-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
in my kbd filter (kbdclass upper filter) i’d need to get the current process
name in which context the keystroke had happened. Is there a way to do that
?
I know that the IRP_MJ_READ is originated in the RIT, which belongs to
csrss.exe (infact, trying to get the active process name looking at the
process offset in PEB , i always ends up to that). Any help would be greatly
appreciated, even a simple “it’s not possible” would be ok and will save me
lot of time 
Thanx,
Valerio
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQA/AwUBQBHw8GGxr2U3nc5EEQK73ACeKdSvhje3kUnvaiFUwKtZmc5OhbwAn1Y8
8wayRCvs5cRWy+g14fBbuMIM
=G4MR
-----END PGP SIGNATURE-----
> in my kbd filter (kbdclass upper filter) i’d need to get the current process
name in which context the keystroke had happened. Is there a way to do that
It is impossible, and just because the multitasking nature of Windows the
kbd scancode delivery occurs from the DPC fired by i8042prt, it can interrupt
absolutely ANY process - from Explorer to LSASS or IIS.
The solution on “to what process this keypress is intended?” is done by far
higher, in USER server code in win32k - around GetMessage implementation. It
puts a message to a queue from where GetMessage will take it.
So, use USER (window manager) hooks to solve your task, do not touch the kernel
kbd stack.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
It’s not possible. What are you trying to do?
D
This posting is provided “AS IS” with no warranties, and confers no
rights.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Valerino
Sent: Friday, January 23, 2004 8:14 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Question about getting current process name in keyboard
filter
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
in my kbd filter (kbdclass upper filter) i’d need to get the current
process
name in which context the keystroke had happened. Is there a way to do
that
?
I know that the IRP_MJ_READ is originated in the RIT, which belongs to
csrss.exe (infact, trying to get the active process name looking at the
process offset in PEB , i always ends up to that). Any help would be
greatly
appreciated, even a simple “it’s not possible” would be ok and will save
me
lot of time
Thanx,
Valerio
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQA/AwUBQBHw8GGxr2U3nc5EEQK73ACeKdSvhje3kUnvaiFUwKtZmc5OhbwAn1Y8
8wayRCvs5cRWy+g14fBbuMIM
=G4MR
-----END PGP SIGNATURE-----
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com