WDF keyboard class filter driver

NTDEV
1

Hi All,

I’m writing a KMDF keyboard class filter driver to intercept the KEYBOARD_INPUT_DATA. I read the code in the WDK sample Kbfiltr and kbclass but now I have a little confusion regarding to them. The kbfiltr registers a callback function to hook into the report chain so it can get the KEYBOARD_INPUT_DATA in the callback function. However, the kbclass doesn’t seem like that which simply gets the KEYBOARD_INPUT_DATA from IRP_MJ_READ.

For my case, I should have my KMDF class upper filter driver handled the EvtIoRead and registers the completion routine where I should be able to intercept the KEYBOARD_INPUT_DATA. Do I understand it right?

Thanks,
Marshall

2

If you install your filter above kbdclass you will need handle read irps. If you are below, the service callback is how you see the keyboard data. I would go for the below the class driver approach

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 10/12/2011 2:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] WDF keyboard class filter driver

Hi All,

I’m writing a KMDF keyboard class filter driver to intercept the KEYBOARD_INPUT_DATA. I read the code in the WDK sample Kbfiltr and kbclass but now I have a little confusion regarding to them. The kbfiltr registers a callback function to hook into the report chain so it can get the KEYBOARD_INPUT_DATA in the callback function. However, the kbclass doesn’t seem like that which simply gets the KEYBOARD_INPUT_DATA from IRP_MJ_READ.

For my case, I should have my KMDF class upper filter driver handled the EvtIoRead and registers the completion routine where I should be able to intercept the KEYBOARD_INPUT_DATA. Do I understand it right?

Thanks,
Marshall

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Thanks, Doron.

I also noticed that the sample code of kbfiltr handles the PS/2 keyboard differently from USB HID keyboard. If I install the keyboard class filter as lower filter, do I need handle the PS/2 keyboard and the USB HID keyboard seperately?

Another issue about the reboot, is it always true to require reboot for class filter driver? Is there any way that I can avoid rebooting?

Thanks,
Marshall

4

If you are just handling input packets in the service callback, there is no need to differentiate between hid or ps2. Since you can’t disable keyboards, there is no way to restart them which means you need a reboot

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 10/12/2011 7:45 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] WDF keyboard class filter driver

Thanks, Doron.

I also noticed that the sample code of kbfiltr handles the PS/2 keyboard differently from USB HID keyboard. If I install the keyboard class filter as lower filter, do I need handle the PS/2 keyboard and the USB HID keyboard seperately?

Another issue about the reboot, is it always true to require reboot for class filter driver? Is there any way that I can avoid rebooting?

Thanks,
Marshall

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

If now I only need to handle USB HID keyboard, to avoid reboot, can I have one filter driver on top of usbccgf.sys to get the input packet?

If no, do you know anyway that satifies these two purposes:

  • handle the keyboard input packet.
  • avoid reboot after the driver’s installation and updating

Thanks again,
Marshall

6

Usbccgp is not guaranteed to be in the stack, but you still have the disable problem

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 10/12/2011 8:25 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] WDF keyboard class filter driver

If now I only need to handle USB HID keyboard, to avoid reboot, can I have one filter driver on top of usbccgf.sys to get the input packet?

If no, do you know anyway that satifies these two purposes:

  • handle the keyboard input packet.
  • avoid reboot after the driver’s installation and updating

Thanks again,
Marshall

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

7

xxxxx@hotmail.com wrote:

If now I only need to handle USB HID keyboard, to avoid reboot, can I have one filter driver on top of usbccgf.sys to get the input packet?

If no, do you know anyway that satifies these two purposes:

  • handle the keyboard input packet.
  • avoid reboot after the driver’s installation and updating

You should be able to avoid the reboot by unplugging and replugging the
device, or by using “devcon restart” to restart it. The device stack is
set at device start time, and cannot be changed thereafter.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

8

Hi Doron,

Regarding to install the keyboard class filter driver below the kbdclass, I tried to have an INF to install it. I got a sample from %WDK%\src\setup\infs\clasfilt and modified it according to my requirement. However, I found two issues:

  • The AddReg can only append my class filter to the kbdclass which means it’s always above the kbdclass not below it. It seems no way for the INF to insert my class filter ahead of the kbdclass.

  • The DefaultInstall doesn’t support CoInstallers so I can’t redistribute the WDF1.9 through the INF. Can I register the WDFCoinstaller as the class coinstallers.

Does the above mean that I will have to have an application installer to install the driver?

Thanks,
Marshall

Doron Holan
xxxxx@microsoft.com Join Date: 08 Sep 2005
Posts To This List: 6333

RE: WDF keyboard class filter driver

If you install your filter above kbdclass you will need handle read irps. If you
are below, the service callback is how you see the keyboard data. I would go for
the below the class driver approach

debt from my phone

9

Yes, you need to use an installer for class driver installation

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 10/13/2011 5:53 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] WDF keyboard class filter driver

Hi Doron,

Regarding to install the keyboard class filter driver below the kbdclass, I tried to have an INF to install it. I got a sample from %WDK%\src\setup\infs\clasfilt and modified it according to my requirement. However, I found two issues:

  • The AddReg can only append my class filter to the kbdclass which means it’s always above the kbdclass not below it. It seems no way for the INF to insert my class filter ahead of the kbdclass.

  • The DefaultInstall doesn’t support CoInstallers so I can’t redistribute the WDF1.9 through the INF. Can I register the WDFCoinstaller as the class coinstallers.

Does the above mean that I will have to have an application installer to install the driver?

Thanks,
Marshall

Doron Holan
xxxxx@microsoft.com Join Date: 08 Sep 2005
Posts To This List: 6333

RE: WDF keyboard class filter driver

If you install your filter above kbdclass you will need handle read irps. If you
are below, the service callback is how you see the keyboard data. I would go for
the below the class driver approach

debt from my phone

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

10

xxxxx@hotmail.com wrote:

If now I only need to handle USB HID keyboard, to avoid reboot, can I have one
filter driver on top of usbccgf.sys to get the input packet?

If no, do you know anyway that satifies these two purposes:

  • handle the keyboard input packet.
  • avoid reboot after the driver’s installation and updating

You should be able to avoid the reboot by unplugging and replugging the
device, or by using “devcon restart” to restart it. The device stack is
set at device start time, and cannot be changed thereafter.

I tried it for the USB keyboard with the command line devcon restart =keyboard and it works fine. However, it doesn’t seem work for PS2 keyboard. Is it by design or is there any other way?

Thanks,
Marshall

11

>However, it doesn’t seem work for PS2 keyboard. Is it by design or is there any other way?

By design. PS/2 stack is not restartable. You cannot avoid reboot in this case.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

12

By design for ps2

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 10/26/2011 2:19 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] WDF keyboard class filter driver

xxxxx@hotmail.com wrote:

If now I only need to handle USB HID keyboard, to avoid reboot, can I have one
filter driver on top of usbccgf.sys to get the input packet?

If no, do you know anyway that satifies these two purposes:

  • handle the keyboard input packet.
  • avoid reboot after the driver’s installation and updating

You should be able to avoid the reboot by unplugging and replugging the
device, or by using “devcon restart” to restart it. The device stack is
set at device start time, and cannot be changed thereafter.

I tried it for the USB keyboard with the command line devcon restart =keyboard and it works fine. However, it doesn’t seem work for PS2 keyboard. Is it by design or is there any other way?

Thanks,
Marshall

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer