locked
Capturing WH_MOUSE_LL events in windows 8 from a Credential Provider-launched application RRS feed

  • Question

  • I am finding that when I install a hook to catch low level keyboard (WH_KEYBOARD_LL) and mouse (WH_MOUSE_LL) events in windows 8 and launch the application from a credential provider the code receives low level keyboard events, but NOT low level mouse events. I have read in How to capture and manipulate keyboard inputs using low level mouse hook and keyboard hook in windows Runtime app that

    It is not possible to use windows hooks from a Windows Store app.

    , but I don't know whether my usage qualifies as a "Windows Store app". My application is being launched prior to login from the context of the LogonUI.exe (LogonUI.exe calls my CredentialProvider.dll, which calls a fullscreen GUI app, which calls SetWindowsHookEx() to register a hook DLL I have written).

    Also, I have read in the documentation for SetWindowsHookEx that

    Windows Store app development If dwThreadId is zero, then window hook DLLs are not loaded in-process for the Windows Store app processes and the Windows Runtime broker process unless they are installed by either UIAccess processes (accessibility tools). 

    , but again, I am not sure if this applies to my usage. I am passing in 0 for dwThreadId and I have tried to compile my exe and dll files with various UAC settings and can't see that it helps.

    When I run the same code on 64 bit windows 7 machine it receives both low level mouse and keyboard events.

    If I run my fullscreen GUI (with hook DLL) from a windows 8 desktop, it also receives both low level mouse and keyboard events.

    However, if I run the fullscreen GUI from the credential provider, it only receives low level keyboard events and no mouse events.

    Is there something about windows 8 that precludes a process from receiving low level mouse events prior to log in? Is it something about the touch interface? I've read in several places some distinctions about which thread the event will be fired to and I admit I don't completely understand the distinctions, but what seems more important to ask is why the exact same code works fine in one OS, but not in another.

    For references, my code that makes the hook registration is as follows:

    hkb=SetWindowsHookEx(WH_KEYBOARD_LL,(HOOKPROC)KeyboardProc,hins,0);

    hms=SetWindowsHookEx(WH_MOUSE_LL,(HOOKPROC)MouseProc,hins,0);

    In order for me to achieve what I am doing, my code must be able to see all keyboard and mouse clicks (prior to the user actually authenticating).

    I appreciate any insight anyone can offer.

    Thanks,

    -Eric


    avatier

    Monday, April 14, 2014 10:09 PM

All replies

  • I'm having a hard time understanding what any of this has to do with Windows Store app development.

    Matt Small - Microsoft Escalation Engineer - Forum Moderator
    If my reply answers your question, please mark this post as answered.

    NOTE: If I ask for code, please provide something that I can drop directly into a project and run (including XAML), or an actual application project. I'm trying to help a lot of people, so I don't have time to figure out weird snippets with undefined objects and unknown namespaces.

    Tuesday, April 15, 2014 1:23 PM
  • I'm not positive that it is Windows Store app. My app is a kiosk mode browser that is launched prior to log in via the Credential Provider. It is possible that anything launched from the CP is in a similar context as a Windows Store app? I found some references to limitations that the Windows Store app environment imposes on applications that try to create a hook for low level mouse events, so I thought that my app might be environmentally "in the same boat" as a Windows Store app?

    Any chance you could suggest a more suitable forum to post on? In summary, my problem is when I launch a process via the Credential Provider prior to login on windows 8, my process receives low level keyboard events, but does not receive low level mouse events that it registers for, yet the same code on Vista and Windows 7 does receive both types of events.

    Thanks,
    -Eric


    avatier

    Tuesday, April 15, 2014 1:50 PM
  • I moved this to the Desktop SDK forum.

    Matt Small - Microsoft Escalation Engineer - Forum Moderator
    If my reply answers your question, please mark this post as answered.

    NOTE: If I ask for code, please provide something that I can drop directly into a project and run (including XAML), or an actual application project. I'm trying to help a lot of people, so I don't have time to figure out weird snippets with undefined objects and unknown namespaces.

    Tuesday, April 15, 2014 1:55 PM
  • Unlike other kinds of global hooks. the LL hooks, when installed globally, are marshalled into the hooking process via Windows messages. What you are describing sounds like a message filter since you got keyboard messages. UIPI would block the whole thing.

    The architecture of credential provider framework indeed changed in Windows 8, however the change documentation mentions nothing about messages. You can try build a v2 credential provider and see if the situation change. If not, I suggest you to open a support case. 



    Visual C++ MVP


    Tuesday, April 15, 2014 6:38 PM