kbd filter driver as a class filter driver

NTDEV
1

Hi All,

I have created 1 ps2 kbd filter driver based on the DDK example. The functions work OK.

Then according to the DDK I install this driver as a class filter
and make it sit below the kbdclass filter driver by adding the service
name of this filter driver before the kbdclass filter in the registry at
" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\
{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters"

Then I connect a USB keyboard.

Now the USB keyboard works fine, with the logic I added in the filter driver. But the PS2 keyboard got problem now. Let me give a example. Suppose I map F1 to F11, F11 to F21 in the filter driver. Now when I press F1, in addition to the F11 make code and break codes, F21 make code and break code are also sent.

Can anyone help me figure out what I did wrongly? Do I need more configuration for the PS2 port driver? Many thanks in advance!

Best Regards,
Jeff

2

Hoe about you connect a kernel debugger and debug it? Or add some logging to see what is going on? We have no idea what you did to the sample after you copied it, the sample works on multiple devices simultaneously so this is something you introduced

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 2/14/2012 10:09 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] kbd filter driver as a class filter driver

Hi All,

I have created 1 ps2 kbd filter driver based on the DDK example. The functions work OK.

Then according to the DDK I install this driver as a class filter
and make it sit below the kbdclass filter driver by adding the service
name of this filter driver before the kbdclass filter in the registry at
" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\
{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters"

Then I connect a USB keyboard.

Now the USB keyboard works fine, with the logic I added in the filter driver. But the PS2 keyboard got problem now. Let me give a example. Suppose I map F1 to F11, F11 to F21 in the filter driver. Now when I press F1, in addition to the F11 make code and break codes, F21 make code and break code are also sent.

Can anyone help me figure out what I did wrongly? Do I need more configuration for the PS2 port driver? Many thanks in advance!

Best Regards,
Jeff

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Hi Doron,

Actually I have added some additional codes in KbFilter_ServiceCallback( ) based on the DDK sample, so that when 1 key is pressed, I can map it to another key. For example F1->F11 and F11->F21.

According to DDK, this sample is for PS2 keyboard. If we want to use it as a class filter driver, we need to change the registry as I mentioned yesterday.

After the modification, the PS2 keyboard got problem. By right, when F1 key is pressed, F11 key effect is generated. But after debugging I found that the mapping seems happen twice, that is, the F11 key effect and further F21 effect are generated. I tried others keys, the same problem. It seems this filter function is called twice for PS2 keyboard.

So I suspect the registry modification is not complete. Maybe I need more configuration.

BTW, the registration modification is based on the comments in the sample code. The details:

If you want to filter keyboard inputs from all the keyboards (ps2, usb)
plugged into the system then you can install this driver as a class filter
and make it sit below the kbdclass filter driver by adding the service
name of this filter driver before the kbdclass filter in the registry at
" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\
{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters"

Thanks and Regards,
Jeff

4

Did you install it as a class filter on the same machine where it was installed as a device upper filter? Then you can easily be in the stack twice

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 2/15/2012 6:11 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] kbd filter driver as a class filter driver

Hi Doron,

Actually I have added some additional codes in KbFilter_ServiceCallback( ) based on the DDK sample, so that when 1 key is pressed, I can map it to another key. For example F1->F11 and F11->F21.

According to DDK, this sample is for PS2 keyboard. If we want to use it as a class filter driver, we need to change the registry as I mentioned yesterday.

After the modification, the PS2 keyboard got problem. By right, when F1 key is pressed, F11 key effect is generated. But after debugging I found that the mapping seems happen twice, that is, the F11 key effect and further F21 effect are generated. I tried others keys, the same problem. It seems this filter function is called twice for PS2 keyboard.

So I suspect the registry modification is not complete. Maybe I need more configuration.

BTW, the registration modification is based on the comments in the sample code. The details:

If you want to filter keyboard inputs from all the keyboards (ps2, usb)
plugged into the system then you can install this driver as a class filter
and make it sit below the kbdclass filter driver by adding the service
name of this filter driver before the kbdclass filter in the registry at
" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\
{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters"

Thanks and Regards,
Jeff

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Hi Doron,

You are right. I have searched my machine registry and found that the filter driver is actually included twice.

Another place is under HKLM\System\CurrentContolSet\Enum\ACPI\PNP0303, there is one registry in which there are values: Service-> i8042prt, UpperFilters -> (my filter driver name).

The current problem is that I cannot remove the UpperFilters value. Every time I restart, it will be there.

Just to share some information on what I did. I based on the DDK sample to modify the kbfiltr.ini, to change the PNPID to PNP0303 according to my BIOS setting.

For what I did for intall it as a class filter driver, I just modified the registry key as I put in my previous message.

So is it correct I should modify the kbfiltr.ini so that it will be installed as a class filter driver? Do you have any suggestions how to modify this kbfiltr,ini?

Thanks and Regards,
Jeff

6

You can’t install class filters with an INF unfortunately.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Thursday, February 16, 2012 8:21 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] kbd filter driver as a class filter driver

Hi Doron,

You are right. I have searched my machine registry and found that the filter driver is actually included twice.

Another place is under HKLM\System\CurrentContolSet\Enum\ACPI\PNP0303, there is one registry in which there are values: Service-> i8042prt, UpperFilters -> (my filter driver name).

The current problem is that I cannot remove the UpperFilters value. Every time I restart, it will be there.

Just to share some information on what I did. I based on the DDK sample to modify the kbfiltr.ini, to change the PNPID to PNP0303 according to my BIOS setting.

For what I did for intall it as a class filter driver, I just modified the registry key as I put in my previous message.

So is it correct I should modify the kbfiltr.ini so that it will be installed as a class filter driver? Do you have any suggestions how to modify this kbfiltr,ini?

Thanks and Regards,
Jeff

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

7

Hi Doron,

So what is the correct way to install class filter driver? Can I install my driver as a service only without it being put into the i8042 port driver?

Thanks and Regards,
Jeff

8

You install a class filter by writing an installer that puts the service in name in the UpperFilters class value in the right order with respect to kbdclass

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Sunday, February 19, 2012 6:54 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] kbd filter driver as a class filter driver

Hi Doron,

So what is the correct way to install class filter driver? Can I install my driver as a service only without it being put into the i8042 port driver?

Thanks and Regards,
Jeff

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

9

For sure!

Em 20/02/2012, ?s 00:54, xxxxx@hotmail.com escreveu:

Hi Doron,

So what is the correct way to install class filter driver? Can I install my driver as a service only without it being put into the i8042 port driver?

Thanks and Regards,
Jeff

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

10

Hi Doron and All,

I have modified the kbfiltr.inf to achieve my purpose although it seems a little not decent.

Thanks and Regards,
Jeff

11

Can I give you a suggestion? I’ve made a library that you could use instead of building your own driver. Although I don’t advise you to stop your learning in any way, the purpose of the library is just to abstract from writing a keyboard/mouse filter driver…

You may check it at http://oblita.com/Interception.

Regards,
Francisco.

Em 20/02/2012, ?s 01:37, xxxxx@hotmail.com escreveu:

Hi Doron and All,

I have modified the kbfiltr.inf to achieve my purpose although it seems a little not decent.

Thanks and Regards,
Jeff

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

12

Hi All,

Actually this message is related to another thread “How to add kbfiltr above kbclass using INF file?” in this ntdev list.

I have tried the way mentioned as modifying the INF “HKLM,System\Class{4D36E96B-E325-11CE-BFC1-08002BE10318},UpperFilters,0x00010 008,kbfiltr”

the current problem it that I got “kbdclass kbfiltr” while what I wanted is “kbfiltr kbdclass”.

Any suggestions how to fix this?

Thanks and Regards,
Jeff

13

Regarding the INF file configuration, I don’t have a suggestion. The way I
do, which is the same way Ctrl2Cap from Sysinternals do, is just write
directly to the register through a small executable installer, to install a
class filter you don’t need much but just writing this to the register, and
the driver installation key.

2012/2/22

> Hi All,
>
> Actually this message is related to another thread “How to add kbfiltr
> above kbclass using INF file?” in this ntdev list.
>
> I have tried the way mentioned as modifying the INF
> “HKLM,System\Class{4D36E96B-E325-11CE-BFC1-08002BE10318},UpperFilters,0x00010
> 008,kbfiltr”
>
> the current problem it that I got “kbdclass kbfiltr” while what I wanted
> is “kbfiltr kbdclass”.
>
> Any suggestions how to fix this?
>
> Thanks and Regards,
> Jeff
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

14

You can’t prepend to a multi sz in an inf. You need code to do this

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 2/21/2012 7:24 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] kbd filter driver as a class filter driver

Hi All,

Actually this message is related to another thread “How to add kbfiltr above kbclass using INF file?” in this ntdev list.

I have tried the way mentioned as modifying the INF “HKLM,System\Class{4D36E96B-E325-11CE-BFC1-08002BE10318},UpperFilters,0x00010 008,kbfiltr”

the current problem it that I got “kbdclass kbfiltr” while what I wanted is “kbfiltr kbdclass”.

Any suggestions how to fix this?

Thanks and Regards,
Jeff

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer