Is it possible to hook PORT_KEYBOARD_EXTENSION.SysButtonEventDpc via a filter driver?
Posted on 2003-10-31 22:34:14 by comrade
Nope the keyboard and mouse are considered by M$ as devices that do not need filtering.
They do not allow you to virtualize the IRQ used for mouse and keyboard.
The original drivers presented in the DDK ignore such IRPs.
Theoretically you could recompile 8042 and ps2 base drivers from DDK examples but unfortunately they will work only on your machine (without restart-- that is :grin:)

Check the ctrl2caps sample driver on sysinternals maybe it can help you with keyboard a little, at least with it you can convert some keys to other keys
Posted on 2003-11-01 06:33:14 by BogdanOntanu
Yes, I have. Windows (2000 here) only gives you to filter normal keys, not sys buttons (power/sleep/wake). It actually processes them and their actions before passing job on to filter driver. Isn't there any way to simply change pointer to that DPC in PORT_KEYBOARD_EXTENSION? Problem is to get DEVICE_OBJECT of keyboard that i8042prt uses.
I have checked out both ctrl2cap and kbfiltr, and both of them do not receive any notification of system buttons. Actually disabling keyboard (makecode=0) through both examples still leaves the system buttons working!
Posted on 2003-11-01 08:03:36 by comrade
Bogdan?
Posted on 2003-11-01 18:55:08 by comrade
It was a very long time ago that i did such VxD/system work.

AFAIK you will receive hardware scancodes and indeed you can NOT use makecode=0

Instead change it to something beningn like Ctrl as it is done in ctrl2cap

You should study the scancodes emited by the keyboard hardware as they can be pretty annoying
up to 7 codes for a "single" key like PrintScreen, Ctrl+Esc etc and they will not always come in sequence

If i will have the time i will search some old work's sourcecode in order to become more exact in my assumptions...
Posted on 2003-11-02 06:28:02 by BogdanOntanu
You cannot change scancodes of power/sleep/wake buttons, as they are processed in i8042prt and it does even let you filter them. Solution is to hook that DPC routine, which actually shuts down system, or puts in standby depending what sysbutton you pressed.
Posted on 2003-11-02 10:11:22 by comrade