Intercepting rdp keystrokes in keyboard filter driver

NTDEV
1

I have the requirement to intercept rdp keystrokes.
I found this thread:
https://community.osr.com/discussion/270714
It seems for me that this is outdated with the actual win10. In my filter driver I see the keys in rdp.
I also found this:

https://support.microsoft.com/en-us/help/2867446/how-to-enable-a-third-party-driver-to-intercept-and-disable-the-sas-ke

  1. Have anyone experience with such requirements?
  2. How should we handle rdp keystrokes?

Thanks
Manfred

2

On Wed, Oct 10, 2018 at 11:42 PM Mak
wrote:
>
> OSR https://community.osr.com/
> Mak started a new discussion: Intercepting rdp keystrokes in keyboard filter driver
>
> I have the requirement to intercept rdp keystrokes.
>
> I found this thread:
>
> https://community.osr.com/discussion/270714
>
> It seems for me that this is outdated with the actual win10. In my filter driver I see the keys in rdp.
>
> I also found this:
>
> https://support.microsoft.com/en-us/help/2867446/how-to-enable-a-third-party-driver-to-intercept-and-disable-the-sas-ke
>
>
> * Have anyone experience with such requirements?
> * How should we handle rdp keystrokes?
>

What do you need to do? You can poke into the remote desktop services
code (the default implementation of which is not actually available
for perusal) to see how input is handled. Not knowing if the RDS code
does something unique, the stack should look like this:

Hardware input / RDS input —> Class driver —> Input stack.

My knowledge of driver operation is that you can only intercept events
in the middle. That place in the stack may or may not retain how the
input was generated (if I had to guess I don’t think it forwards it
along, it’s irrelevant). You really should not process input any
differently based on how it was generated. The differences should be
contained in the drivers before the input class drivers.

Considering this the best thing to do is to check if you are in a
remote session in userspace. Again, it’s not a good idea to do much
different based on this information.

Cheers,
R0b0t1

3

I dont know what you want to say. I write a keyboard filter driver and here we have the service callback in which we get all keystrokes. You can translate/replace them. I have no knowledge about userspace at this moment. The only thing is that the rdp is a special HID with the name “TERMINPUT…”.