How to Simulate CTRL+ALT+DEL dialog box from a Application

NTDEV
1

Hi All,
Is it possible to call the CTRL+ALT+DEL dialog box from a win32
application. I remember reading sometime back that CTRL+ALT+DEL forms a
different desktop and could not be called from applications, since they run
on a different desktop. If it’s not possible to be done from a application,
will I be able to do it with the help of a keyboard filter driver by
replacing some keys with CTRL+ALT+DEL.

Thanks,
Sajeev.

2

> Is it possible to call the CTRL+ALT+DEL dialog box from a win32

application. I remember reading sometime back that CTRL+ALT+DEL forms a
different desktop and could not be called from applications, since they run
on a different desktop. If it’s not possible to be done from a application,
will I be able to do it with the help of a keyboard filter driver by
replacing some keys with CTRL+ALT+DEL.

Just relying on my poor memory about NT: CTRL+ALT+DEL is suppose to
be filtered away by if I’m not mistaken by it’s own driver. And you
can’t hook into it or replace it. It’s an integral part of NT’s
security model. It makes it difficult if not impossible to intercept
the CRTL+ALT+DELETE and provide a fake login box. If it’s implemented
as a priority filter after a keyboard driver then you might get lucky
if you write your own keyboard driver and provide a hook to insert
keystrokes. But I’m doubtful it could be that easy. Keyboard drivers
might be required to be signed in a normal system and if that’s the case
you are not going to get microsoft to sign it unless you satisfy their
security model.

3

CTRL+ALT+DEL doesn’t always pop up the logon dialog. Think about what
happens if the user’s already interactively logged on, for example. And not
all GINAs use CTRL+ALT+DEL as their SAS.

But if u want to fake a SAS at an arbitrary time & are very desparate, u
might want to try injecting a DLL into winlogon’s address space, hooking
winlogon’s call to !WlxInitialize, saving off a copy of the
function table that’s passed by winlogon to the gina in this function (and
the wlx handle), then notify your DLL from your app to call
functionTable->WlxSasNotify() whenever u want to simulate a “CTRL+ALT+DEL”
event. The quickest dirtiest way to do this that comes to mind is to make a
wrapper gina that does nothing but forward calls to the previously reigning
gina. This way has a # of problems, but it might be a good way for u to
test this method w/o having to waste a bunch of time. Look in msdn for info
on how to write a custom gina.

Keep in mind that since i’m no NT security stud, there’s a good chance that
I may very well be talking out of my buttocks.

----- Original Message -----
From:
To: “NT Developers Interest List”
Sent: Thursday, September 21, 2000 1:26 AM
Subject: [ntdev] How to Simulate CTRL+ALT+DEL dialog box from a Application

> Hi All,
> Is it possible to call the CTRL+ALT+DEL dialog box from a win32
> application. I remember reading sometime back that CTRL+ALT+DEL forms a
> different desktop and could not be called from applications, since they
run
> on a different desktop. If it’s not possible to be done from a
application,
> will I be able to do it with the help of a keyboard filter driver by
> replacing some keys with CTRL+ALT+DEL.
>
> Thanks,
> Sajeev.
>
> —
> You are currently subscribed to ntdev as: xxxxx@timesn.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
>