Hello,
I am relatively new to driver development and I am trying to write a
keyboard filter driver that filters out certain keystrokes. Before I
invest all my time into starting the implementation, I’d like to make
sure I implement the right type of driver.
From my research, it looks like I need a “keyboard class filter
driver”. Is this correct? This will allow me to filter ps2, usb, etc.
type keyboards correct? Also, I’d like to have it work with Windows
XP and Windows 7. Is there anything else I should know before I start
this implementation? The implementation should be very simple really.
The functionality I am trying to implement is as such; When my
application is active, I’d like to *disable* certain keys +
keystrokes, and when application is not running, I’d like all the keys
pass through.
Thanks,
J
Yes, you want a keyboard class filter driver. You want to start with the kb= dfiltr example in the wdk. It can work as a device or class upper filter. K= nowing that your application is running can be done by the app opening up t= he raw PDO that the sample demonstrates how to create. You do have to thin= k about per session semantics though, what if 2 users are logged in at the = same time? Do you need to track active sessions?
d
Thanks Doron, for the help. I’ve installed the DDK and I’ve located
the driver. However, it is called “kbdclass” in the most recent DDK
(7.1.0). Do you know where the .inf file though is? In the .htm file
provided in the directory, it doesn’t describe how to install it as
well.
Thanks,
J
On Thu, Dec 30, 2010 at 6:04 PM, wrote:
> Yes, you want a keyboard class filter driver. You want to start with the kb= dfiltr example in the wdk. It can work as a device or class upper filter. K= nowing that your application is running can be done by the app opening up t= he raw PDO that the sample demonstrates how to create. ?You do have to thin= k about per session semantics though, what if 2 users are logged in at the = same time? Do you need to track active sessions?
>
> d
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
no, kbdclass is an in box driver that is the class filter for keyboards. you want to install your class filter *below* kbdclass in the stack (ie, your service name should appear before kbdclass in the multi sz reg value). class filters are not installed via inf since there is no specific hw id to install on. kbdfiltr can be found in WinDDK\7600.16385.1\src\input\kbfiltr
d
> From my research, it looks like I need a "keyboard class filter
driver". Is this correct? This will allow me to filter ps2, usb, etc.
type keyboards correct?
Yes and yes.
Also, I’d like to have it work with Windows
XP and Windows 7. Is there anything else I should know before I start
this implementation?
On Vista+ such a driver must be a KMDF one to be WHQLed.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
Thanks all for the feedback. Just a few more questions 
-
What’s the best way to install kbfiltr? I used the installer from
here: http://www.osronline.com/article.cfm?name=wdffltr_v10.zip&id=446
and just added my filter driver as an upper filter driver by
modifying
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters
and adding my filter driver before “kbdclass”. Will this work or is
there a simpler approach.
-
Looking at KbFilter_ServiceCallback, it doesn’t seem like I can get
the process ID that sent down the packet. I only have the
DEVICE_OBJECT and a couple KEYBOARD_INPUT_DATA structs. Any
suggestions?
-
For most of the basic buttons such as “print screen”, “left shift”,
“right shift”, etc, are the keyboard scan codes going to be the same?
Thanks,
J
On Sun, Jan 2, 2011 at 3:07 AM, Maxim S. Shatskih
wrote:
>> From my research, it looks like I need a “keyboard class filter
>> driver”. ?Is this correct? This will allow me to filter ps2, usb, etc.
>> type keyboards correct?
>
> Yes and yes.
>
>>Also, I’d like to have it work with Windows
>> XP and Windows 7. ?Is there anything else I should know before I start
>> this implementation?
>
> On Vista+ such a driver must be a KMDF one to be WHQLed.
>
> –
> Maxim S. Shatskih
> Windows DDK MVP
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
Jonathon wrote:
- What’s the best way to install kbfiltr? I used the installer from
here: http://www.osronline.com/article.cfm?name=wdffltr_v10.zip&id=446
and just added my filter driver as an upper filter driver by modifying
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters
and adding my filter driver before “kbdclass”. Will this work or is
there a simpler approach.
How could it possibly be any simpler than that? Class filters are among
the easiest PnP drivers to install.
By the way, don’t EVER modify the numbered control sets, like
ControlSet001. Always modify CurrentControlSet. The control set
numbers change if you use “last known good” at boot time.
CurrentControlSet is a link to the “live” one.
- Looking at KbFilter_ServiceCallback, it doesn’t seem like I can get
the process ID that sent down the packet. I only have the
DEVICE_OBJECT and a couple KEYBOARD_INPUT_DATA structs. Any
suggestions?
What packet are you talking about? KbFilter_ServiceCallback is called
in the keyboard’s interrupt service routine when a keystroke arrives.
It comes from below, not from above.
- For most of the basic buttons such as “print screen”, “left shift”,
“right shift”, etc, are the keyboard scan codes going to be the same?
The same as what?
–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.
Thanks Tim for the quick reply.
On Tue, Jan 4, 2011 at 10:23 AM, Tim Roberts wrote:
> Jonathon wrote:
>> 1) What’s the best way to install kbfiltr? ?I used the installer from
>> here: http://www.osronline.com/article.cfm?name=wdffltr_v10.zip&id=446
>> ?and just added my filter driver as an upper filter driver by modifying
>> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters
>> and adding my filter driver before “kbdclass”. ?Will this work or is
>> there a simpler approach.
>
> How could it possibly be any simpler than that? ?Class filters are among
> the easiest PnP drivers to install.
>
> By the way, don’t EVER modify the numbered control sets, like
> ControlSet001. ?Always modify CurrentControlSet. ?The control set
> numbers change if you use “last known good” at boot time.
> CurrentControlSet is a link to the “live” one.
>
Thanks for the warning. I’ll keep my changes in CurrentControlSet.
>
>> 2) Looking at KbFilter_ServiceCallback, it doesn’t seem like I can get
>> the process ID that sent down the packet. ?I only have the
>> DEVICE_OBJECT and a couple KEYBOARD_INPUT_DATA structs. Any
>> suggestions?
>
> What packet are you talking about? ?KbFilter_ServiceCallback is called
> in the keyboard’s interrupt service routine when a keystroke arrives.
> It comes from below, not from above.
>
That makes sense. So if it comes from the ISR, I guess it is not
possible to determine which process the keyboard input is destined for
huh?
>
>> 3) For most of the basic buttons such as “print screen”, “left shift”,
>> “right shift”, etc, are the keyboard scan codes going to be the same?
>
> The same as what?
>
Sorry. I meant to say, are the scan codes going to be the same for
all other keyboards and keyboard types?
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
the input stacks have no idea which application will receive the input. that is determined by the raw input thread (the RIT), which is in win32k.sys. why do you care which process receives the input?
scan codes are constant across all keyboards. what changes is the mapping from scan code -> virtual (VK_Xxx in windows)
d
>08002BE10318}\UpperFilters
and adding my filter driver before “kbdclass”. Will this work
Yes, after a stack restart, and stack restart for PS/2 requires a reboot.
the process ID that sent down the packet.
You cannot. There is no such things as “process IDs” there, all IRPs are sent by win32k RawInputThread, which belongs to System process.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
>possible to determine which process the keyboard input is destined
Surely no.
To do this, you will need to use USER32 APIs on installing keyboard message hooks.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com