Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Question regarding Virtual HID Framework

jtomczykjtomczyk Member Posts: 10

I have successfully built and installed the HID Injector sample from Microsoft. I see in device manager the “Virtual HID Framework (VHF) HID device” under the Human Interface Devices category.

I know that the HID Injector simulates standard windows devices (keyboard, mouse, touch panel etc.) because its HID Report descriptors specifies those devices. So sending a HID command to simulate a keyboard key stroke will be forwarded to the “Virtual HID Framework (VHF) HID device” which will in turn “inject” this command to the operating system for processing. The same as if I pressed a key on the keyboard.

The flow of data is:

  1. Application connects to HID Injector and send HID command,
  2. HID Injector forwards HID command to “Virtual HID Framework (VHF) HID device”,
  3. “Virtual HID Framework (VHF) HID device” injects HID Command to operating system.

I created a new HID report descriptor that includes vendor defined Usage Page and Usages. It will not be injecting its commands into the operating system.

Is it possible to “inject” a HID report to another application instead of the operating system? I want to accomplish the following data flow:

  1. Application 1 connects to HID Injector,
  2. Application 2 connects to “Virtual HID Framework (VHF) HID device”,
  3. Application 1 send HID command to HID Injector,
  4. HID Injector forwards HID command to “Virtual HID Framework (VHF) HID device”,
  5. “Virtual HID Framework (VHF) HID device” injects HID Command to Application 2.

Is that data flow scenario possible?

How can Application 2 connect to the “Virtual HID Framework (VHF) HID device” to receive reports sent by Application 1?


  • Tim_RobertsTim_Roberts Member - All Emails Posts: 13,823

    Are you the same person as @geeklostinwoods ? Because he had the exact same insane question. There are a hundred ways to do interprocess communication. Writing a fake HID device is not one of them.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • jtomczykjtomczyk Member Posts: 10

    Actually, I'm not that person.

    Though it may be "insane" - is what I suggesting possible?

    If so, how?

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 13,823

    Of course it's possible, you practically wrote a design document above. Your injector just needs to send ioctls directly to the device. The driver then stores them in a local data store, and submits them as reports when the HID application reqeusts.

    It's still a stupid way to do IPC.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • jtomczykjtomczyk Member Posts: 10

    If failed to mention that Application 1 & Application 2 both have the ability to send and receive HID commands. So they both need to connect to the HID Injector driver. Application 1 already uses the provided interface for the injector. I wanted Application 2 to connect to the PDO which in this case is “Virtual HID Framework (VHF) HID device”.

  • MBond2MBond2 Member Posts: 277

    presumably you don't control anything about either application and simply want the 'glue' them together via the input stack?

    also, presumably, neither application1 nor application2 rely on Windows standard input processes for keyboard or mouse input but directly open devices?

  • jtomczykjtomczyk Member Posts: 10

    The answer to the 1st question is -> Yes.

    I'm not sure about what you're referring to in the 2nd, however both applications can receive input from keyboard and mouse.

  • MBond2MBond2 Member Posts: 277

    yes, the question is how they receive input. do they simply process normal input via GDI and the message loop? or do they do less common things like opening devices directly? If you don't know, than almost certainly they process input normally - which means that you can control application 1 from application 2 entirely in UM with no driver at all by simply calling SendInput. if you don't control the source for either of them, then use a low level keyboard hook or the detours library to 'capture' the input you want to transmit from one to the other.

    all of this can be done in UM and all has enforced security boundaries within windows

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE