Injecting keyboard scan codes at driver level

Mark Andrews

I am writing a program for a friend who has difficulty using the keyboard. I
would like to create a program that injects scan codes directly into the
keyboard data stream to simulate an actual key press. There are certain
programs he has installed that read the raw keyboard data so the simple Post
Message and Send Input solutions do not work. I must somehow simulate key
presses at the lowest level so that they appear as raw data.

Hardware:
The operating system is XP using a PS/2 keyboard. There is a high
probability that he will upgrade to a USB keyboard and Vista but probably not
at the same time. The program must therefore be compatible with both OS and
both port types.

Ideas:
I have 2 ideas. The first is to create a virtual keyboard in device manager
that Windows sees as a real keyboard. My user program will tell this virtual
keyboard what keys are pressed/released and the device will be read by
Windows/programs as normal. I have found no information on how to do this
so...
My second idea is to create a keyboard filter driver which would append the
scan codes to the keyboard data stream based on data received from the user
program.

How far I have got:
I have no experience with drivers and I’m eager to learn. I have determined
that:
- The driver must be an upper level keyboard class filter driver (simple
registry installation)
- The driver does not need to handle (dis)connection, power or LEDs. It only
injects scan codes
- The driver does not block, read or modify any real keyboard activity – it
lets it all through
- The user program simply sends scan codes to the driver – there is no other
communication (although some result value to let the program know that the
driver responded would be useful)

I have hit a brick wall as I do not know where to begin! I have successfully
built a scan code modifying kbfiltr from the DDK but this is PS/2 lower
level, has complex unnecessary code and has no injection sample code.
Ctrl2Cap sounds interesting but there is no source code available now and the
author states that injection will be difficult to achieve.

While I am fluent in C and programming in general, I understand that this
program will require non-user mode programming and I have zero experience in
this area. This program has a very simple, specific, unobtrusive function but
I’m finding it hard to know where to start. Any advice, links or samples to
help me achieve this goal would be fantastic. Thank you.

Owen Smith

Have a look at the vhidmini and toaster bus sample drivers. This should
allow you to make a HID keyboard driver that is root enumerated. You will
need to create a control object to communictate (you cant open the
keyboard directly)
Although this will create a HID keyboard, the system will combine all the
output into one, so you dont need to worry about writing for both PS/2 and
USB possibilities

On Mon, 22 Oct 2007 12:17:00 +0100, Mark Andrews <Mark
<>> wrote:

> I am writing a program for a friend who has difficulty using the
> keyboard. I
> would like to create a program that injects scan codes directly into the
> keyboard data stream to simulate an actual key press. There are certain
> programs he has installed that read the raw keyboard data so the simple
> Post
> Message and Send Input solutions do not work. I must somehow simulate key
> presses at the lowest level so that they appear as raw data.
>
> Hardware:
> The operating system is XP using a PS/2 keyboard. There is a high
> probability that he will upgrade to a USB keyboard and Vista but
> probably not
> at the same time. The program must therefore be compatible with both OS
> and
> both port types.
>
> Ideas:
> I have 2 ideas. The first is to create a virtual keyboard in device
> manager
> that Windows sees as a real keyboard. My user program will tell this
> virtual
> keyboard what keys are pressed/released and the device will be read by
> Windows/programs as normal. I have found no information on how to do this
> so...
> My second idea is to create a keyboard filter driver which would append
> the
> scan codes to the keyboard data stream based on data received from the
> user
> program.
>
> How far I have got:
> I have no experience with drivers and I’m eager to learn. I have
> determined
> that:
> - The driver must be an upper level keyboard class filter driver (simple
> registry installation)
> - The driver does not need to handle (dis)connection, power or LEDs. It
> only
> injects scan codes
> - The driver does not block, read or modify any real keyboard activity –
> it
> lets it all through
> - The user program simply sends scan codes to the driver – there is no
> other
> communication (although some result value to let the program know that
> the
> driver responded would be useful)
>
> I have hit a brick wall as I do not know where to begin! I have
> successfully
> built a scan code modifying kbfiltr from the DDK but this is PS/2 lower
> level, has complex unnecessary code and has no injection sample code.
> Ctrl2Cap sounds interesting but there is no source code available now
> and the
> author states that injection will be difficult to achieve.
>
> While I am fluent in C and programming in general, I understand that this
> program will require non-user mode programming and I have zero
> experience in
> this area. This program has a very simple, specific, unobtrusive
> function but
> I’m finding it hard to know where to start. Any advice, links or samples
> to
> help me achieve this goal would be fantastic. Thank you.
>



--
Using Opera's revolutionary e-mail client:

Mark Andrews

The problem applications appear to access the keyboard directly. I'm guessing
they access the keyboard via GetRawInputData. Keydown messages and SendInput
are simply ignored. I have tried filling the SendInput structure in various
ways but nothing seems to work. The OSK is a nice idea so I tried it out but
it couldn't send a key to the apps either. Notepad was fine though so I'm
guessing it uses SendInput too?

I guess my question should be: How do I inject a scancode so that
GetRawInputData receives it?

"jrb1400" wrote:

> Hi Mark,
>
> Hopefully there are some easier ways to do this than write a driver.
> Maybe you have looked into these already, but I thought they are
> worth mentioning.
>
> (1) Windows XP already comes with this function
> Start - All Programs - Accessories - Accessibility - On Screen Keyboard
>
> (2) I'd give SendInput() another try. ..

jrb1400

Hi Mark,

Hopefully there are some easier ways to do this than write a driver.
Maybe you have looked into these already, but I thought they are
worth mentioning.

(1) Windows XP already comes with this function - If your friend can move
a mouse, try
Start - All Programs - Accessories - Accessibility - On Screen Keyboard


(2) I'd give SendInput() another try. The wScan field is NOT ignored,
and can be used, even if the flags are not KEYEVENTF_UNICODE. I
had a program that simulated keyboard input and most things worked except
some programs like Remote Desktop Connection that needed the actual scan
codes. This did not work until the wScan field ws filled in.

Hope this helps.
Jay



Sample code:

void key_press (int key) {
INPUT in;
unsigned char vk;
DWORD time;

vk = ... // for my code I converted input from my hardware to
// a virtual Key Code here.

in.type = INPUT_KEYBOARD;
in.ki.wVk = vk;
in.ki.wScan = MapVirtualKey(vk,0); // NOT ignored
// 0 -> VK to Scan Code Conversion
in.ki.dwFlags = 0; // assumes key down
in.ki.time = 0; // system will provide timestamp
in.ki.dwExtraInfo = NULL;


SendInput(1, &in, sizeof(in));
}

Ray Trent

Owen Smith wrote:
> Although this will create a HID keyboard, the system will combine all
> the output into one, so you dont need to worry about writing for both
> PS/2 and USB possibilities

Unless, of course, you care about DirectInput's ability to tell an app
which device a key came from, then you'll need to make it a keyboard
filter and install it on the kbd class.
--
Ray

Mark Andrews

The problem applications appear to access the keyboard directly. I'm guessing
they access the keyboard via GetRawInputData. Keydown messages and SendInput
are simply ignored. I have tried filling the SendInput structure in various
ways but nothing seems to work. The OSK is a nice idea so I tried it out but
it couldn't send a key to the apps either. Notepad was fine though so I'm
guessing it uses SendInput too?

I guess my question should be: How do I inject a scancode so that
GetRawInputData receives it?

"jrb1400" wrote:

> Hi Mark,
>
> Hopefully there are some easier ways to do this than write a driver.
> Maybe you have looked into these already, but I thought they are
> worth mentioning.
>
> (1) Windows XP already comes with this function
> Start - All Programs - Accessories - Accessibility - On Screen Keyboard
>
> (2) I'd give SendInput() another try. ..

Ray Trent

jrb1400 wrote:
> (2) I'd give SendInput() another try. The wScan field is NOT ignored,
> and can be used, even if the flags are not KEYEVENTF_UNICODE. I

I used to be a big advocate of "just use SendInput". Alas, Vista has put
an end to that (or perhaps that should be "hooray" :-).

SendInput doesn't send keystrokes to elevated apps (unless sent from an
elevated app, or one with a manifest setting uiAccess=TRUE... both of
which are either a hassle or bug-ridden and better avoided), or session
0 dialogs (in any way, AFAICT, unless perhaps you call it from a service).

A keyboard class/device filter driver or HID keyboard mini-driver will
work in all cases, at least until Palladium comes around again :-).
--
Ray

Doron Holan [MSFT]

as a hid miniport you cannot create a control device object. you have a
couple of alternatives
1) report a fake new HID TLC in your hid descriptor that is used as a
control channel
2) use the WDK 6001 osrfx2hid sample which is really a full blown KMDF
driver using a HID miniport that is purely pass through. at that point, you
can create a control device (not recommended) or enumerate a raw PDO (see
the kmdf kbdfiltr example on how to do that) to talk with user mode

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"Owen Smith" <nospam.osmith@saitek.com.nospam> wrote in message
newsp.t0lu1qbu39p9aw@oas-core2...
> Have a look at the vhidmini and toaster bus sample drivers. This should
> allow you to make a HID keyboard driver that is root enumerated. You will
> need to create a control object to communictate (you cant open the
> keyboard directly)
> Although this will create a HID keyboard, the system will combine all the
> output into one, so you dont need to worry about writing for both PS/2 and
> USB possibilities
>
> On Mon, 22 Oct 2007 12:17:00 +0100, Mark Andrews <Mark
> <Andrews@discussions.microsoft.com>> wrote:
>
>> I am writing a program for a friend who has difficulty using the
>> keyboard. I
>> would like to create a program that injects scan codes directly into the
>> keyboard data stream to simulate an actual key press. There are certain
>> programs he has installed that read the raw keyboard data so the simple
>> Post
>> Message and Send Input solutions do not work. I must somehow simulate key
>> presses at the lowest level so that they appear as raw data.
>>
>> Hardware:
>> The operating system is XP using a PS/2 keyboard. There is a high
>> probability that he will upgrade to a USB keyboard and Vista but
>> probably not
>> at the same time. The program must therefore be compatible with both OS
>> and
>> both port types.
>>
>> Ideas:
>> I have 2 ideas. The first is to create a virtual keyboard in device
>> manager
>> that Windows sees as a real keyboard. My user program will tell this
>> virtual
>> keyboard what keys are pressed/released and the device will be read by
>> Windows/programs as normal. I have found no information on how to do this
>> so...
>> My second idea is to create a keyboard filter driver which would append
>> the
>> scan codes to the keyboard data stream based on data received from the
>> user
>> program.
>>
>> How far I have got:
>> I have no experience with drivers and I’m eager to learn. I have
>> determined
>> that:
>> - The driver must be an upper level keyboard class filter driver (simple
>> registry installation)
>> - The driver does not need to handle (dis)connection, power or LEDs. It
>> only
>> injects scan codes
>> - The driver does not block, read or modify any real keyboard activity –
>> it
>> lets it all through
>> - The user program simply sends scan codes to the driver – there is no
>> other
>> communication (although some result value to let the program know that
>> the
>> driver responded would be useful)
>>
>> I have hit a brick wall as I do not know where to begin! I have
>> successfully
>> built a scan code modifying kbfiltr from the DDK but this is PS/2 lower
>> level, has complex unnecessary code and has no injection sample code.
>> Ctrl2Cap sounds interesting but there is no source code available now
>> and the
>> author states that injection will be difficult to achieve.
>>
>> While I am fluent in C and programming in general, I understand that this
>> program will require non-user mode programming and I have zero
>> experience in
>> this area. This program has a very simple, specific, unobtrusive
>> function but
>> I’m finding it hard to know where to start. Any advice, links or samples
>> to
>> help me achieve this goal would be fantastic. Thank you.
>>
>
>
>
> --
> Using Opera's revolutionary e-mail client:

adischlesinger

I am trying to achieve the same thing. Did anybody put together a solution that he could share?

Thanks,
Adrian