Ali
Tue Nov 14 07:16:59 CST 2006
Ray Trent wrote:
> Ahhh. I'm guessing that Windows is reforwarding the message to the
> original destination in the default hook function.
>
> Still, it's not exactly nice to fail to call the next callback in the
> hook chain, and that behavior isn't documented as far as I know.
>
> As for how they do it if not process injection, I don't know the
> details, but the docs say that they just forward the message to the
> hooking thread (you have to have a message loop) instead of the app with
> the focus. That seems relatively straightforward for the OS to
> accomplish. That probably also explains why the below trick works to eat
> the key.
>
> Still... no way to be sure that you're the first one in the chain, so
> you can't perfectly block it except with a driver (and even then, you
> can't be sure to be the first one in the filter chain).
>
> And I'm still not sure about elevated apps (which winlogin almost
> certainly is). I would hope that MS would have prevented that along with
> all the other shatter, snooping, and spoofing attacks via UIPI.
>
> Even if it does work today, the chances are pretty good that it will
> stop working as soon as MS realizes that it's a security hole. So I
> wouldn't count on it.
>
> Mike Carlisle wrote:
> > The way I'm doing it is from C# with PInvoke to SetWindowsHookEx and
> > CallNextHookEx.
> >
> > I attach a handler using
> >
> > hHook = SetWindowsHookEx(WH_KEYBOARD_LL, keyHookHandler,
> > Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
> >
> > Then in keyHookHandler return 1 to eat the event, else bubble the event the
> > the next handler.
> >
> > private int keyHookHandler(int nCode, IntPtr wParam, IntPtr lParam)
> > {
> > if (nCode == HC_ACTION && (wParam = WM_KEYDOWN || wParam == WM_SYSKEYDOWN))
> > {
> > hookStruct = (KeyboardHookStruct)Marshal.PtrToStructure(lParam,
> > typeof(KeyboardHookStruct));
> > // Left Win key
> > if (hookStruct.vkCode == 0x5B)
> > return 1;
> > else
> > CallNextHookEx(hHook, nCode, wParam, lParam);
> > }
> > }
> >
> >
> > "Ray Trent" wrote:
> >
> >> Mike Carlisle wrote:
> >>> Using a low level hook it is possible to prevent the event, WH_KEYBOARD_LL.
> >>> This is good for trapping the windows key, but as you say not ctrl-alt-del.
> >> Oh, how's that? There doesn't appear to be a *documented* way to do eat
> >> a keystroke from a LL kb hook...
> >>
> >> And interesting question is whether LL KB hooks see keystrokes destined
> >> for elevated applications in Vista... a lot of things like that are
> >> prohibited, but since the LL hooks don't require process injection...
> >> who knows?
> >>
> >>> "Bruno van Dooren [MVP VC++]" wrote:
> >>>
> >>>>> You can trap the windows key using a keybroad hook with the
> >>>>> SetWindowsHookEx
> >>>>> api. Just eat the event.
> >>>> Afaik, there are 2 problems with SetWindowsHookEx:
> >>>> 1) you cannot hook CTRL+ALT+DEL, nor any capture keystrokes in the WinLogon
> >>>> desktop (by design)
> >>>> 2) SetWindowsHookEx does not give you a means to change the events. it only
> >>>> alows you to monitor.
> >>>>
> >>>> --
> >>>>
> >>>> Kind regards,
> >>>> Bruno van Dooren MVP - VC++
> >>>> bruno_nos_pam_van_dooren@hotmail.com
> >>>> Remove only "_nos_pam"
> >>>>
> >>>>
> >>>>
> >>
> >> --
> >> Ray
> >>
>
>
> --
> Ray
SNIP:
>Still, it's not exactly nice to fail to call the next callback in the hook chain, and that >behavior isn't documented as far as I know.
DDK says that KbFilter_ServiceCallback for example can do following :
Called when there are keyboard packets to report to the RIT. You can
do anything you like to the packets. For instance:
o Drop a packet altogether
o Mutate the contents of a packet
o Insert packets into the stream
Why we cann't skip these (Ctrl+Alt+Del) keys here?
>As for how they do it if not process injection, I don't know the details, but the docs say >that they just forward the message to the hooking thread (you have to have a message >loop) instead of the app with the focus.
Yeah that's true kbfilter just explains that you can modify the data
with Service class
[
http://www.osronline.com/ddkx/intinput/km-ovr_4i7b.htm
] but won't tell you how;-) And ofcourse it is pretty that you will
never know that you are the first or one to modify these packets in
chain.
ali