how does csrss read the mouse/keyboard ?

NTDEV
1

>

I am familiar with the mouse/keyboard drivers…

But i am unclear on which object/handle the csrss is actually opening and reading.

Does the class driver export a well known file object which csrss opens ?

Thanks for any leads/info

2

Why does it matter? Just curious or do you think you need to open these input devices too?

d

tiny phone keyboard + fat thumbs = you do the muth

-----Original Message-----
From: xxxxx@gmail.com
Sent: Tuesday, March 23, 2010 1:50 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] how does csrss read the mouse/keyboard ?

<>

I am familiar with the mouse/keyboard drivers…

But i am unclear on which object/handle the csrss is actually opening and reading.

Does the class driver export a well known file object which csrss opens ?

Thanks for any leads/info

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

> Why does it matter? Just curious or do you think you need to open these input devices too? d

Because, having spend 2 fun months writing a filter kb and mouse, i am considering
an architecture change (non kernel api trapping inside csrss anyone? )

(yes - i know this is not MS advised - yes i know this will smell like rootkit - sighs)

Any actual help will be appreciated

4

But what’s the ultimate prob
wrote in message news:xxxxx@ntdev…
>> Why does it matter? Just curious or do you think you need to open these
>> input devices too? d
>
> Because, having spend 2 fun months writing a filter kb and mouse, i am
> considering
> an architecture change (non kernel api trapping inside csrss anyone? )
>
> (yes - i know this is not MS advised - yes i know this will smell like
> rootkit - sighs)
>
> Any actual help will be appreciated
>

5

All input goes through the raw input thread (in win32k.sys, not csrss) so your current scheme with a filter driver is probably the best choice.

d

tiny phone keyboard + fat thumbs = you do the muth

-----Original Message-----
From: xxxxx@gmail.com
Sent: Tuesday, March 23, 2010 3:46 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] how does csrss read the mouse/keyboard ?

> Why does it matter? Just curious or do you think you need to open these input devices too? d

Because, having spend 2 fun months writing a filter kb and mouse, i am considering
an architecture change (non kernel api trapping inside csrss anyone? )

(yes - i know this is not MS advised - yes i know this will smell like rootkit - sighs)

Any actual help will be appreciated

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

6

On Wed, Mar 24, 2010 at 3:19 AM, Doron Holan wrote:
> All input goes through the raw input thread (in win32k.sys, not csrss).

So the raw input thread is a kernel thread?

How does the RIT handle sessions?

–
Aram Hăvărneanu

7

It is not a kernel thread (it does not belong to ntoskrnl). It belongs to Win32k.sys, so it is a KM thread. Win32k.sys is session aware, so it knows how to handle sessions

d