Intercept mouse input

NTDEV
1

Hi,

I have one requirement for my mouse class filter driver - for each MOUSE_INPUT_DATA, the driver needs the user mode application to determine whether to keep the input data from Win32. The detemination can’t be in the kernel mode because the code calls all Win32 APIs.

The filter driver gets the MOUSE_INPUT_DATA in the service callback function which runs in the DISPATCH_LEVEL. How can I do that not to impact the performance and not block the normal mouse events?

Thanks,
Marshall

2

First off, your design is kind of busted if you need per packet inspection. What APIs are you calling in user mode to make the determination?

In your service callback you can store the reported packets and not call the upper callback. You copy those packets in to a pending read ioctl that your app sends (at all times probably). The app sends a different ioctl for the packets that are approved. When that is received you call the upper callback. I sure hope your code does this quickly because the user can perceive delays > 10-20ms

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 7/15/2012 6:51 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Intercept mouse input

Hi,

I have one requirement for my mouse class filter driver - for each MOUSE_INPUT_DATA, the driver needs the user mode application to determine whether to keep the input data from Win32. The detemination can’t be in the kernel mode because the code calls all Win32 APIs.

The filter driver gets the MOUSE_INPUT_DATA in the service callback function which runs in the DISPATCH_LEVEL. How can I do that not to impact the performance and not block the normal mouse events?

Thanks,
Marshall

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Hi Doron,

Thanks for you quick reply. Actually, we don’t need to inpect each input. We need to inpect the mouse down and up event. For each down and up mouse event, the app needs check whether it’s in the specific window by calling couple Win32 GDI related APIs.

I will evalute the delay using WPP log. Is there any way to improve the performance if it causes dramatic delay for users?

Thanks,
Marshall

4

Instead if inspecting window in the app for every packet, have the app send the “baked” state changes to the driver and then the driver can just switch on the state and do the intended behavior without a round trip

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 7/15/2012 6:48 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Intercept mouse input

Hi Doron,

Thanks for you quick reply. Actually, we don’t need to inpect each input. We need to inpect the mouse down and up event. For each down and up mouse event, the app needs check whether it’s in the specific window by calling couple Win32 GDI related APIs.

I will evalute the delay using WPP log. Is there any way to improve the performance if it causes dramatic delay for users?

Thanks,
Marshall

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Since this is for a specific application, why does the kernel need to be
involved at all? You can do all this in the app. Note that unless you
are doing mouse capture, only the active window under the mouse (static
windows are ignored) receives the mouse input.

Is it strictly an issue of latency? Note that most interactive apps get
mouse messages completed with high priority so the app will be able to
respond quickly.
joe

Hi,

I have one requirement for my mouse class filter driver - for each
MOUSE_INPUT_DATA, the driver needs the user mode application to determine
whether to keep the input data from Win32. The detemination can’t be in
the kernel mode because the code calls all Win32 APIs.

The filter driver gets the MOUSE_INPUT_DATA in the service callback
function which runs in the DISPATCH_LEVEL. How can I do that not to impact
the performance and not block the normal mouse events?

Thanks,
Marshall

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

I have written hundreds of thousands of lines of app-level code. Many of
these apps care a lot about mouse clicks. It sounds to me like you are
creating a complex solution to a problem that had been solved in Win16
1.0. So what is the reason this has to be done in the kernel? Can you
give a spec on the actual requirements, as well as explaining why it can’t
be done without doing stuff in the kernel, or using a per-process hook in
the worst case (an by “hook” I mean SetWinowsHookEx).
joe

Hi Doron,

Thanks for you quick reply. Actually, we don’t need to inpect each input.
We need to inpect the mouse down and up event. For each down and up mouse
event, the app needs check whether it’s in the specific window by calling
couple Win32 GDI related APIs.

I will evalute the delay using WPP log. Is there any way to improve the
performance if it causes dramatic delay for users?

Thanks,
Marshall

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

>

I have written hundreds of thousands of lines of app-level code. Many of
these apps care a lot about mouse clicks. It sounds to me like you are
creating a complex solution to a problem that had been solved in Win16 1.0.
So what is the reason this has to be done in the kernel? Can you give a spec
on the actual requirements, as well as explaining why it can’t be done
without doing stuff in the kernel, or using a per-process hook in the worst
case (an by “hook” I mean SetWinowsHookEx).

One reason would be if they were developing an “aim bot” for cheating at 3rd person shooter games, which detect most trivial attempts to inject input events. The description the OP gives seems to rule that out though (unless they are telling a few mistruths to get the information they want - I’m sure that’s never happened before :slight_smile:

James

8

Note that mouse ballistics is added above in win32k.sys, so you cannot match the coords in MOUSE_INPUT_DATA against the windows.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntdev…
> Hi,
>
> I have one requirement for my mouse class filter driver - for each MOUSE_INPUT_DATA, the driver needs the user mode application to determine whether to keep the input data from Win32. The detemination can’t be in the kernel mode because the code calls all Win32 APIs.
>
> The filter driver gets the MOUSE_INPUT_DATA in the service callback function which runs in the DISPATCH_LEVEL. How can I do that not to impact the performance and not block the normal mouse events?
>
> Thanks,
> Marshall
>

9

>down and up event. For each down and up mouse event, the app needs check whether it’s in the

specific window by calling couple Win32 GDI related APIs.

User32 level hooks are the only solution. You cannot match MOUSE_INPUT_DATA against windows.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com