USB HID upper filter driver

NTDEV
1

Hi,
I have written a USB HID upper filter driver and able to see my normal keyboard input report. But I am unable to see the vendor specific input reports on KbFilter_ServiceCallback() callback. The bellow is my vendor specific HID descriptor

0x06, 0x00, 0xFF, /* USAGE_PAGE(Vendor Defined) */
0x09, 0x01, /* USAGE(vendor defined) */
0xA1, 0x01, /* COLLECTION (Application) */
0x85, 0x06, /* REPORT_ID (6) */
0x15, 0x00, /* LOGICAL_MINIMUM */
0x25, 0x01, /* LOGICAL_MAXIMUM */
0x19, 0x01, /* USAGE_MINIMUM */
0x29, 0x02, /* USAGE_MAXIMUM */
0x75, 0x01, /* REPORT_SIZE (1) */
0x95, 0x02, /* REPORT_COUNT (2) */
0x81, 0x06, /* INPUT (Data,Var,Rel) */
0x75, 0x06, /* REPORT_SIZE (6) */
0x95, 0x01, /* REPORT_COUNT (1) */
0x81, 0x03, /* INPUT (Cnst,Var,Abs) */
0xC0 /* End Collection */

Is it feasible to trace Vendor specific report in upper filter driver.
Thanks,
Skdeak

2

The vendor Usage page is in a different top level collection than the keyboard. so a keyboard filter will not see it.

Sent from my Windows 10 phone

From: xxxxx@gmail.commailto:xxxxx
Sent: Friday, June 10, 2016 1:34 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] USB HID upper filter driver

Hi,
I have written a USB HID upper filter driver and able to see my normal keyboard input report. But I am unable to see the vendor specific input reports on KbFilter_ServiceCallback() callback. The bellow is my vendor specific HID descriptor

0x06, 0x00, 0xFF, /* USAGE_PAGE(Vendor Defined) /
0x09, 0x01, / USAGE(vendor defined) /
0xA1, 0x01, / COLLECTION (Application) /
0x85, 0x06, / REPORT_ID (6) /
0x15, 0x00, / LOGICAL_MINIMUM /
0x25, 0x01, / LOGICAL_MAXIMUM /
0x19, 0x01, / USAGE_MINIMUM /
0x29, 0x02, / USAGE_MAXIMUM /
0x75, 0x01, / REPORT_SIZE (1) /
0x95, 0x02, / REPORT_COUNT (2) /
0x81, 0x06, / INPUT (Data,Var,Rel) /
0x75, 0x06, / REPORT_SIZE (6) /
0x95, 0x01, / REPORT_COUNT (1) /
0x81, 0x03, / INPUT (Cnst,Var,Abs) /
0xC0 / End Collection */

Is it feasible to trace Vendor specific report in upper filter driver.
Thanks,
Skdeak

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:></mailto:xxxxx></mailto:xxxxx>

3

Thanks Doron
I am new to USB hid so not being able identify the problem. Could you
please specify what would be proper usage page for vendor define usage page.

skdeka
On Jun 10, 2016 7:00 PM, “Doron Holan” wrote:

> The vendor Usage page is in a different top level collection than the
> keyboard. so a keyboard filter will not see it.
>
>
>
> Sent from my Windows 10 phone
>
>
>
> *From: *xxxxx@gmail.com
> *Sent: *Friday, June 10, 2016 1:34 AM
> *To: *Windows System Software Devs Interest List
> *Subject: [ntdev] USB HID upper filter driver
>
>
> Hi,
> I have written a USB HID upper filter driver and able to see my normal
> keyboard input report. But I am unable to see the vendor specific input
> reports on KbFilter_ServiceCallback() callback. The bellow is my vendor
> specific HID descriptor
>
> 0x06, 0x00, 0xFF, / USAGE_PAGE(Vendor
> Defined) /
> 0x09, 0x01, / USAGE(vendor
> defined) /
> 0xA1, 0x01, / COLLECTION
> (Application) /
> 0x85, 0x06, / REPORT_ID (6) /
> 0x15, 0x00, / LOGICAL_MINIMUM /
> 0x25, 0x01, / LOGICAL_MAXIMUM /
> 0x19, 0x01, / USAGE_MINIMUM /
> 0x29, 0x02, / USAGE_MAXIMUM /
> 0x75, 0x01, / REPORT_SIZE (1) /
> 0x95, 0x02, / REPORT_COUNT (2) /
> 0x81, 0x06, / INPUT (Data,Var,Rel)
> /
> 0x75, 0x06, / REPORT_SIZE (6) /
> 0x95, 0x01, / REPORT_COUNT (1) /
> 0x81, 0x03, / INPUT (Cnst,Var,Abs)
> /
> 0xC0 / End Collection */
>
> Is it feasible to trace Vendor specific report in upper filter driver.
> Thanks,
> Skdeak
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

4

Is that your entire hid descriptor? Doesn’t look like there is a keyboard there. Regardless, when you say KbdFitlr_ServiceCallback, you have a keyboard filter, not a HID filter. A keyboard filter (kbdfiltr) can filter any type of keyboard (HID, ps2, etc). if you want to filter the collection with the vendor usage, you need to write a filter that sits on top of the HID PDO for that collection.

What bigger problem are you trying to solve?

From: sushil [mailto:xxxxx@gmail.com]
Sent: Friday, June 10, 2016 8:14 AM
To: Doron Holan
Cc: Windows System Software Devs Interest List
Subject: RE: [ntdev] USB HID upper filter driver

Thanks Doron
I am new to USB hid so not being able identify the problem. Could you please specify what would be proper usage page for vendor define usage page.

skdeka
On Jun 10, 2016 7:00 PM, “Doron Holan” > wrote:

The vendor Usage page is in a different top level collection than the keyboard. so a keyboard filter will not see it.

Sent from my Windows 10 phone

From: xxxxx@gmail.commailto:xxxxx
Sent: Friday, June 10, 2016 1:34 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] USB HID upper filter driver

Hi,
I have written a USB HID upper filter driver and able to see my normal keyboard input report. But I am unable to see the vendor specific input reports on KbFilter_ServiceCallback() callback. The bellow is my vendor specific HID descriptor

0x06, 0x00, 0xFF, /* USAGE_PAGE(Vendor Defined) /
0x09, 0x01, / USAGE(vendor defined) /
0xA1, 0x01, / COLLECTION (Application) /
0x85, 0x06, / REPORT_ID (6) /
0x15, 0x00, / LOGICAL_MINIMUM /
0x25, 0x01, / LOGICAL_MAXIMUM /
0x19, 0x01, / USAGE_MINIMUM /
0x29, 0x02, / USAGE_MAXIMUM /
0x75, 0x01, / REPORT_SIZE (1) /
0x95, 0x02, / REPORT_COUNT (2) /
0x81, 0x06, / INPUT (Data,Var,Rel) /
0x75, 0x06, / REPORT_SIZE (6) /
0x95, 0x01, / REPORT_COUNT (1) /
0x81, 0x03, / INPUT (Cnst,Var,Abs) /
0xC0 / End Collection */

Is it feasible to trace Vendor specific report in upper filter driver.
Thanks,
Skdeak

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:></mailto:xxxxx></mailto:xxxxx>

5

sushil wrote:

I am new to USB hid so not being able identify the problem. Could you
please specify what would be proper usage page for vendor define usage
page.

I think you misunderstand. What you showed us IS a vendor usage page.
It’s perfectly valid, but it’s not a keyboard.

In a HID device, each of the usage pages becomes a top-level
collection. Each type of top-level collection causes a new device to be
created. If you have a keyboard usage page, it will create a keyboard
device. If you have a mouse usage page, it will create a mouse device.
When you have a vendor page like this, it will create a vendor device.
All of the reports for that page are routed to the vendor device.

So, your keyboard filter will never see these reports, because the
reports won’t be sent through the keyboard device.

A vendor page doesn’t have a driver by default. You can use the
user-mode HID library to access the reports, if you want.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

6

Thanks Tim,
I got it now. To be more specific keyboard device wants to send some
special function key. which I can still define within the keyboard hid
descriptor not necessarily to be define as vendor define input report.
Regards,
Skdeka

skd
On Jun 10, 2016 11:59 PM, “Tim Roberts” wrote:

> sushil wrote:
> >
> > I am new to USB hid so not being able identify the problem. Could you
> > please specify what would be proper usage page for vendor define usage
> > page.
> >
>
> I think you misunderstand. What you showed us IS a vendor usage page.
> It’s perfectly valid, but it’s not a keyboard.
>
> In a HID device, each of the usage pages becomes a top-level
> collection. Each type of top-level collection causes a new device to be
> created. If you have a keyboard usage page, it will create a keyboard
> device. If you have a mouse usage page, it will create a mouse device.
> When you have a vendor page like this, it will create a vendor device.
> All of the reports for that page are routed to the vendor device.
>
> So, your keyboard filter will never see these reports, because the
> reports won’t be sent through the keyboard device.
>
> A vendor page doesn’t have a driver by default. You can use the
> user-mode HID library to access the reports, if you want.
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

7

You can’t do that. The hid keyboard mapper has a fixed mapping of usages to scan codes. Since this is a custom usage, it will get dropped and not called in kbdfiltr_servicecallback. You could filter BELOW kbdhid and process the URBs, parse it yourself and extract the data. But if you are going to do that, it is exactly the same driver as if you have the special key in a vendor input report.

What bigger problem are you trying to solve? You can read HID directly from user mode, so there is no need for a driver as far as you have described. Usually a driver of this type is written so that you can translate the custom HID usage into something else that will be consumed by an app or another driver. Without knowing what your goal is, it is hard to tell you if you are on the right path

d

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of sushil
Sent: Friday, June 10, 2016 12:06 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] USB HID upper filter driver

Thanks Tim,
I got it now. To be more specific keyboard device wants to send some special function key. which I can still define within the keyboard hid descriptor not necessarily to be define as vendor define input report.
Regards,
Skdeka

skd
On Jun 10, 2016 11:59 PM, “Tim Roberts” > wrote:
sushil wrote:
>
> I am new to USB hid so not being able identify the problem. Could you
> please specify what would be proper usage page for vendor define usage
> page.
>

I think you misunderstand. What you showed us IS a vendor usage page.
It’s perfectly valid, but it’s not a keyboard.

In a HID device, each of the usage pages becomes a top-level
collection. Each type of top-level collection causes a new device to be
created. If you have a keyboard usage page, it will create a keyboard
device. If you have a mouse usage page, it will create a mouse device.
When you have a vendor page like this, it will create a vendor device.
All of the reports for that page are routed to the vendor device.

So, your keyboard filter will never see these reports, because the
reports won’t be sent through the keyboard device.

A vendor page doesn’t have a driver by default. You can use the
user-mode HID library to access the reports, if you want.

–
Tim Roberts, xxxxx@probo.commailto:xxxxx
Providenza & Boekelheide, Inc.

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:
— NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at To unsubscribe, visit the List Server section of OSR Online at</http:></http:></http:></mailto:xxxxx>

8

Hi Doron,
Thanks Doron.
My requirement is sending some combination keys(Fn+F4) from the keyboard which is special functionality to be performed in the PC side. On the PC side we need to capture this input report and send it to a I2C controller driver. A output report has to be send it back to the Keyboard. I presume filter driver is best suited for me as we need to communicate with another driver.

9

If you can change the firmware so that the output report can be written to the custom vendor collection you do not need a filter for either the keyboard or vendor collection at all. Perhaps you have may need a driver to communicate with the i2c driver, but that is not clear if that is a requirement or not

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Sunday, June 12, 2016 10:24 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] USB HID upper filter driver

Hi Doron,
Thanks Doron.
My requirement is sending some combination keys(Fn+F4) from the keyboard which is special functionality to be performed in the PC side. On the PC side we need to capture this input report and send it to a I2C controller driver. A output report has to be send it back to the Keyboard. I presume filter driver is best suited for me as we need to communicate with another driver.

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>

10

Is it feasible to add a filter driver on HIDCLASS.SYS and trace the vendor specific reports over there?

11

Thanks Doron and Tim,
I have written an application to get the vendor specific data. I call HidD_GetInputReport() function API to get the input report. Is there a way to get the input report only when actual report is available. Some kind of asynchronous mechanism to get the input report?

12

Got it working with ReadFile and WriteFile.