none
Example code to modify kbfiltr.c that would substitute for a key sequence another key sequence RRS feed

  • Question

  • Would someone be willing to illustrate where in kbfiltr.c substitution code should be written, and maybe a simple exchange of input?

    Friday, February 12, 2016 10:29 PM

Answers

  • in the service callback. you would walk the passed in array of KEYBOARD_INPUT_DATA, check for the key you want to replace and then in place change the value to the new key. then call the upper layer

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Saturday, February 13, 2016 3:47 AM

All replies

  • in the service callback. you would walk the passed in array of KEYBOARD_INPUT_DATA, check for the key you want to replace and then in place change the value to the new key. then call the upper layer

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Saturday, February 13, 2016 3:47 AM
  • Can I expand/shrink that array as in <the data element(s)>  are shorter/longer than <my data element(s)>? 
    Saturday, February 13, 2016 3:33 PM
  • yes and no. the passed in array's size cannot change, but you can easily report your own array of your defined length to the upper service callback. there is no requirement that you must pass up the array that was passed to you. instead of an array, you could also just have one KEYBOARD_INPUT_DATA on the stack and format it multiple times, calling the upper service callback N times in a row

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Saturday, February 13, 2016 4:47 PM
  • If I pass my own array pointer, how do I know when it has been used or deleted? Since such is likely very short and I reuse my memory,  when would I know that I can do so?
    Sunday, February 14, 2016 4:38 PM
  • When the driver below you *completes* the request, it is done with the buffer. Then you can reuse it. The same applies to requests sent to you.

    -- pa

    Sunday, February 14, 2016 10:28 PM
  • keyboard filters don't deal with irps, they pass information with a callback

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, February 15, 2016 5:44 AM
  • it used synchronously. if you take the time to look at the service callback signature it has a parameter which indicates how many are consumed after the call returns.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, February 15, 2016 5:45 AM
  • I think I see most of my question illustrated in https://social.msdn.microsoft.com/Forums/en-US/1cc3cb35-4fe3-434e-8ef6-c731e31baa2c/keyboard-filter-driver-how-to-check-if-a-key-was-pressed-in-combination-with-shift?forum=wdk, but the last part of the loop confuses me.

    ..... in for loop handling one input at a time

    (*(PSERVICE_CALLBACK_ROUTINE)(ULONG_PTR)devExt->UpperConnectData.ClassService)(
    devExt
    ->UpperConnectData.ClassDeviceObject,
    &data[0],
    &data[endIndex],
    InputDataConsumed);       <-IN, not set to anything different, more than one?, evaluated InputDataConsumed times
    }

    *InputDataConsumed = (ULONG)length;

    }

    Is that right wrong, good practice?  I have not been able to test my own yet as having target W10Pro UEFI boot problem and host 8.1Pro VS2015 Update 1 with W10WDK debug setup error "Inappropriate request for export from part that belongs to another sharing boundary", but I'll get there.


    • Edited by mwindham Tuesday, February 16, 2016 4:31 AM omission
    Tuesday, February 16, 2016 4:31 AM
  • using the caller's InputDataConsumed for the upper callback's parameter is fine. In practice, the passed up keyboard_input_datas are always consumed and the implementation in the sample assumes this, so it just assigns the number of consumed to the lower caller to the number of elements reported

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Tuesday, February 16, 2016 8:45 PM
  • On my target machine, I am trying to use devcon to install in the package folder the unaltered kbfiltr.sys from "Keyboard Input WDF Filter Driver (Kbfiltr)". It just fails. Toshiba 845T 64 bit description "PC/AT Enhanced PS/2 Keyboard (101/102-Key)" with hids "ACPI\VEN_TOS&DEV_1105,
    ACPI\TOS1105, *TOS1105"and chids "*PNP030B". Driver is signed in build and inx used to make inf has used the first hid and  chid instead of pnpbaad to no avail. Administrator command prompt. Missing what? Do I need to import certificate manually first, something else?
    Friday, February 19, 2016 9:41 PM
  • Finally got vs2015 working to Target. Had to https://msdn.microsoft.com/en-us/windows-drivers/develop/deploying_a_driver_to_a_test_computer  add HKLM\Software\Microsoft\DriverTest\Service DWORD value DebugSession, and set it to 0, set WDK Remote Communication Service to automatic, and sign driver in driver project not package as package already set to sign. Norton or RealVNC does not seem to conflict. Used value of "%DDK_Ex% = kbfiltr,  *PNP030B" in inx and installed as "ACPI\VEN_TOS&DEV_1105". devcon hwids *pnp030* lists
    C:\DriverTest>devcon hwids *pnp030*
    ACPI\TOS1105\4&19149E12&0
        Name: DDK Example Device that needs filtering
        Hardware IDs:
            ACPI\VEN_TOS&DEV_1105
            ACPI\TOS1105
            *TOS1105
        Compatible IDs:
            *PNP030B  

    Only problem now is kbftest does not find it.
    List of KBFILTER Device Interfaces
    ---------------------------------
    No device interfaces present
    Reason ERROR_NO_MORE_ITEMS from the first iteration.


    • Edited by mwindham Monday, February 22, 2016 10:40 PM added error code
    Monday, February 22, 2016 6:07 PM
  • Do not forget "Bcdedit.exe -set TESTSIGNING ON"!!!!!!!

    Now I can freely screw up the driver and know who did it.

    Wednesday, March 2, 2016 6:41 PM