Combining keyboard and mouse filters into one driver

NTDEV
1

I am working on a singular driver that needs to filter mouse and keyboard input. They both will work together to achieve a common goal so cupelling them makes sense plus it makes life easier when installing, signing, etc. Anyways I have gotten these filter drivers working perfectly on their own but I am having trouble merging them. My DriverEntry function contains WDF_DRIVER_CONFIG_INIT(&config, Filter_EvtDeviceAdd) where Filter_EvtDeviceAdd needs to be designed to handle both mouse and keyboard devices. My thought was to find a way to check for the incoming GUID and based on that I can run something like the following.

if (IsEqualGUID(&deviceClassGuid, &GUID_DEVCLASS_MOUSE)) {
        WdfDeviceInitSetDeviceType(DeviceInit, FILE_DEVICE_MOUSE);
        WDF_IO_QUEUE_CONFIG_INIT_DEFAULT_QUEUE(&ioQueueConfig, WdfIoQueueDispatchParallel);
        ioQueueConfig.EvtIoInternalDeviceControl = MouFilter_EvtIoInternalDeviceControl;
    } 
    else if (IsEqualGUID(&deviceClassGuid, &GUID_DEVCLASS_KEYBOARD)) {
        WdfDeviceInitSetDeviceType(DeviceInit, FILE_DEVICE_KEYBOARD);
        WDF_IO_QUEUE_CONFIG_INIT_DEFAULT_QUEUE(&ioQueueConfig, WdfIoQueueDispatchParallel);
        ioQueueConfig.EvtIoInternalDeviceControl = KbFilter_EvtIoInternalDeviceControl;
    } 
    else {
        DebugMessage("Neither mouse nor keyboard device class assigned \n");
        return STATUS_SUCCESS;  // If it's neither a mouse nor a keyboard, just return.
    }

The tricky part however is that I don’t know how I can determine deviceClassGuid. At first I thought I could use IoGetDeviceProperty(WdfDeviceWdmGetPhysicalDevice(device), DevicePropertyClassGuid, sizeof(GUID), &deviceClassGuid, &returnedLength) but that would require an instance of device which I don’t have because it would require me to call WdfDeviceCreate which deletes DeviceInit thus making it impossible to call WdfDeviceInitSetDeviceType(DeviceInit, FILE_DEVICE_MOUSE). The only other idea I have is to make a generic EvtIoInternalDeviceControl function and then check GUID there in the way I suggested above. Anyways I would greatly appreciate a solution to this so that I can correctly handle both types of devices.

2

WdfFdoInitWdmGetPhysicalDevice WdfFdoInitAllocAndQueryProperty WdfFdoInitAllocAndQueryPropertyEx WdfFdoInitQueryProperty WdfFdoInitQueryPropertyEx

3

@Doron_Holan said:
WdfFdoInitWdmGetPhysicalDevice
WdfFdoInitAllocAndQueryProperty
WdfFdoInitAllocAndQueryPropertyEx
WdfFdoInitQueryProperty
WdfFdoInitQueryPropertyEx

I am still stuck I decided to do the following.

// Query for the device class GUID.
    if (NT_SUCCESS(status = WdfFdoInitAllocAndQueryProperty(DeviceInit, DevicePropertyClassGuid, NonPagedPool, WDF_NO_OBJECT_ATTRIBUTES, &memory))) {
        deviceClassGuid = WdfMemoryGetBuffer(memory, NULL);

        if (deviceClassGuid == NULL) {
            WdfObjectDelete(memory);
            DebugMessage("deviceClassGuid is null");
            return STATUS_SUCCESS;
        }

        DebugMessage("deviceClassGuid: {%.8lX-%.4hX-%.4hX-%.2hhX%.2hhX-%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX}\n",
            deviceClassGuid->Data1, deviceClassGuid->Data2, deviceClassGuid->Data3,
            deviceClassGuid->Data4[0], deviceClassGuid->Data4[1], deviceClassGuid->Data4[2],
            deviceClassGuid->Data4[3], deviceClassGuid->Data4[4], deviceClassGuid->Data4[5],
            deviceClassGuid->Data4[6], deviceClassGuid->Data4[7]);

        DebugMessage("GUID_DEVCLASS_KEYBOARD: {%.8lX-%.4hX-%.4hX-%.2hhX%.2hhX-%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX}\n",
            GUID_DEVCLASS_KEYBOARD.Data1, GUID_DEVCLASS_KEYBOARD.Data2, GUID_DEVCLASS_KEYBOARD.Data3,
            GUID_DEVCLASS_KEYBOARD.Data4[0], GUID_DEVCLASS_KEYBOARD.Data4[1], GUID_DEVCLASS_KEYBOARD.Data4[2],
            GUID_DEVCLASS_KEYBOARD.Data4[3], GUID_DEVCLASS_KEYBOARD.Data4[4], GUID_DEVCLASS_KEYBOARD.Data4[5],
            GUID_DEVCLASS_KEYBOARD.Data4[6], GUID_DEVCLASS_KEYBOARD.Data4[7]);

        DebugMessage("GUID_DEVCLASS_MOUSE: {%.8lX-%.4hX-%.4hX-%.2hhX%.2hhX-%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX}\n",
            GUID_DEVCLASS_MOUSE.Data1, GUID_DEVCLASS_MOUSE.Data2, GUID_DEVCLASS_MOUSE.Data3,
            GUID_DEVCLASS_MOUSE.Data4[0], GUID_DEVCLASS_MOUSE.Data4[1], GUID_DEVCLASS_MOUSE.Data4[2],
            GUID_DEVCLASS_MOUSE.Data4[3], GUID_DEVCLASS_MOUSE.Data4[4], GUID_DEVCLASS_MOUSE.Data4[5],
            GUID_DEVCLASS_MOUSE.Data4[6], GUID_DEVCLASS_MOUSE.Data4[7]);

This resulted in the following debug messages.

deviceClassGuid: {0034007B-0064-0033-3600-650039003600}
GUID_DEVCLASS_KEYBOARD: {4D36E96B-E325-11CE-BFC1-08002BE10318}
GUID_DEVCLASS_MOUSE: {4D36E96F-E325-11CE-BFC1-08002BE10318}

I am manually creating the driver via cmd and then I am going into my device manager and then clicking on “HID-compliant mouse” and selecting disable before then reenabling it again which then runs my drivers code. But I have no idea what the 0034007B-0064-0033-3600-650039003600 GUID is because it does not even look valid so what is going on here and how can I fix it?

4

Anyone have any suggestions to get the ClassGUID from a PWDFDEVICE_INIT DeviceInit before we can create its instance of WDFDEVICE device?

5

Requests the GUID for the device’s setup class. PropertyBuffer points to a NULL-terminated array of WCHAR. This routine returns the GUID in a string format as follows, where each “c” represents a hexadecimal character: {cccccccc-cccc-cccc-cccc-cccccccccccc}

1 Like