Filter Driver (HID) Touch Display Devices.

Windows 10 (1607) and higher, Windows Server 2019 and higher.

I apologize for the length of this post, but I thought it was best to prevent ‘what are you trying to accomplish’ responses.

I have a client / server application ’suite’ that is sort of a VNC suite on steroids.
A client can connect to the server and see the server’s desktop.
A client can ‘request ownership’ of the server. When this occurs the server ‘grants’ the client ownership and then:
– Keyboard input generated on the client is directed to the server.
– Mouse input generated on the client is directed to the server.
– Touch events (Touch screen / display) generated on the client are directed to the server.
---- On the server, touch events are processed by a Virtual Touch Display driver that is sitting as an UpperFilter on mshidkmdf.

The server component (The VNC type server) running on the server machine has a true Windows service component that amongst other things watches for a desktop change. When the desktop changes it loads a ‘Helper’ component that runs under the current session within the desktop. When the service sees the desktop change (UAC prompts, User Logon, Etc.) it unloads the current ‘Helper’ and loads a new helper component under the current context.

There is an option in the server to disable input from on the server machine when a client ‘owns’ the resources.
– Keyboard input from local devices on the server machine are disabled. This is currently achieved via a low-level Keyboard Hook DLL managed within the ‘Helper’ component plus BlockInput(), and yes, I am going to replace this with a keyboard filter driver.
– Mouse input from local devices on the server machine are disabled. This is currently achieved via the ‘Helper’ component via BlockInput(), and yes, I am going to replace this with a mouse filter driver.
To Do: Touch events (Touch screens / displays) from local devices on the server machine need to be disabled. I cannot disable touch (Wisp) in the registry due to the Virtual Touch Display driver on the server that needs to stay enabled (amongst other reasons).

So, I believe I need a filter driver (perhaps above HidClass.sys?) where I can filter out all Touch events EXCEPT for the touch events produced by the Virtual Touch Display driver.

The only relevant posting (anywhere!) I have found about this:
Intercepting touch screen input — OSR

Here is what I perceive to be the ‘answer’ (From Doran Holan):
Yes, you can filter at the class level. The risk is higher. Filtering at the class layer means if you can query for usage page in AddDevice, do so and not attach. Otherwise you will always be in each stack and decide in startdevice if you are in pass through mode or filter mode. Remember that the parent device (the hid miniport) is also installed in the HIDclass and you should not attach to these.

This (of course) has generated a myriad of questions on my part:
Yes, you can filter at the class level. Meaning, yes, filter as an upper filter on HidClass.sys?
Filtering at the class layer means if you can query for usage page in AddDevice. I am utilizing KMDF and am assuming that ‘AddDevice’ is EVT_WDF_DRIVER_DEVICE_ADD. How does one ‘query for usage page’ from EVT_WDF_DRIVER_DEVICE_ADD?
do so and not attach. I believe this means if the usage page is Digitizer (0x05,0x0D) do not attach.
Remember that the parent device (the hid miniport) is also installed in the HIDclass and you should not attach to these. It seems as if I knew how to query for the devices usage page (above) I am going to see ‘the parent device’ also and I should not attach to that. How does none identify ‘the parent device’?

I apologize if I am asking to many questions in a single post.


Any assistance or pointers would be greatly appreciated.