Mouse Filter Driver?

NTDEV
1

Hello everyone!

I’ve never written a driver yet, but I want to start with some (properly simple) project for my personal use. The Idea is to write a kind of driver which simulates Mouse-Movements from time to time (to avoid that the screensaver kicks in, also in RDP Sessions).

It’s very annoying in “RDP Hopping” Scenarios (Computer At Home -> My company dev machine -> Gateway server at some location -> Some Server) that you may need to enter different passwords so often. Reconfiguring the Screen-Saver on several machines is also not really an option.

So I thought that some kind of software which just makes the machine think the mouse has been moved would be a very handy tool. Ideally it should only kick in when the mouse has not been moved by the user for some time period. I thought that a kind of Mouse Filter would do the job. Basically I would update a timestamp when the user moves the mouse and register a periodic callback that checks if current time - recorded timestamp > threshold. If so, it shall generate a mouse-movement.

I would also like to implement a feature that allows the functionality to be enabled / disabled (maybe by using a kind of “tray icon app”). Can this be achieved just be starting / stopping the driver? Or do I need to implement custom DeviceIoControl commands?

So I have the following questions:

? What do you think about it? Would it be a project to start driver deployment?

? What shall I choose for the Development Environment (I would like to support WinXP and above)

? Are there any samples to start with?

? I would like to have a behavior similar to the sysinternal tools, which are started as a tool and that dynamically installs and starts the needed driver(s). How can this be achieved?

? For Vista64 and above: When I want to run this on another machine, does it need to be signed?

Thank you so far!

GP

2

Please see my response below

From: G?nter Prossliner
Sent: Monday, June 15, 2009 2:46 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Mouse Filter Driver?

Hello everyone!

I’ve never written a driver yet, but I want to start with some (properly simple) project for my personal use. The Idea is to write a kind of driver which simulates Mouse-Movements from time to time (to avoid that the screensaver kicks in, also in RDP Sessions).

It’s very annoying in “RDP Hopping” Scenarios (Computer At Home -> My company dev machine -> Gateway server at some location -> Some Server) that you may need to enter different passwords so often. Reconfiguring the Screen-Saver on several machines is also not really an option.

So I thought that some kind of software which just makes the machine think the mouse has been moved would be a very handy tool. Ideally it should only kick in when the mouse has not been moved by the user for some time period. I thought that a kind of Mouse Filter would do the job. Basically I would update a timestamp when the user moves the mouse and register a periodic callback that checks if current time - recorded timestamp > threshold. If so, it shall generate a mouse-movement.

I would also like to implement a feature that allows the functionality to be enabled / disabled (maybe by using a kind of “tray icon app”). Can this be achieved just be starting / stopping the driver? Or do I need to implement custom DeviceIoControl commands?

So I have the following questions:

? What do you think about it? Would it be a project to start driver deployment?

I don’t think you need a driver to simulate the mouse movements, standard win 32 API can do this for you.

? What shall I choose for the Development Environment (I would like to support WinXP and above)

? Are there any samples to start with?

? I would like to have a behavior similar to the sysinternal tools, which are started as a tool and that dynamically installs and starts the needed driver(s). How can this be achieved?

If I am right latest sys internals make use of event tracing for windows to monitor the events, they hardly use drivers.

? For Vista64 and above: When I want to run this on another machine, does it need to be signed?

Thank you so far!

GP

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

You can use SetThreadExecutionState (http://msdn.microsoft.com/en-us/library/aa373208.aspx ) to indicate that you are present, no driver is necessary. You cannot pull off what sysinternals does in terms of dynamically loading a driver, the mouse input stacks are pnp and there is no way for you to put yourself into the stack after it has started running (you could install yourself as a filter and then restart the stack, but that is probably not worth the pain).

d

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of G?nter Prossliner
Sent: Monday, June 15, 2009 2:16 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Mouse Filter Driver?

Hello everyone!

I’ve never written a driver yet, but I want to start with some (properly simple) project for my personal use. The Idea is to write a kind of driver which simulates Mouse-Movements from time to time (to avoid that the screensaver kicks in, also in RDP Sessions).

It’s very annoying in “RDP Hopping” Scenarios (Computer At Home -> My company dev machine -> Gateway server at some location -> Some Server) that you may need to enter different passwords so often. Reconfiguring the Screen-Saver on several machines is also not really an option.

So I thought that some kind of software which just makes the machine think the mouse has been moved would be a very handy tool. Ideally it should only kick in when the mouse has not been moved by the user for some time period. I thought that a kind of Mouse Filter would do the job. Basically I would update a timestamp when the user moves the mouse and register a periodic callback that checks if current time - recorded timestamp > threshold. If so, it shall generate a mouse-movement.

I would also like to implement a feature that allows the functionality to be enabled / disabled (maybe by using a kind of “tray icon app”). Can this be achieved just be starting / stopping the driver? Or do I need to implement custom DeviceIoControl commands?

So I have the following questions:

? What do you think about it? Would it be a project to start driver deployment?

? What shall I choose for the Development Environment (I would like to support WinXP and above)

? Are there any samples to start with?

? I would like to have a behavior similar to the sysinternal tools, which are started as a tool and that dynamically installs and starts the needed driver(s). How can this be achieved?

? For Vista64 and above: When I want to run this on another machine, does it need to be signed?

Thank you so far!

GP

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

Doron,

The docum explicitly states that SetThreadExecutionState cannot stop
screen saver from executing:
http://msdn.microsoft.com/en-us/library/aa373208.aspx
so simulation of user input is probably required.

( I’ve recenlty answered same Q in other NG and found this note to my
surprise…)

Regards,
– pa

“Doron Holan” wrote in message
news:xxxxx@ntdev…
> You can use SetThreadExecutionState
> (http://msdn.microsoft.com/en-us/library/aa373208.aspx ) to indicate that
> you are present, no driver is necessary. You cannot pull off what
> sysinternals does in terms of dynamically loading a driver, the mouse
> input stacks are pnp and there is no way for you to put yourself into the
> stack after it has started running (you could install yourself as a filter
> and then restart the stack, but that is probably not worth the pain).
>
> d
>
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Günter Prossliner
> Sent: Monday, June 15, 2009 2:16 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Mouse Filter Driver?
>
> Hello everyone!
>
> I’ve never written a driver yet, but I want to start with some (properly
> simple) project for my personal use. The Idea is to write a kind of driver
> which simulates Mouse-Movements from time to time (to avoid that the
> screensaver kicks in, also in RDP Sessions).
>
> It’s very annoying in “RDP Hopping” Scenarios (Computer At Home -> My
> company dev machine -> Gateway server at some location -> Some Server)
> that you may need to enter different passwords so often. Reconfiguring the
> Screen-Saver on several machines is also not really an option.
>
> So I thought that some kind of software which just makes the machine think
> the mouse has been moved would be a very handy tool. Ideally it should
> only kick in when the mouse has not been moved by the user for some time
> period. I thought that a kind of Mouse Filter would do the job. Basically
> I would update a timestamp when the user moves the mouse and register a
> periodic callback that checks if current time - recorded timestamp >
> threshold. If so, it shall generate a mouse-movement.
>
> I would also like to implement a feature that allows the functionality to
> be enabled / disabled (maybe by using a kind of “tray icon app”). Can this
> be achieved just be starting / stopping the driver? Or do I need to
> implement custom DeviceIoControl commands?
>
> So I have the following questions:
>
>
> · What do you think about it? Would it be a project to start
> driver deployment?
>
> · What shall I choose for the Development Environment (I would
> like to support WinXP and above)
>
> · Are there any samples to start with?
>
> · I would like to have a behavior similar to the sysinternal
> tools, which are started as a tool and that dynamically installs and
> starts the needed driver(s). How can this be achieved?
>
> · For Vista64 and above: When I want to run this on another
> machine, does it need to be signed?
>
> Thank you so far!
>
> GP
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

5

Hello!

Thank you all for your responses.

@All: I’ll try SetThreadExecutionState, but the tests I’ve made so far with the Win API never did the trick regarding to RDP Sessions. Anyway, I would also like to implement a tiny driver just for learning / fun, and I thought that this may be a good project to start. Don’t you think?

@Doron: So I cannot start a Filter-Driver on the running stack. Ok … I’ve not known this. But it would be possible to install my filter and implement the enable / disable functionality by an custom IOCP?

@Pavel: Which NG? Are there any more hints?

Can someone tell we how to start?

Thank you!
GP

6

G?nter Prossliner wrote:

@Pavel: Which NG? Are there any more hints?

IIRC, m.p.w.programmer.kernel ;
The question was how to prevent screen saver while running XP Media Center;
and IIRC there was nothing more useful for this issue.

If there is no other way besides simulation of user input
or temporary disabling screen saver, then IMHO yes
this may be an interesting project.

Regards,
– pa

7

>“Günter Prossliner” wrote in message
>news:xxxxx@ntdev…>
>@All: I’ll try SetThreadExecutionState, but the tests I’ve made so far with
>the Win API never did the trick regarding to RDP Sessions. Anyway, I >would
>also like to implement a tiny driver just for learning / fun, and I thought
>that this may be a good project to start. Don’t you think?

You can get this done with SetWindowsHookEx but you need to call this
separately for every desktop, for instance at logon.

//Daniel

8

Hello once again,

thank to everyone for the great help! I still have some additional questions:

@Daniel: Could you please elaborate which hook to setup, also for RDP Client Windows.

@All: After searching though the archives (for this and the MS driver & kernel groups), I’ve found more information on the topic:

[microsoft.public.development.device.drivers: Re: Install moufiltr on HID class driver]
http://www.tech-archive.net/Archive/Development/microsoft.public.development.device.drivers/2005-03/0973.html

It seem like a MOUCLASS lower filter would be fine, because it can handle USB and other mice. Is this correct?

I wanted to validate the .inf posted here, but … all me a dump if you like … I cannot find the checkinf tool in DDK (18002) directories. Is this a separate download?

Should I use kmdf for this? Would be the toaster sample (filter) a starting point? The “firefly” sample also seems to be interesting. What can you recommend?

Can you recommend any book which covers the driver development basics or maybe one which describes HID filter drivers?

@Doron: By browsing the archives it seems that you are very skilled in this area, maybe you can point me so samples and / or articles covering the topic? BTW: you have the same firstname like my little son (3 years old)!

Thank anybody here!
GP

9

“Günter Prossliner” wrote in message
news:xxxxx@ntdev…
@Daniel: Could you please elaborate which hook to setup, also for RDP Client
Windows.

I read your message better and am actually not sure this is going to work as
the system may detect that created events are injected. In any case this
does not seem like a good project to learn about developing drivers and you
are likely to receive better responses in the usermode newsgroups.

//Daniel

10

Plus there’s the 32-bit/64-bit problem; different DLLs required for different bitnesses.

But I don’t see what he’d need to hook at all here. If he wants to stop RDP sessions from timing out for screensaver, he could probably try something (slightly) less sleazy and just fake mouse move messages to the mstsc windows client-side and be done with it.

  • S

-----Original Message-----
From: xxxxx@resplendence.com
Sent: Tuesday, June 16, 2009 02:57
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Mouse Filter Driver?

>“G?nter Prossliner” wrote in message
>news:xxxxx@ntdev…>
>@All: I’ll try SetThreadExecutionState, but the tests I’ve made so far with
>the Win API never did the trick regarding to RDP Sessions. Anyway, I >would
>also like to implement a tiny driver just for learning / fun, and I thought
>that this may be a good project to start. Don’t you think?

You can get this done with SetWindowsHookEx but you need to call this
separately for every desktop, for instance at logon.

//Daniel

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

11

I haven’t tried this in a while, but I’m pretty sure you can prevent
screensavers and auto-sleeps by periodically calling mouse_event (or
better, SendInput) with a 0’d mouse packet. This doesn’t interfere with
normal mouse operation, so it would be harmless to do it “all the time”
(hopefully only every minute or so :-), whether the mouse was being used
or not.

But yes, a mouse filter is a fine first driver to write if you are just
trying to get experience. The moufiltr sample in the WDK is a great
place to start. Last I looked, there were both WDM and KMDF samples for
that.

Günter Prossliner wrote:

Hello everyone!

I’ve never written a driver yet, but I want to start with some (properly
simple) project for my personal use. The Idea is to write a kind of
driver which simulates Mouse-Movements from time to time (to avoid that
the screensaver kicks in, also in RDP Sessions).

It’s very annoying in “RDP Hopping” Scenarios (Computer At Home -> My
company dev machine -> Gateway server at some location -> Some Server)
that you may need to enter different passwords so often. Reconfiguring
the Screen-Saver on several machines is also not really an option.

So I thought that some kind of software which just makes the machine
think the mouse has been moved would be a very handy tool. Ideally it
should only kick in when the mouse has not been moved by the user for
some time period. I thought that a kind of Mouse Filter would do the
job. Basically I would update a timestamp when the user moves the mouse
and register a periodic callback that checks if current time – recorded
timestamp > threshold. If so, it shall generate a mouse-movement.

I would also like to implement a feature that allows the functionality
to be enabled / disabled (maybe by using a kind of “tray icon app”). Can
this be achieved just be starting / stopping the driver? Or do I need to
implement custom DeviceIoControl commands?

So I have the following questions:

· What do you think about it? Would it be a project to start
driver deployment?

· What shall I choose for the Development Environment (I would
like to support WinXP and above)

· Are there any samples to start with?

· I would like to have a behavior similar to the sysinternal
tools, which are started as a tool and that dynamically installs and
starts the needed driver(s). How can this be achieved?

· For Vista64 and above: When I want to run this on another
machine, does it need to be signed?

Thank you so far!

GP

–
Ray
(If you want to reply to me off list, please remove “spamblock.” from my
email address)

12

Hello Ray!

Thank you very much for participating in this Thread.

I’ll try SendInput for my scenario. I also will take a look at the moufiltr sample. I’ve seen the WDM Version (src\input\moufiltr), but in the kmdf directory I can’t find it (although there is a kbfiltr sample).

I’ll check them out.

Thank you very much!

GP

13

The kmdf version of moufiltr is in the win7 wdk

d

Sent from my phone with no t9, all spilling mistakes are not intentional.

From: G?nter Prossliner
Sent: Tuesday, June 23, 2009 9:11 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Mouse Filter Driver?

Hello Ray!

Thank you very much for participating in this Thread.

I?ll try SendInput for my scenario. I also will take a look at the moufiltr sample. I?ve seen the WDM Version (src\input\moufiltr), but in the kmdf directory I can?t find it (although there is a kbfiltr sample).

I?ll check them out.

Thank you very much!

GP

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

14

Hello once again,

I’ve checked moufltr (WDM Version). It looks like there are only PS2 Mice supported. Because most mice are USB mice nowadays I don’t think it makes sense to support just PS/2.

Am I missing something? Will the KMDF moufltr support USB mice?

When I tried the moufltr sample on a Microsoft Virtual PC WinXP SP2 instance, mouse moves are ok, but I’m not able to perform a click. Is it possible that the moufltr is incompatible with the VPC included driver (which is a “VM Additions PS/2 Port Mouse”)?

thanks!
GP

15

Hello,

Moufiltr can certainly support USB/HID mouses once you have adjusted the
accompanying INF file. I would firstly remove all the PS/2-specific code
(IOCTL_INTERNAL_I8042_HOOK_MOUSE, MouFilter_IsrHook) because all that
really matters is the MouFilter_ServiceCallback/MouseClassServiceCallback
routine, and then set the hw-id in the INF file’s Models section to
HID_DEVICE_SYSTEM_MOUSE.

  • Cay

On Wed, 24 Jun 2009 12:02:35 +0200, Günter Prossliner
wrote:
> Hello once again,
>
> I’ve checked moufltr (WDM Version). It looks like there are only PS2
> Mice supported. Because most mice are USB mice nowadays I don’t think it
> makes sense to support just PS/2.
>
> Am I missing something? Will the KMDF moufltr support USB mice?
>
> When I tried the moufltr sample on a Microsoft Virtual PC WinXP SP2
> instance, mouse moves are ok, but I’m not able to perform a click. Is it
> possible that the moufltr is incompatible with the VPC included driver
> (which is a “VM Additions PS/2 Port Mouse”)?
>
> thanks!
> GP

16

And replace every occurrence of “PS2_Inst” with “HID_Mouse_Inst”.

  • Cay

On Wed, 24 Jun 2009 12:28:24 +0200, Cay Bremer wrote:
> Hello,
>
> Moufiltr can certainly support USB/HID mouses once you have adjusted the
> accompanying INF file. I would firstly remove all the PS/2-specific code
> (IOCTL_INTERNAL_I8042_HOOK_MOUSE, MouFilter_IsrHook) because all that
> really matters is the
> MouFilter_ServiceCallback/MouseClassServiceCallback routine, and then
> set the hw-id in the INF file’s Models section to
> HID_DEVICE_SYSTEM_MOUSE.
>
>
> - Cay
>
>
> On Wed, 24 Jun 2009 12:02:35 +0200, Günter Prossliner
> wrote:
>> Hello once again,
>>
>> I’ve checked moufltr (WDM Version). It looks like there are only PS2
>> Mice supported. Because most mice are USB mice nowadays I don’t think
>> it makes sense to support just PS/2.
>>
>> Am I missing something? Will the KMDF moufltr support USB mice?
>>
>> When I tried the moufltr sample on a Microsoft Virtual PC WinXP SP2
>> instance, mouse moves are ok, but I’m not able to perform a click. Is
>> it possible that the moufltr is incompatible with the VPC included
>> driver (which is a “VM Additions PS/2 Port Mouse”)?
>>
>> thanks!
>> GP
>

17

Doron Holan wrote:

You cannot pull off what sysinternals does in terms of
dynamically loading a driver, the mouse input stacks
are pnp and there is no way for you to put yourself
into the stack after it has started running (you could
install yourself as a filter and then restart the stack,
but that is probably not worth the pain).

Speaking of SysInternals, I think PortMon does exactly what you are saying cannot be done (attaches to a live stack, without restarting it, and begins watching I/O).

18

>Speaking of SysInternals, I think PortMon does exactly what you are saying

cannot be done (attaches to a live stack, without restarting >it, and
begins watching I/O).

Well, it depends on the stack and where you want to filter.

When an application opens a named device (e.g. \Device\Serial0), it receives
back a handle to a file object that points to the named device. When the
user submits an I/O against that handle, the I/O manager converts the handle
back into the file object, retrieves the device object, and then calls
IoGetRelatedDeviceObject to get the target device object. Assuming no odd
edge cases (VPBs, targeted creates, etc), the device object returned will be
the device at the top of the device stack. The I/O request is then submitted
to the top of the device stack.

Thus, if you want to filter at the top of a device stack you can dynamically
attach and start to see I/O requests. I’ve never used PortMon, but I’m
assuming that this is why it works without a reboot.

However, say you have an existing stack with three attached devices A->B->C
and you want to insert a filter between A->B. There is no architecturally
defined way to dynamically insert that filter, you must tear down the stack
and rebuild it with your filter inserted.

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

wrote in message news:xxxxx@ntdev…
> Doron Holan wrote:
>
>> You cannot pull off what sysinternals does in terms of
>> dynamically loading a driver, the mouse input stacks
>> are pnp and there is no way for you to put yourself
>> into the stack after it has started running (you could
>> install yourself as a filter and then restart the stack,
>> but that is probably not worth the pain).
>
> Speaking of SysInternals, I think PortMon does exactly what you are saying
> cannot be done (attaches to a live stack, without restarting it, and
> begins watching I/O).
>

19

Yes, it does do that, but that is not something that we can readily endorse as a company and there are caveats to what they are doing. Furthermore, the input stacks negotiate function pointers at init, you won’t see that by attaching later

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, June 24, 2009 12:02 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Mouse Filter Driver?

Doron Holan wrote:

You cannot pull off what sysinternals does in terms of dynamically
loading a driver, the mouse input stacks are pnp and there is no way
for you to put yourself into the stack after it has started running
(you could install yourself as a filter and then restart the stack,
but that is probably not worth the pain).

Speaking of SysInternals, I think PortMon does exactly what you are saying cannot be done (attaches to a live stack, without restarting it, and begins watching I/O).

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

20

Doron Holan wrote:

Yes, it does do that, but that is not something that we can readily endorse as a company…

The delicious irony in that, of course, is that SysInternals now IS
Microsoft…

:wink:

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.