making a keylogger from keyboard filterdriver

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Drivers
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - How Access SRB buffer data in filter driver? How Access SRB buffer data in filter driver? I'm writing a upper filter driver to a stream minidriver (DDK sample - testcap.sys in my project) and try to modify the stream data in the filter. I write my filter based on the document : http://www.cswl.com/whiteppr/tech/wdm.html But how can I access the buffer data in the filter driver? Any suggestion would be apprieciated, and thank you in advance. Here's something about my idea. in minidriver, I find the srb has the irp point: 0: kd> ??*pSrb (0x81921c78 struct _HW_STREAM_REQUEST_BLOCK *) struct _HW_STREAM_REQUEST_BLOCK +0x000 SizeOfThisPacket : 0x4c +0x004 Command : 0 ( SRB_READ_DATA ) .... +0x018 CommandData : _CommandData union _CommandData +0x000 DataBufferArray : 0x81c038f8 (KSSTREAM_HEADER) +0x000 StreamBuffer : 0x81c038f8 +0x000 ....... +0x01c NumberOfBuffers : 1 +0x020 TimeoutCounter : 0xf +0x024 TimeoutOriginal : 0xf +0x028 NextSRB : (null) +0x02c Irp : 0x81f2a008 +0x030 Flags : 3 ..... and in the irp, I found the Irp->AssociatedIrp->SystemBuffer has the same value with the pSrb->CommandData (KSSTREAM_HEADER): 0: kd> ??*pSrb->Irp struct _IRP +0x000 Type : 6 +0x002 Size : 0x190 ........ +0x00c AssociatedIrp : __unnamed 0: kd> ??pSrb->Irp->AssociatedIrp union __unnamed +0x000 MasterIrp : 0x81c038f8 +0x000 IrpCount : -2118108936 +0x000 SystemBuffer : 0x81c038f8 +0x010 ThreadListEntry : _LIST_ENTRY [ 0x81c275c8 - 0x821da018 ] +0x018 IoStatus : _IO_STATUS_BLOCK +0x020 RequestorMode : 1 '' so I ajudge that Irp->AssociatedIrp->SystemBuffer is the stream data buffer, but I found that when minidriver complete the SRB (calling StreamClassStreamNotification(StreamRequestComplete, ...)), the stream class driver (I took it for granted as I used "ba" command in Windbg)change the value of pSrb->CommandData.Data. so in the complete routine in filter driver, the stream data buffer can't access. Tag: making a keylogger from keyboard filterdriver Tag: 67816
  - 2
    - Tooltip of UI plug-in on Win2K Hello! I implemented UI plug-in DLL with Tooltip feature. This DLL can work on the WinXP or higher OSs correctly. But, in case of Win2K, this DLL can not show any tooltip windows. I used sample code(refer to below) on MSDN for adding tooltip feature. Please give me an answer. Thanks, Junyoung Choi //////////////////////////////////////////////////////////////////////// void CreateMyTooltip (HWND hwnd, HWND hctrl) { // struct specifying control classes to register INITCOMMONCONTROLSEX iccex; HWND hwndTT; // handle to the ToolTip control // struct specifying info about tool in ToolTip control TOOLINFO ti; unsigned int uid = 0; // for ti initialization TCHAR strTT[30] = _T("This is your ToolTip string."); LPTSTR lptstr = strTT; RECT rect; // for client area coordinates // INITIALIZE COMMON CONTROLS iccex.dwICC = ICC_WIN95_CLASSES; iccex.dwSize = sizeof(INITCOMMONCONTROLSEX); InitCommonControlsEx(&iccex); // CREATE A TOOLTIP WINDOW hwndTT = CreateWindowEx(WS_EX_TOPMOST, TOOLTIPS_CLASS, NULL, WS_POPUP | TTS_NOPREFIX | TTS_ALWAYSTIP, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, hwnd, NULL, ghInstance, NULL ); SetWindowPos(hwndTT, HWND_TOPMOST, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE | SWP_NOACTIVATE); /* INITIALIZE MEMBERS OF THE TOOLINFO STRUCTURE */ ti.cbSize = sizeof(TOOLINFO); ti.uFlags = TTF_SUBCLASS; ti.hwnd = hctrl; ti.hinst = ghInstance; ti.uId = uid; ti.lpszText = lptstr; /* GET COORDINATES OF THE MAIN CLIENT AREA */ GetClientRect (hctrl, &rect); ti.rect.left = rect.left; ti.rect.top = rect.top; ti.rect.right = rect.right; ti.rect.bottom = rect.bottom; VERBOSE(DLLTEXT("Tooltip : %d, %d, %d, %d \r\n"), ti.rect.left, ti.rect.top, ti.rect.right, ti.rect.bottom); /* SEND AN ADDTOOL MESSAGE TO THE TOOLTIP CONTROL WINDOW */ SendMessage(hwndTT, TTM_ADDTOOL, 0, (LPARAM) (LPTOOLINFO) &ti); } Tag: making a keylogger from keyboard filterdriver Tag: 67810
  - 3
    - How many IRPs are queued at most when use cancel-safe queue framework? Hi, I implement a lower filter driver to queue IPR by using cancel-safe queue framework. The system seems not to send IRP again when the number of IRP is about 25. The following is my test: 1. create a lower filter driver under Disk.sys 2. Queue IRP_MJ_SCSI in lower filter driver. 3. The system seems not to send IRP_MJ_SCSI again when the number of IRP_MJ_SCSI in queue is about 25. Lower filter driver dont release IRP_MJ_SCSI in queue until after ten minutes. 5. Lower filter driver release IRP_MJ_SCSI and it's ok. Question: 1. How many IRP can be queued at most by using cancel-safe queue framework? 2. Will it cause problem if lower filter driver queue IRP ten minutes or even more? 3. Why the system dont send IRP_MJ_SCSI again when the number of IRP in queue is about 25? What's mechanism? Thanks in advanced. Brian Tag: making a keylogger from keyboard filterdriver Tag: 67807
  - 4
    - How WMI Trace is synchronized? Several times I've heard that ETW trace is designed so that it avoids artificial serialization that won't exist without trace. If this is true, how it works? It should eventualy synchronize on access to some memory buffer or file object ? Regards, --PA Tag: making a keylogger from keyboard filterdriver Tag: 67806
  - 5
    - Stack overflow in nt!Kei386EoiHelper+0x173d Hi For some reason i was unable to configue symbols on windbg so i didn't post the !analyze -v output. I got a UNEXPECTED_KERNEL_MODE_TRAP (7f) Parameter 1 : 0x8 Double Fault. Any idea what can be the cause ? nt!Kei386EoiHelper+0x173d is the only function i saw in the stack trace, i didn't even see my driver's function. Thanks Tag: making a keylogger from keyboard filterdriver Tag: 67798
  - 6
    - test Sorry - another test Tag: making a keylogger from keyboard filterdriver Tag: 67797
  - 7
    - Assert being the highest-level driver The DDK specifies that some operations are restricted to highest-level drivers only. Such as safely waiting on dispatcher objects. Ok, this makes a lot of sense. But how a driver can guarantee it is in effect the highest-level driver? Assume, I just want to assert this at run time, will ExGetPreviousMode do the trick? Tag: making a keylogger from keyboard filterdriver Tag: 67796
  - 8
    - Build problem with Windows Development Kit (WDK) Hello, I'm continuing work on a user-mode project that uses the Windows DDK, which was originally written using the Windows IFS Kit version 3790.1414 on another PC. To get the project to build, the following include directories were listed up in Microsoft Visual Studio .NET (Tools | Options... | Projects | VC++ Directories): C:\WINDDK\3790.1414\inc C:\WINDDK\3790.1414\inc\wxp C:\WINDDK\3790.1414\inc\ifs\wxp C:\WINDDK\3790.1414\inc\ddk\wxp C:\WINDDK\3790.1414\inc\crt I have just installed a later version of the IFS Kit / DDK, now known as "MicrosoftÂ® WindowsÂ® Driver Kit (WDK)". The DDK directory structure is installed on my PC under: C:\WINDDK\5112 The include directories present in this later DDK do not match exactly those in the earlier one - by looking at the contents of the directories in the 3790.1414 and comparing them with those in the newer one, I've set up the following include directories: C:\WINDDK\5112\inc C:\WINDDK\5112\inc\api C:\WINDDK\5112\inc\ddk C:\WINDDK\5112\inc\crt However, when I build the entire solution in Visual Studio now, I get the following build error for several of the projects: C:\WINDDK\5112\inc\ddk\fltUserStructures.h(24) : fatal error C1012: unmatched parenthesis : missing ')' The line this refers to is: #if FLT_MGR_BASELINE If I right-click on this symbol and "Go to definition", it shows the definition in fltUser.h: #define FLT_MGR_BASELINE (OSVER(NTDDI_VERSION) == NTDDI_WIN2K && SPVER(NTDDI_VERSION) >= 5) || \ (OSVER(NTDDI_VERSION) == NTDDI_WINXP && SPVER(NTDDI_VERSION) >=2) || \ (OSVER(NTDDI_VERSION) == NTDDI_WS03 && SPVER(NTDDI_VERSION) >=1) || \ (OSVER(NTDDI_VERSION) >= NTDDI_WINLH) Clearly, there are no unmatched parentheses! (?) So I'm confused about why I get this build error. Does anyone have any idea why this error occurs, and what I can do to resolve it? Many thanks in advance for any advice or comments, JP Tag: making a keylogger from keyboard filterdriver Tag: 67789
  - 9
    - IOCTL_DISK_GET_DRIVE_GEOMETRY Hi all, I have written a lower filter to class driver(disk.sys). I want to get the information about the size of the disk. I see class driver is sending the IOCTL_DISK_GET_DRIVE_GEOMETRY down, for which I have registered a completion routine. In the completion routine I get Irp->IoStatus.Status as STATUS_NOT_SUPPORTED. SO I'm unable to get the information I wanted. Can anybody please tell me why I'm getting this error? Has anybody encountered this problem earlier? - Prashanth Tag: making a keylogger from keyboard filterdriver Tag: 67781
  - 10
    - Multi-interface BDA Driver install Issie Our device driver is TV USB Dongle BDA Driver and drivers have six files (modlod.inf ,modlod.sys,modlod.cat,modbda.inf,modbda.sys,modbda.cat) it is multi-interface device one is TV tuner function for USB interface another is Remoter function for USB HID interface now have question issue?because i can't find any solution or correct answer to solve So could anybody give me help or guide ? i describe this issue as follows: 1. I use manual mode install BDA driver,frist install modload driver and continue install modbda driver ,when i plug in the dongle to USB port then TV tuner interface and HID interfcae all can mount on and show ok in device manager 2. but i use DIfX ( Driver Installation Tools 2.0) tool's DPInst.exe install driver or use installshield package setup.exe to install driver when plug in the dongle , then the tv tuner interface mount on ok but usb hid interface can't mount on ok 3. final i only remove modbda driver and modload driver to keep ,the modbda driver remove so the tv tuner function can't mount on at the same time the usb hid interfcae can auto mount on ok So i think that modbda2.inf may be change some setting ( mod*.inf in attachment ) but i don't any idea to change some setting or another place must be change my driver modbda.inf section content as follow: [uni] %uni.DeviceDesc% = uni.Device,USB\VID_xxxx&PID_xxxx %uni.DeviceDesc% = uni.Device,USB\VID_xxxx&PID_xxxx&MI_00 i know mi00 interface is tv tuner interface but mi01 interface is usb-hid interface in can to completely imitate OS internal .inf and usbxxx.sys so i think .inf file may be modify some setting or in hct testing how to setting to cover question Tag: making a keylogger from keyboard filterdriver Tag: 67772
  - 11
    - IRP and Queue ? i get a little misunderstand.. 1 Overlapped API returned after driver return pending. 2 Does IO manager pass down IRP one by one? Serial sample code manage Queue by itself, Start Irp if there is no any Irp is processing, otherwise queue it . If there is current irp working now, it will not return until compelete. How can the second Irp go into queue? Poly Tag: making a keylogger from keyboard filterdriver Tag: 67767
  - 12
    - 64 bit development Hi, I have a few questions regarding the subject. 1) Will executables/drivers built for IA64 work on x64 and vice versa? Is there any common subset of assembly instructions that allows to have a single binary for both platforms? 2) I had an impression that I can't use x86 to compile 64 bit user and kernel mode software. However, I tried DDK's IA64 build environment on x86, and it built a driver. So can I use a x86 (32 bit) machine to build 64 bit software with the DDK and VS 2003 compilers? 3) I heard IA64 strictly enforces data alignment, while AMD x64 is more tolerant. Does that mean it makes more sense to use IA64 for testing purposes? Is everything that comes from Intel is IA64? 4) I want to get a 64bit PC to test drivers. What's the cheapest CPU option? Now can use Pentium D, or should it be Itanium, Opteron, Athlon? I don't need a dual core CPU, do I? Of course, I plan to buy a dual CPU motherboard. Thanks. -- Tag: making a keylogger from keyboard filterdriver Tag: 67756
  - 13
    - USB driver latency at system boot I've been pulling my hair out on this one for about 3 weeks. Dell tech services is of no help - update your chipset drivers. Yes, been there, done that. I've updated every driver I can find. I'm seeing this problem on multiple motherboards from different vendors and different BIOS's. I have an application that gets started via HKLM\Software\Microsoft\Windows\CurrentVersion\Run. It performs a 10 second wait, then looks for a USB security dongle. If the dongle isn't present, the application disables most functionality. This has been working for several years and all of a sudden it's stopped working. (WinXP SP1a & some QFEs, Win XP Embedded SP2) Long story short, there's approximately a 70 second delay after boot where the security dongle isn't available. I added a function call CMP_WaitNoPendingInstallEvents using an infinite wait. The first call waits 67-72 seconds before returning. I'm trying to figure out what's causing the delay. I've noticed I cannot logoff until after this period expires. I can initiate the logoff, but nothing happens until after this wait expires. Also, any USB device detection doesn't occur until after the wait expires. I saw this with a thumb drive, USB keyboard and mouse. (i.e. the PnP install wizard doesn't show in the notification area and I had no kb/mouse I/O for about 90 seconds). Once the initial detection occurs, the kb/mouse seem to work fine at boot. Just the initial detection. I've used bootviz to do some testing but found nothing. All I have is CMP_WaitNoPendingInstallEvents timings. As long as this function call is there, everything is happy but if I let the app just run, the security dongle is never found right away. How do I figure out what's causing the latency problems? I need help troubleshooting this. I'm a Windows application developer and know very little about DDK or hardware in general. Regards, harrier Tag: making a keylogger from keyboard filterdriver Tag: 67754
  - 14
    - INF file expert authors help me Hi, Iam trying to write a win2k plug n play driver for 16 bit PCMCIA PC card. Iam having one doubt in writing INF file. That is "ClassGuid" Which class name should I define in my INF file. whether I have to define the same class name "PCMCIA" as per DDK documentation or I can specify My own class name? If I use separate class name, so which ClassGuid shall I use for that. As per the following para from DDK documentation,it is confirm that this class is for only system-supplied drivers of PCMCIA and CardBus host controllers, but not drivers of PCMCIA or CardBus peripherals. //////////////////////////////////////////////////// PCMCIA Adapters Class = PCMCIA ClassGuid = {4d36e977-e325-11ce-bfc1-08002be10318} This class includes system-supplied drivers of PCMCIA and CardBus host controllers, but not drivers of PCMCIA or CardBus peripherals. /////////////////////////////////////////////////// I used the following in my INF file Class = ACLPCMCIA ClassGuid = {4d36e97e-e325-11ce-bfc1-08002be10318} I took pcmcia id from the following registry path. CurrentControlSet\Enum\PCMCIA\ and written in my INF file as follows. PCMCIA\Apollo-ApoorvaCard-77F7. I Plugged pcmcia card in PC and appeared new harware found wizard.I followed the steps and I given my .INF file path. After I found blue death screen and PC restarted. Before I created Win2k plug n play driver project in VC++ 6.0 and compiled with wizard generated code and without adding my code.The generated .sys file Iam using in INF file to copy to destination dirs. For detecting a device is it required to add any code in drivers or the default pnp driver project code is sufficient? What could be the problem?Please help me in solving the above issues.Iam ready to send my INF file if required. If Iam going in a wrong direction please guide me in right way. Thank u Mahender. Tag: making a keylogger from keyboard filterdriver Tag: 67751
  - 15
    - Official INTERNAL Ioctls What makes an internal IOCTL to being officially documented and supported? 1) Mentioned in the DDK documentation 2) Defined in a ntddXXX include file in the inc subdir of the ddk 3) Defined in a ntddXXX include file in an inc subdir of the src tree I suppose that the case 2 is good enough. But what about the last case? Seems to be a grey area. If it's official why the include file is not in the main inc subdir. But on the other hand, if it's private why use that particular filename convention? Thanks Tag: making a keylogger from keyboard filterdriver Tag: 67747
  - 16
    - How do I Load a new Driver? I'm a bit confused about how I load a driver for an FDO. I've got a bus enumerator driver, it detects a new piece of hardware. Now I want to create a PDO that controls access to the hardware and demand load a functional driver that creates its own FDO, rooted with the PDO I've created in my bus enumerator. How do I do this? Thanks. Tag: making a keylogger from keyboard filterdriver Tag: 67746
  - 17
    - Repost: DIFxApp Legacy Mode on Windows 2000 This is a repost but I am now invoking the tech support powers of the MSDN Universal Subscription. Please forgive my redundancy. I have an installation for an unsigned driver that I have configured for legacy mode (flags set to 0x8 in the MsiDriverPackages custom table). It works fine on XP but fails on 2000. The error code that I am seeing from DIFxApp is 0x800B0100 which I believe indicates a signature problem. What else do I need to do to get this to work? Mike Tag: making a keylogger from keyboard filterdriver Tag: 67745
  - 18
    - Identify attached devices to an usb hub Hi freaks, I'm looking for a way to solve the following problem: I've a pc with several usb hubs attached to. To these hubs there are usb devices attached in turn (typical 4 usb-serial converter and a memery stick). Due to the undefined connection sequence I'm not able to predict which COM port is located to which usb hub - but my software have to know it for sure. I've been able to find a way to identify all to the system attached usb devices (.NET framework: System.Management.PropertyDataCollection). But further more I have to know, which usb device is attached to which usb hub. Is there something like a path which shows me the actual physical tree structure of hubs and devices and their assigned com ports? (I know: It is a bus system ;-) ) \\pc\usb_01\hub_02\device_01->(ComPort 05) \device_02->(ComPort 02) \device_03->(ComPort 03) \device_04->(ComPort 04) \\pc\usb_03\hub_01\device_01->(ComPort 01) ... Where can I get these information (registry) an how can I obtain this information by software (e.g. C#) Thanks in advance! Mario Tag: making a keylogger from keyboard filterdriver Tag: 67742
  - 19
    - don't go to stanby from C3 state I am makeing WDM streaming driver like USBintel. we supported selective suspend. But we faced a new problem. Some PC can go to Stanby mode with pluging in our capture driver. But some PC can NOT go to Stanby mode with pluging in our capture driver. All PC that we can test, can go to Stanby mode with pluging in our capture driver before we building SelfSuspend mode ( or selective suspend mode ) in our capture driver. Unfortunately, the PC can not go to Stanby mode was not near me. I think that, when a PC go to suspend mode, IdleNotificationRequestCompletion must be called. some PC's may not call that routin. I don't write codes for WaitWake because our device not support remote wake. I hope to some advice for facing that Bug. Tag: making a keylogger from keyboard filterdriver Tag: 67741
  - 20
    - Valueadd.sys Hi, I am looking for the Valueadd.sys filter driver sample that was originally in the Windows 98 DDK, but seems to have been removed from the current downloadable DDK. Anyone know where I can find this, including source? Is it still available? Many thanks Andy W Tag: making a keylogger from keyboard filterdriver Tag: 67739
  - 21
    - Keyboard IRQ & IDT Mapping In my driver, I need to get the address of ISR registered by i8042prt.sys( or any keyboard device driver). I checked through WinDbg and I found that, 0x93 index is using by keyboard ISR. I observed !opapic extension's output also. It is givign the following info. lkd> !ioapic IoApic @ FEC00000 ID:2 (20) Arb:0 Inti00.: 000100ff Vec:FF FixedDel PhysDest:00 edg high masked Inti01.: 00000993 Vec:93 LowestDl Lg:01000000 edg high Inti02.: 000100ff Vec:FF FixedDel PhysDest:00 edg high masked lkd> !idt ............................. ..................................... 93: ff995dd4 (Vector:193,Irql:8,SyncIrql:9,Connected:TRUE,No:0,ShareVector:FALSE,Mode:Latched,ISR:i8042prt!I8042KeyboardInterruptService(f96684a2)) ........................ ..................... How can I get that IDT index value programatically on Multiprocessor & Uniprocessor systems? Please help me. Thanks in Advance, &Raj. Tag: making a keylogger from keyboard filterdriver Tag: 67736
  - 22
    - ethernet raw sockets Hello We need to establish a communication between two devices. They use the ethernet protocol, but no other protocol above (neither IP, nor TCP, UDP...), we want to make the frames by ourselves and send our own data with our own protocol. Is it possible? In this post http://msdn.microsoft.com/newsgroups/default.aspx?dg=microsoft.public.development.device.drivers&tid=2046a88b-e302-4bb1-ba95-b472995d7c4f&cat=en-us-msdn&lang=en&cr=US&sloc=en-us&m=1&p=1 I have understood that it is possible using raw sockets, but how can I do that I want under Windows XP? Thank you in advance Tag: making a keylogger from keyboard filterdriver Tag: 67733
  - 23
    - Problem with usbccid driver I am developing an usb smartcard reader using the usbccid driver from Microsoft. The reader works fine except in "hard" condition tests (detailed below) that have 2 critical consequences: (1) Reboot of the PC or (2) Impossibility to detect an usb product anymore (as if the usb plug-and-play service was crashed). For the second consequence, a reboot of the PC is also necessary to find again a normal behaviour of the PC. My smartcard reader is not powered by USB, but has an external power supply. Unfortunately I am unable to find a repeatedly test sequence that make my reader crash the PC but here is what I have noticed: (1) Reboot of the PC appears after a lot of quick insertion/removal of both USB and power supply. I have a blue screen with information: BAD_POOL_CALLER (i.e. free buffer failed) (2) The impossibility the find any usb product anymore appears when one or more CCID messages was/were sent from the PC and the reader did not answered it/them because the power supply was voluntary removed. So I want to know if somebody has got similar problems with the usbccid driver or an idea of what I am doing wrong in my code to produce those behaviours. Best regards, Olivier Tag: making a keylogger from keyboard filterdriver Tag: 67729
  - 24
    - Problem with UnbindFrom() I have problem with unbinding IM driver from all above and bellow components. I have tried it by this way: INetCfgComponent* cfgCompBuff[256]; INetCfgComponent* pncc=NULL; INetCfgComponentBindings* inetCfgCompBindings = NULL; INetCfgBindingPath* pncbp=NULL; hr = pnc->FindComponent(szComponentId, &pncc); while (S_OK == (hr = HrGetNextBindingPathToDelete(pncc, EBP_BELOW, &pncbp, &inetCfgCompBindings))) { ZeroMemory(cfgCompBuff, sizeof(cfgCompBuff)); hr = pnc->EnumComponents(&GUID_DEVCLASS_NET, &enumCfgComp); if(hr == S_OK) { hr = enumCfgComp->Next(256, (INetCfgComponent**)&cfgCompBuff, &celtFetched); for(i = 0; i < celtFetched; i++) { hr = inetCfgCompBindings->UnbindFrom(cfgCompBuff[i]); } } enumCfgComp->Release(); ReleaseObj(pncbp); } while (S_OK == (hr = HrGetNextBindingPathToDelete(pncc, EBP_ABOVE, &pncbp, &inetCfgCompBindings))) { ZeroMemory(cfgCompBuff, sizeof(cfgCompBuff)); hr = pnc->EnumComponents(&GUID_DEVCLASS_NETTRANS, &enumCfgComp); if(hr == S_OK) { hr = enumCfgComp->Next(256, (INetCfgComponent**)&cfgCompBuff, &celtFetched); for(i = 0; i < celtFetched; i++) { hr = inetCfgCompBindings->UnbindFrom(cfgCompBuff[i]); } } enumCfgComp->Release(); ReleaseObj(pncbp); } Return values from UnbindFrom() functions are S_OK in case that binding exist, but when I see Properties dialog of unbinded network connection - check box is still there and IM driver is functional. What is wrong with that way of unbinding ? Peter Tag: making a keylogger from keyboard filterdriver Tag: 67727
  - 25
    - Event Notifications from Stream Class Minidriver Hi, How can I get Event Nofications from Stream Class to Client? Whenever the Hardware Interrupt occurs, I want to receive notifications from Minidriver. So far I am coding like this on client program: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/VidCapStream/hh/vidcapstream/avsover_5e27cc99-0dca-497c-a539-6f188d46374f.xml.asp And on the mindriver side, 1. Is it the cbEventRoutine(strMiniEvent) called when the client send pIKsControl->KsEvent? 2. If not, How can I arrange KSEVENT_ENTRY for StreamClassStreamNotification? Thanks. Tag: making a keylogger from keyboard filterdriver Tag: 67724
- Next
  - 1
    - Telephony service will not start, error 1053 The 'Phone and modem options' in the controlpanel have stopped working. I've traced it to the 'Telephony' service that will not start. I gives a 1053 error telling me that the service could not be started. To my knowledge nothing changed in the configuration. The OS is W2K Server (english version). Untill now WinFax has always worked without a problem (simple modem connected to COM2), now it will not work anymore because of these errors. Any idea what could be wrong ? Tag: making a keylogger from keyboard filterdriver Tag: 67707
  - 2
    - Problem when using MmWriteCombined in MmMapIoSpace Hi, After specifying MmWriteCombined in MmMapIoSpace, the Write through a PCI Device became much faster but data written does not seems to be correct. The DDK says the when using MmWriteCombined, the requested memory cannot be cached, but can be used as a frame buffer by the video port driver. Why there some data are lost or not correct when using this Cache type? Also, does Windows programs any hardware to increase the performance? What is the best way to map a PCI base register to get the best performance for the write access (write bursts)? -- Thanks, Daniel Tag: making a keylogger from keyboard filterdriver Tag: 67706
  - 3
    - test Testing - sorry. -- Please do not send e-mail directly to this alias. this alias is for newsgroup purposes only. This posting is provided "AS IS" with no warranties, and confers no rights. Tag: making a keylogger from keyboard filterdriver Tag: 67705
  - 4
    - Watch locals not working (win2003server amd64) Hello All, I have tried to debug my driver on the win2003server amd64 target computer (host computer - winxp 32 bit, windbg ver. 6.3.0003.7), but i can't watch locals. This is the dv command result: kd> dv/v 00000000`000000ac DriverObject = <Memory access error> 00000000`000000b4 RegistryPath = <Memory access error> 00000000`0000008c status = <Memory access error> How can I fix this? Thanks. -- Best regards, Vladimir Zinin mailto:vzinin@gmail.com Tag: making a keylogger from keyboard filterdriver Tag: 67703
  - 5
    - DIFxApp Legacy Mode on Windows 2000 I have an installation for an unsigned driver that I have configured for legacy mode (flags set to 0x8 in the MsiDriverPackages custom table). It works fine on XP but fails on 2000. The error code that I am seeing from DIFxApp is 0x800B0100 which I believe indicates a signature problem. What else do I need to do to get this to work? Mike Tag: making a keylogger from keyboard filterdriver Tag: 67700
  - 6
    - disable and re-enable a device Hi, I'm trying to disable a device by issuing an irp (IRP_MN_QUERY_REMOVE_DEVICE) followed by another irp (IRP_MN_REMOVE_DEVICE). to re-enable it again, I'm sending another irp(IRP_MN_START_DEVICE) but I'm getting an error stating STATUS_DELETE_PENDING. Hence, I managed to "disable" a device, but fail to "re-enable" it back. Anybody know the right way of doing this? I'm running as a filter driver. Is there a way to force the system to re-enumerate all the devices - so I could get the device back? cheers. Tag: making a keylogger from keyboard filterdriver Tag: 67694
  - 7
    - purging ntfs cache from driver - again, sorry... I'm reposting this as I haven't found the answer that I'm looking for, and there's no answer from microsoft yet, and I've been guaranteed 2 days response time.... Hi, I'm trying to purge a specific file data cached by the OS... How do I accomplish that? I've tried to use various techniques (incl setting the flag FILE_NO_INTERMEDIATE_BUFFERING) but the data is still cached. I'm trying to force the system to re-read data in a dvdrom. Apparently, the DVD rom won't be accessed if part of the data (few hundred megs) are cached in the file system. I want this to be accssed each time - or when I want it to. i'm assuming that the file won't be memory-mapped into the memory. I found that mounting and dismounting the drive would purge the cache, but this is a fairly big operation... wondering if there's a better way to do it. This is evident if you try to copy some large files, cancelling it halfway and do a re-copy would take shorter time as the reading is done via cache... but if you disable the dvdrom, and re-enable it, the copy time would take as long as the first time. thanks in advance. Kenny Tag: making a keylogger from keyboard filterdriver Tag: 67691
  - 8
    - Two drivers for same device Is it possible to have two different low-level drivers claiming the same physical device, and dynamically switch between them? One would be the Microsoft supplied one and another a custom one. I can't implement this as a filter driver, because both claim ownership at the hardware and interrupt level. I don't want to "replace" the system supplied driver. Just to temporarily disable it and activate the custome one and vice-versa. Tag: making a keylogger from keyboard filterdriver Tag: 67686
  - 9
    - Ndis-Broadcom Hi All, I have written an intermediate driver based on passthru sample. My driver works fine with WLAN card and Gigabit LAN card of intel . But it crashes, when i use it on BroadCom Nextreme Gigabit ethernet card. The operating system is windows xp with SP2 and version of the driver is 7.80.0.0 date:06/19/04. Is there anything i need to put it in .inf or in intermediate driver to make it work with Broadcom's hardware? Could anyone let me know how can i fix this bug? Thanks, Senthil Tag: making a keylogger from keyboard filterdriver Tag: 67683
  - 10
    - Create asynchronic IRP As a result from IoDeviceControl from an application i want to create a new asynchronic IRP using IoAllocateIrp. The input buffer for the new IRP is the same buffer got from the application. newIrp = IoAllocateIrp(DeviceObject->StackSize, FALSE); if(NULL != newIrp ) { NextStack = IoGetNextIrpStackLocation(Irp); NextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL; NextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_I8042_KEYBOARD_WRITE_BUFFER; buf = Irp->AssociatedIrp.SystemBuffer; BufLen = stack->Parameters.DeviceIoControl.InputBufferLength; NextStack->Parameters.DeviceIoControl.Type3InputBuffer = ExAllocatePool(NonPagedPool,BufLen ); RtlCopyMemory( NextStack->Parameters.DeviceIoControl.Type3InputBuffer, Irp->AssociatedIrp.SystemBuffer, BufferLength); ..... } Got blue screen with error 0xCC PAGE_FAULT_IN_NONPAGED_AREA Invalid system memory has been referenced. can you tell me where i get wrong? Tag: making a keylogger from keyboard filterdriver Tag: 67681
  - 11
    - How to delete system file in WinXP sp2 on AMD 64-Bit platform? Dear Sir, In WinXP 64bit platform, when I use DeleteFile() function to delete c:\windows\system32\drivers\a.sys ,it can not be deleted successfully , the error code is 2(GetLastError ,means can not find the file, but the file is in the folder), I guess the system protect the system folder ,then how can I delete the files in the system folder ? BTW,I also tried as follows,failed again: 1. I write the hard code of the path "c:\windows\system32\drivers\a.sys"; 2. I use GetSystemWow64Directory () function get the system directory,message box shows the path is "c:\windows\sysWow64",I use the return path +"\drivers\a.sys" in DeleteFile() function; 3. I new a A.txt file in system32 folder,use the above two method to delete the file; All above 3 methods,GetLastError() return value shows can not find the special file. 3ks! Cathy Tag: making a keylogger from keyboard filterdriver Tag: 67673
  - 12
    - DRIVER_VERIFIER_IOMANAGER_VIOLATION Hi All ! I am working on an Intermediate Driver. When the driver has been installed and i try to dial-up my ISP my machine crashes with BSOD. The following is the detailed crash dump analysis. I am new to WinDBG and so am facing problems on where to begin futher investigation. Any clues would be helpful. Please help. Thanks for your help and time in advance !!! kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9) The IO manager has caught a misbehaving driver. Arguments: Arg1: 00000005, Irql not equal across call to the driver dispatch routine Arg2: ffb96870, the device object associated with the offending driver Arg3: 00000000, the Irql before the call Arg4: 00000002, the Irql after the call Debugging Details: ------------------ DRIVER_VERIFIER_IO_VIOLATION_TYPE: 5 PREVIOUS_IRQL: 0 CURRENT_IRQL: 2 DEVICE_OBJECT: ffb96870 DRIVER_OBJECT: ffb987e0 IMAGE_NAME: mvstdi5x.sys DEBUG_FLR_IMAGE_TIMESTAMP: 41377210 FAULTING_MODULE: f8e00000 tcpip DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xC9 LAST_CONTROL_TRANSFER: from 80669d06 to 8053331e STACK_TEXT: fc91756c 80669d06 000000c9 00000005 ffb96870 nt!KeBugCheckEx+0x1b fc9175a4 fa4a5ca0 fc9175c8 fa4a9506 ffb96870 nt!IovCallDriver+0xe1 WARNING: Stack unwind information not available. Following frames may be wrong. fc9175ac fa4a9506 ffb96870 81ed4f20 81ed4f20 mvstdi5x+0x6ca0 fc9175c8 fa4a9a41 ffb885f0 ffb96870 81ed4f20 mvstdi5x+0xa506 fc9175e0 fa4a499d ffb885f0 81ed4f20 ffb885f0 mvstdi5x+0xaa41 fc9175f8 fa4a4a42 ffb885f0 81ed4f20 0000000f mvstdi5x+0x599d fc91760c 804e37f7 ffb885f0 81ed4f20 806ed2a4 mvstdi5x+0x5a42 fc91761c 80669cc5 fc91768c 00000044 819a0b48 nt!IopfCallDriver+0x31 fc917640 f8dda544 ff819ef8 ff87d820 f8df398c nt!IovCallDriver+0xa0 fc917664 f8dda391 fc91768c ff819fc8 00000044 netbt!TdiSendDatagram+0x1b8 fc9176a8 f8dde149 ff819ef8 ac190a0f 00000044 netbt!UdpSendDatagram+0x14c fc9176f0 f8de2421 ff819ef8 ff843fb8 00b72de8 netbt!UdpSendNSBcast+0x288 fc917740 f8de2deb 00000000 00000000 81942abb netbt!NbtRegisterName+0x2d6 fc91779c f8df587d fc9177c8 00942ab5 c0a80109 netbt!NbtOpenAddress+0x3f2 fc9177dc f8df57f1 ff713848 82204f20 0000001a netbt!NTOpenAddr+0x95 fc9177fc 804e37f7 ff713848 00204f20 806ed2a4 netbt!NbtDispatchCreate+0x92 fc91780c 80669cc5 82204f30 82204f20 ff879bb8 nt!IopfCallDriver+0x31 fc917830 8057069a ff8e9960 ff866fa0 fc917a10 nt!IovCallDriver+0xa0 fc917910 80571ba0 ff713848 00000000 ff88a870 nt!IopParseDevice+0xa58 fc917948 805674b5 ff8e9960 00000000 ff88a870 nt!IopParseFile+0x46 fc9179d0 8056729a 000002ec fc917a10 00000040 nt!ObpLookupObjectName+0x119 fc917a24 80570b73 00000000 00000000 55ebe000 nt!ObOpenObjectByName+0xeb fc917aa0 80570c42 ff830fe4 c0100000 fc917c20 nt!IopCreateFile+0x407 fc917afc 80570d78 ff830fe4 c0100000 fc917c20 nt!IoCreateFile+0x8e fc917b3c 804de7ec ff830fe4 c0100000 fc917c20 nt!NtCreateFile+0x30 fc917b3c 804dc9b1 ff830fe4 c0100000 fc917c20 nt!KiFastCallEntry+0xf8 fc917be0 f8d6ba3f ff830fe4 c0100000 fc917c20 nt!ZwCreateFile+0x11 fc917c44 f8d80088 ff830fa4 e14bb690 ff830fcc rdbss!RxTdiOpenAddress+0x80 fc917c80 f8d2bded ff830fcc ff830fa4 fc917cbc rdbss!RxCeBuildAddress+0xb6 fc917ce4 f8d29a91 fc917cfc ff81ee70 ff9aa8d0 mrxsmb!MRxSmbpBindTransportCallback+0x11d fc917d10 fc77dc62 00000001 00000009 ff9a3c28 mrxsmb!MRxSmbPnPBindingHandler+0x11f fc917d34 fc77e2e8 fc77f208 ff81ee70 00000001 TDI!TdiNotifyPnpClientList+0x164 fc917d58 fc77c3e4 fc77f220 00954d68 fc77f230 TDI!TdiExecuteRequest+0x382 fc917d74 804e426b ff954d68 00000000 81a88b30 TDI!CTEpEventHandler+0x32 fc917dac 8057be15 fc77f220 00000000 00000000 nt!ExpWorkerThread+0x100 fc917ddc 804fa4da 804e4196 00000001 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 FOLLOWUP_IP: mvstdi5x+6ca0 fa4a5ca0 5d pop ebp SYMBOL_STACK_INDEX: 2 FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: mvstdi5x+6ca0 MODULE_NAME: mvstdi5x STACK_COMMAND: kb FAILURE_BUCKET_ID: 0xC9_mvstdi5x+6ca0 BUCKET_ID: 0xC9_mvstdi5x+6ca0 Followup: MachineOwner --------- BR Sukhvinder Tag: making a keylogger from keyboard filterdriver Tag: 67663
  - 13
    - Unplug the usb power cause a system crash in winxp+sp2 I made a bda driver for our usb box. It seems working well until I unplug the power wire when it running in winxp+sp2.(it saids that it did not crash in win2k or winxp+sp1, so strange.) In the read data routine, I insert the irp to a list and in the complete routine I remove it from the list. Like this: (I simply use the global variables.) Insert: --8<---------------cut here---------------start------------->8--- KeAcquireSpinLock(&g_ks_pl, &g_old_pk_irql); InsertTailList(&g_irp_list, &p_irp->Tail.Overlay.ListEntry); KeReleaseSpinLock(&g_ks_pl, g_old_pk_irql); status = IoCallDriver(p_devobj, p_irp); --8<---------------cut here---------------end--------------->8--- Removal: --8<---------------cut here---------------start------------->8--- KeAcquireSpinLock(&g_ks_pl, &old_irql); if (IsListEmpty(&g_irp_list)) { KeReleaseSpinLock(&g_ks_pl, old_irql); return FALSE; } RemoveHeadList(&g_irp_list); KeReleaseSpinLock(&g_ks_pl, old_irql); --8<---------------cut here---------------end--------------->8--- After I unplug the power of the usb, winxp+sp2 would crash in usbport.sys. I commented out these codes, then unplug the power, no crash. I did not test the status of the irp, because I thought it was useless. I simply insert the irp to the queue and remove it after it completed. Could some one tell me what's wrong with my code? Advance thanks! Tag: making a keylogger from keyboard filterdriver Tag: 67659
  - 14
    - Printer language monitor gets an error durring driver installation I have created a simple print language monitor which is having installation problems. When I try to install the driver I get the error "Printer driver was not installed. The specified print monitor does not have the required functions." I have gone through the DDK documentation and to the extent of my knowledge I have defined all of the required functions and returned them in a MONITOR2 structure. Does anyone know what is causing this error. Here is the code that I think is relevant to this problem, if you need anything else, I can post it too. My computer is running Windows XP SP2. //Structure to hold pointers to all the functions MONITOR2 pfn = { sizeof(MONITOR2), NULL, NULL, OpenPortEx, // OpenPortEx StartDocPort, // StartDoc WritePort, // WritePort ReadPort, // ReadPort EndDocPort, // EndDoc ClosePort, // ClosePort NULL, NULL, NULL, NULL, GetPrinterDataFromPort, NULL, NULL, NULL, NULL, NULL, NULL }; //Called by spooler to initiate language mon LPMONITOR2 WINAPI InitializePrintMonitor2(PMONITORINIT pMonitorInit, PHANDLE phMonitor) { //MessageBox(NULL, L"init print mon called", L"PrintPDF", NULL); //Fix size of MONITOR2 if it is on win 2k if(IsWin2K()) pfn.cbSize = MONITOR2_SIZE_WIN2K; return &pfn; } -WBuik Tag: making a keylogger from keyboard filterdriver Tag: 67657
  - 15
    - How to generate CLASSGUID and PCMCIA device ID to write in the INF file Hi everybody, Iam writing Win 2k PNP drivers for PCMCIA 16 bit PC card. In that process, Iam trying to write .INF file, But I have two doubts in preparing that file. 1. What is CLASS GUID. How it can be generated.I saw some examples INF files in my system.In each file I observed "CLASS GUID". What is the procedure to generate CLASS GUID? 2. "PCMCIA\Manufacturer-Product-NNNN" NNNN is a four digit Hex code. I can write Manufcaturer ID and Product ID. But I was not able to create the four digit hex code. I used DTPL.exe to generate PCMCIA unique device id. I executed DTPL with our card CIS file as input. But It is not generating the device ID and displays as ... "Device ID cannot be created for the PC card" What could be the reason? Is there any problem in the CIS information or due to any other problem this message may come? Please guide me in sovling the above problems. Thank u, Mahender. Tag: making a keylogger from keyboard filterdriver Tag: 67640
  - 16
    - Windows XP x64 crashdump problem I have a SCSI HBA serving as the boot controller in a dual processor hyper-threaded system running WinXP x64 edition. Upon generating a crash via Crash-On-Ctrl-Scroll or the HCT crashdumptest, I have seen proof via WinDbg that the runtime (miniport) driver is still running when the crashdump driver is being loaded. Specifically, I have seen an interrupt generated during crashdump initialization get serviced by the runtime driver. I have also seen the one second timer I have continue to run on the runtime driver. No need to explain what a driver collision like this can do to the hardware. If I disable hyper-threading and one of the processors, the problem goes away. Why isn't crashdump processing disabling the other processors? Thanks Scott Tag: making a keylogger from keyboard filterdriver Tag: 67628
  - 17
    - on windows XP 64 bit platform, IoCallDriver cause system hanging hi All: I am porting a 32bit driver to windows 64 bit platform, my drivers is tow parts, one is a pcmcia ata driver for accessing media; the other is a filter driver for handling s1 s3 s4 power status, which is hook on pcmica bus drivers and my function driver. my drivers works well on windows xp 32 bit, but system resuming from hibernating(s4), sometimes after cover the progress of resuming, the system is hung.I traced my drivers, found that, after filter driver calling IoCallDriver, the system is hung. the following source code is for reading/writing register instead of HalGetBusData or HalGetBusOffset which are obsolete. ULONG ReadDWord( PDEVICE_OBJECT DeviceObject, USHORT Offset ) { ULONG RawData = 0; MBXConfigRegisterBufferRead( DeviceObject, &RawData, Offset&0xFC, sizeof(ULONG) ); return RawData; } NTSTATUS MBXConfigRegisterBufferRead( PDEVICE_OBJECT DeviceObject, // target device object PVOID buffer, //the read buffer ULONG offset, //buffer offset ULONG Length //the length of buffer ) { PIRP pIrp = NULL; KEVENT event; NTSTATUS status; PIO_STACK_LOCATION stack = NULL; PDEVICE_OBJECT AttachedPDO = NULL; IO_STATUS_BLOCK ioSattus; PDEVICE_EXTENSION pdx = NULL ; ULONG Transferred; pdx =(PDEVICE_EXTENSION)DeviceObject->DeviceExtension; KdPrint((" Enter MBXConfigRegisterBufferRead \n")); if( KeGetCurrentIrql() < DISPATCH_LEVEL ) { KdPrint(("KeGetCurrentIrql() < DISPATCH_LEVEL\n")); RtlZeroMemory( buffer,Length); KeInitializeEvent( &event, NotificationEvent, FALSE ); // //get the pdo of function 0! // AttachedPDO = pdx->NextLowerDriver;//LowerDeviceObject; if( NULL == AttachedPDO ) { KdPrint(("Error! The AttachedPDO is NULL")); return STATUS_UNSUCCESSFUL; } // //allocate a irp for next stack. // KdPrint(("Begin to build IRP \n")); pIrp = IoBuildSynchronousFsdRequest ( IRP_MJ_PNP, AttachedPDO, NULL, 0, NULL, &event, &ioSattus ); if ( pIrp == NULL ) { KdPrint(("Failed to build IRP \n")); return( STATUS_INSUFFICIENT_RESOURCES ); } //get the next pci stack! stack = IoGetNextIrpStackLocation( pIrp ); // Fill the IRP pIrp->IoStatus.Status = STATUS_NOT_SUPPORTED; stack->MajorFunction = IRP_MJ_PNP; stack->MinorFunction = IRP_MN_READ_CONFIG; stack->Parameters.ReadWriteConfig.WhichSpace = 0; stack->Parameters.ReadWriteConfig.Buffer = buffer; stack->Parameters.ReadWriteConfig.Offset = offset; stack->Parameters.ReadWriteConfig.Length = Length; // // this step will call the function 0 of pcmcia bus driver. // KdPrint(("Begin to send IRP \n")); status = IoCallDriver( AttachedPDO, pIrp ); KdPrint(("Have sent IRP \n")); if(!NT_SUCCESS(status)) { KdPrint(("iocaller failed!")); } if (status == STATUS_PENDING) { // Wait for completion KdPrint(("Wait the IRP completion \n")); KeWaitForSingleObject( &event, Executive, KernelMode, FALSE, NULL ); status = pIrp->IoStatus.Status; } KdPrint(("Read %x = %x\n",offset, *((PULONG)buffer))); } else { //irp level>=dispatch_level KdPrint(("KeGetCurrentIrql() >= DISPATCH_LEVEL \n")); Transferred = pdx->BusInterfaceStandard.GetBusData( pdx->BusInterfaceStandard.Context, PCI_WHICHSPACE_CONFIG, buffer, offset, Length ); KdPrint(("Read %x = %x\n",offset, *((PULONG)buffer))); if( Transferred == Length ) { KdPrint(("KeGetCurrentIrql() = DISPATCH_LEVEL---success\n")); status = STATUS_SUCCESS; } else { KdPrint(("KeGetCurrentIrql() = DISPATCH_LEVEL---failed\n")); status = STATUS_UNSUCCESSFUL; } } KdPrint((" Exit MBXConfigRegisterBufferRead\n")); return status; } thanks best regards Leon Tag: making a keylogger from keyboard filterdriver Tag: 67617
  - 18
    - Receive send packet Hi All, I have the following scenario: A virtual Miniport driver that indicate a receive packet whenever a send command is issued, in order to receive a send packet by the stack. A protocol driver binds to this Miniport driver to send and receive packets from a user-mode application (via IOCTRL). This work if a packet is read from the Miniport driver by the protocol driver that is receive by the stack via a real network adapter. But if a write packet is issued from the user-mode application a send packet is commanded to the Miniport the packet is looped-back and indicated as a received packet, then the stack receives the packet as well as the protocol driver. This is because the protocol driver is bind to the Miniport and receives all packets from the Miniport. So how can I change this to not receive my own send packets but still receive those coming from the stack? Thanks. Tag: making a keylogger from keyboard filterdriver Tag: 67615
  - 19
    - VideoPortInt10 Hi Shatskih, Our driver is simple kernel mode driver and I need to call VideoPortInt10().But this function requires first argument which I don't know how to get.What I study is display driver is transparent to other drivers and only filter driver/mini port drivers can call that function. Please tell me how to call this function from a simple kernel mode driver. thanks in advance, Krishna Tag: making a keylogger from keyboard filterdriver Tag: 67614
  - 20
    - LPD service in Windows XP rejecting spool job from Mac We are facing a problem while printing from Mac to Windows XP using LPD service. Windows is getting the print job control file and removing immediately. We trace the problem and found the reason. Mac is sending 1TeraByte as Spool job length. Can we get any patch to solve the problem in windows xp LPD service? Is there any solution to solve this problem? Any pointers are appreciated. Tag: making a keylogger from keyboard filterdriver Tag: 67613
  - 21
    - The address of a data from a virtual disk Hi experts: sorry for my pool english. i've changed the filedisk.sys and add the encrypt function. but i want to get the data's physical address on the virtual disk which is mounted with filkdisk. i don't know how. in the MajorFunction case of IRP_MJ_READ, i need the buffers's physical address on the virtual disk. thanks for all replyers Tag: making a keylogger from keyboard filterdriver Tag: 67612
  - 22
    - Whats wrong with my Old driver? I have changed INF file of general\portio driver which is shipped with XP DDK. I have just just changed the ports configuration in INF file for accessing the ECP (LPT1) printer port of my machine though before installation I manually changed system assigned resources of ECP (LPT1) port which were assigned by OS to avoide any confilict. CHANGES that I've made in INF file to drive the ECP port by genport.sys [PortIO.LC0] ConfigPriority=DESIRED IOConfig=378-37b(3ff::) ; 10 bit decode ranging from 378 - 37B Now every thing works fine as far as I'm using genport.sys to read\write the printer port but don't know why my existing driver is not working any more , any idea? My old driver use same port addresses. Tag: making a keylogger from keyboard filterdriver Tag: 67591
  - 23
    - Create bsod from user mode? Is there any user-mode equivalent of KeBugCheck, or some other way of causing a user-mode BSOD with a code that won't be easily confused with anything else (like 0xE2)? I have a hard-to-reproduce boot problem with a ps/2 keyboard filter driver. If everything is OK then I have a user-mode app restart the machine. If/when I can repro the problem I want something in user mode that'll cause me to drop into Windbg. (I know causing int3 will do it if I boot with /debug in boot.ini, but because the machine runs unattended and reboots every 5 minutes I wanted to try and use /crashdebug instead, so that when it goes wrong I only get the info relevant to the boot that fails) Tag: making a keylogger from keyboard filterdriver Tag: 67587
  - 24
    - Display "New hardware" wizard on an orphanded device programmatically We have situations where the user selects "cancel" on the new hardware wizard dialogs before the driver is completely installed (apparently they get confused or something.) The driver files have been pre-installed using SetupCopyOEMInf. This is a USB device and if they unplug and re-plug the device in the wizard comes up again and works fine (at least on XP where I'm testing.) Is there a way to do this from a program? I can detect the device on the bus and that it wasn't setup correctly. Now I want to "reinstall" the device to set it up correctly. If I right click in the device manager it displays the new hardware wizard. I want to do this from my application, just cause the new hard found dialog to appear and again and do its normal thing. Any way to do this? Thanx! Tag: making a keylogger from keyboard filterdriver Tag: 67586
  - 25
    - PC Card and slve mode DMA Hi all, Is it possible to use slave mode DMA with 16 bit Pc Card, and if so, is it effective, or are there better ways? Thanks in advance Guy Tag: making a keylogger from keyboard filterdriver Tag: 67575

Hi,
As a project for school i needed to study the DDK.
now we need to make a working driver. now my idea was to adjust the
keyboard filterdriver so it would become a keylogger.
By using a simple program i'd load and unload it so i can determine
when it logs the keystrokes.
The loading and unloading the driver wouldn't really be a big problem.
But as i'm still a big newbe in driver development, i could use a lot
of help for the keylogger thing. Is there anyone that could help me
with this please?
thx a lot in advance,
frotske

Top

RE: making a keylogger from keyboard filterdriver by pavel_a

pavel_a
Thu Aug 11 12:15:06 CDT 2005

"frotske" wrote:
> Hi,
> As a project for school i needed to study the DDK.
> now we need to make a working driver. now my idea was to adjust the
> keyboard filterdriver so it would become a keylogger.
> By using a simple program i'd load and unload it so i can determine
> when it logs the keystrokes.
> The loading and unloading the driver wouldn't really be a big problem.
> But as i'm still a big newbe in driver development, i could use a lot
> of help for the keylogger thing. Is there anyone that could help me
> with this please?
> thx a lot in advance,
> frotske

It's a really exciting school project...
Can you tell please, how we could check that your keylogger is (not) running
on our machines?

--PA

Top

Re: making a keylogger from keyboard filterdriver by frotske

frotske
Wed Aug 17 10:59:43 CDT 2005

Well i'm not sure, but you can check with my school that i'm really
writing a driver for a schoolproject.
You can mail one of the promotors of my thesis at t.dams@ha.be.
sorry for the late response, i've been busy with working.
Thx for the response,
frotske

Top