none
need keyboard filter driver solution RRS feed

  • Question

  • I have keyboard filter driver and whant to disable Windows key.

    Here is my source code of read completion routine:

    NTSTATUS ReadComplete( 
        IN PDEVICE_OBJECT DeviceObject, 
        IN PIRP Irp,
        IN PVOID Context 
        )
    {
        PIO_STACK_LOCATION        IrpSp;
        PKEYBOARD_INPUT_DATA      KeyData;
        int                       numKeys, i;
    
        IrpSp = IoGetCurrentIrpStackLocation( Irp );
        if( NT_SUCCESS( Irp->IoStatus.Status ) ) {
    
            KeyData = Irp->AssociatedIrp.SystemBuffer;
            numKeys = Irp->IoStatus.Information / sizeof(KEYBOARD_INPUT_DATA);
    
            for( i = 0; i < numKeys; i++ ) {
    
                DbgPrint(("ScanCode: %x ", KeyData[i].MakeCode ));
                DbgPrint(("%s\n", KeyData[i].Flags ? "Up" : "Down" ));
    
    			if( KeyData[i].MakeCode == 0x01) {
    				DbgPrint(("Win key pressed!"));
    
    				Irp->IoStatus.Status = STATUS_CANCELLED;
    				Irp->IoStatus.Information = 0;
    				IoCompleteRequest(Irp, IO_NO_INCREMENT);
    				return Irp->IoStatus.Status;
    
    			} else {
    				if( Irp->PendingReturned ) {
    					IoMarkIrpPending( Irp );
    				}
    			}
            }
        }
    
        return Irp->IoStatus.Status;
    }
    It is not working. What should I do? I don't have IRP cancel callback defined (Irp->CancelRoutine). Is it a problem?  Everything else works fine. When my code executes and win key pressed my keyboard stops replying.
    Monday, December 10, 2012 1:09 PM

Answers

  • First off, it is much easier to filter below kbdclass and do this in the service callback. Don't return an error, rather you should change the input packet to something meaningless. You could resubmit the read, but that is more complicated.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, December 10, 2012 3:40 PM

All replies

  • First you are very confused about CANCEL, this is an action the application does to stop an I/O operation not something the driver does, so your comments about a CancelRoutine and use of STATUS_CANCELLED are off.  In your completion routine if you want to ignore the key you should be resubmitting the request so the action is not seen.  Note also you will confuse things if you hide the key down but not the key up.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    Monday, December 10, 2012 1:52 PM
  • First off, it is much easier to filter below kbdclass and do this in the service callback. Don't return an error, rather you should change the input packet to something meaningless. You could resubmit the read, but that is more complicated.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, December 10, 2012 3:40 PM
  • First off, it is much easier to filter below kbdclass and do this in the service callback. Don't return an error, rather you should change the input packet to something meaningless. You could resubmit the read, but that is more complicated.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    I had tried to change KeyData[i].MakeCode to zero, the key was still working. I had tried to change KeyData[i].MakeCode to another key, it was working like another key had been pressed.

    I use IoAttachDevice to connect filter device to stack to \\Device\\KeyboardClass0.

    status = IoAttachDevice( device, &ntUnicodeString, &devExt->TopOfStack );

    It is easy to replace keys, but what new value should be used as non used keyboard key?

    I don't know how to resubmit the read, please give me a path.

    Monday, December 10, 2012 6:12 PM
  • attaching to an already created pnp stack is not correct. you need to properly instal yourself as a pnp filter. once you do that, in the service callback you just eat the input packet, ie never report it to kbdclass. then there is no need to change any make code or anything else.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, December 10, 2012 6:43 PM