Could someone please give me a high level explanation how they are able to monitor every single registry access?
http://technet.microsoft.com/en-us/sysinternals/bb896645
Enough detail so that i could google around the various sub-topics and try to write my own one? I know they've used some sort of dll injection/API hooking, but i'm unsure how they reached all the kernel mode activity.
It loads a virtual driver on startup which does the monitoring on a low-level. So it doesn't have to inject anything in other processes.
On http://www.decuslib.com/decus/vmslt00a/nt/filemon.htm there's a short explanation about how FileMon, one of ProcMon's predecessors, works.
If you like reading code, here's the source code of FileMon and RegMon: http://www.wasm.ru/baixado.php?mode=tool&id=283 (from http://forum.sysinternals.com/topic8038_page1.html)
来源：https://stackoverflow.com/questions/4833972/how-does-sysinternals-processmonitor-work