but not reads - this is what teased me with the idea. If you want to check it out, the source is in VB and included in the zip Regspy2.zip

Thanks to everyone in advance, I dont usually post on forums, but these ones are pretty active so I'll keep my fingers crossed

-LC

[Bert]

ummm....this can be used for dark stuff. Could you explain why you want to do such a thing? We know what you want to do, but not why you want to do it....

No offense, but if your reasons are not honorable, we won't help. It is a ethical thing....

[LeftclicK]

Volly, I completely understand. Its nothing dark, quite light actually.

I have been working through a list of 240 application's my firm uses and bundling them into MSI's. We button up our folders and registry pretty tight, so I have to with each package make sure that I give full permissions to whatever key's/files the users will need to modify when using each app.

I found the RegSpy application while trying to troubleshoot such issues and then thought "Hey, if I could create a wrapper, I wouldnt need to open permissions on these folders/keys at all" - but also it will allow these customizations to travel with the user to our citrix servers / other machines.

I dont need anyone to write this for me, on the contrary, I would love to learn how to do it myself. Alike examples would be more than enough to get me going here.

Pretty please, any help would be greatly appreciated!

[LeftclicK]

some love please

[noone]

Why not use the program regmon? It monitor all registry action.