Hi.
I want to write program that will block all keyboard buttons including ctrl+alt+delete.
In ring 3 level I only found that I can disable ctrl+alt+delete buttons through injecting the dll with hook to ‘WINLOGON’ process and it doesn’t work in Windows Vista.
I have found somewhere this info - “WHen you press these 3 keys, they create a special electrical circuit that generates what is called an interrupt. THis is a signal to the CPU that something wants attention. The windows kernel drivers intercept this interrupt and go through the motions of whatever chunk of code is run, that shows the ctrl+alt+del screen. It cannot be replicated in software without writing your own kernel level keyboard driver or something.”
So as I have understood I need to write a driver. I started to look in the way of src\input\kbfiltr but I don’t know if it’s right way? I read that this driver designed to filter a PS/2 keyboard, but what about usb keyboard. How I can write universal driver for all types of keyboards?
Could someone can tell something about this situation?
Kbfiltr (you should use the KMDF version in the 600 WDK, not the WDM version from previous DDKs) can filter any keyboard type. It has some specific PS2 logic in it, but that does not get turned on unless you are connected to a ps2 keyboard.
The special electrical circuit quote is just a hw interrupt. A ps2 keyboard generates a hw interrupt everytime you press and release a key. Winlogon has no idea about the hw though. C+A+D (or the security attention sequence (SAS)) is processed as keystrokes. This is why pressing the SAS on a usb keyboard (which does not have its own interrupt) works just like a ps2 keyboard ;). Since it is processed as keystrokes, you can remove them in your filter driver and prevent the SAS from occurring.
BUT, why would you want to do this? There are probably other solutions (like group policy, kiosk mode) that will do what you want.
d
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, November 07, 2007 9:14 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Keyboard filter and Ctrl+Alt+delete
Hi.
I want to write program that will block all keyboard buttons including ctrl+alt+delete.
In ring 3 level I only found that I can disable ctrl+alt+delete buttons through injecting the dll with hook to ‘WINLOGON’ process and it doesn’t work in Windows Vista.
I have found somewhere this info - “WHen you press these 3 keys, they create a special electrical circuit that generates what is called an interrupt. THis is a signal to the CPU that something wants attention. The windows kernel drivers intercept this interrupt and go through the motions of whatever chunk of code is run, that shows the ctrl+alt+del screen. It cannot be replicated in software without writing your own kernel level keyboard driver or something.”
So as I have understood I need to write a driver. I started to look in the way of src\input\kbfiltr but I don’t know if it’s right way? I read that this driver designed to filter a PS/2 keyboard, but what about usb keyboard. How I can write universal driver for all types of keyboards?
Could someone can tell something about this situation?
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
I want to disable (or enable) all buttons only for some time (real-time).
If I use group policy this will only enables after restart (or logoff).
As I have understood this driver won’t work if computer has only usb keyboard connected, this is bad for me.
Could anyone can say any different way?
The kbfiltr example is exacly what you need. Use the kdmf filter example (it is a lot sinpler). I got it to work in Vista no problems and I have a USB Keyboard. This is because I installed it as an upper level filter driver (above the functional driver) where it filters inputs for all keyboards regardless of type.
The Example actually tells you what PS2 specific stuff to remove for an upper level filter driver (2 functions and one switch condition).
You then write your filtering code in the KbFilter_ServiceCallback function. You need some global variables to track the state of the Ctrl, Alt and Del keys. There are examples around to show you how to do this (since I developed my code for my employers I can’t post it - sorry).
The Ctrl2Cap.c example (if you can find it somewhere) is a good place to start.
Thank you for information. I’ll try.
You misunderstood. The filter will work for any keyboard type, including usb hid
d
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, November 07, 2007 10:45 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Keyboard filter and Ctrl+Alt+delete
I want to disable (or enable) all buttons only for some time (real-time).
If I use group policy this will only enables after restart (or logoff).
As I have understood this driver won’t work if computer has only usb keyboard connected, this is bad for me.
Could anyone can say any different way?
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer