I wrote a WDF keyboard filter driver which is supposed to hook the keyboard class service callback. I do everything exactly as kbfiltr does, but for some reason, my device completely replaces kbdhid in the keyboard device stack. Consequently, the keyboard service callback is never called and the request is dropped at hidclass level. After doing some debugging I noticed that when I load my driver and connect a physical device, the KbdHid_AddDevice function is not called by the system, whereas it usually is. Normally the keyboard device stack looks like hidclass->kbdhid->kbdclass, if my driver is loaded then it looks like hidclass->kbdhid->kbdclass. I don't think this is intended since I should be able to just hook the service callback. Microsofts documentation doesn't really help either. I also tried to load unmodified kbfiltr and the result is the same, the hook doesn't work and the device is replaced. Help is much appreciated!
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||20 Apr 2020||LIVE ONLINE|
|Writing WDF Drivers||11 May 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|