Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Yes it is.</p> <p>CTRL+ALT+DEL, known as the <a href="http://en.wikipedia.org/wiki/Secure_attention_key" rel="nofollow">Secure Attention Sequence (SAS)</a>, can't be intercepted through the common Global Windows Hook mechanism though.</p> <p>The option you have to intercept SAS that I know of, not mattering the situation, is just one: a driver.</p> <p>But it doesn't need to be a full blown device driver, it can be a simpler one known as a filter driver. You'll need to learn how to do kernel development which is not so trivial and will require you to do, for example, kernel debugging with two machines. If you expect to use your driver at other machines with newer Windows, you'll need to sign your driver since Windows Vista x64 and newer will not load non-signed drivers, only the x86 version of these operating systems are allowed to do it. And you'll get the risk of getting some funny BSOD in the way.</p> <p>The official microsoft sample for a keyboard filter driver is the <a href="http://msdn.microsoft.com/en-us/site/ff542312" rel="nofollow">kbfiltr</a> sample.</p> <p>Now, there's a much simpler way to circumvent all of this: use some library that communicates with a driver to do all this dirty work. And this is what I have tried to do.</p> <p>I've developed a library, which I call <a href="http://oblita.com/Interception" rel="nofollow">Interception</a>, that allows one to, well..., <em>intercept</em> device input from a common user mode program while using the powers of a device driver. It's a small and simple C api that internally communicates with drivers which I've properly signed.</p> <p>You must use an <a href="https://github.com/oblitum/Interception/releases/latest" rel="nofollow">installer</a> to install the drivers at your system before using the API.</p> <p>At my web site there's already a sample for SAS interception and you can also check it out <a href="https://github.com/oblitum/Interception/blob/master/samples/cadstop/cadstop.cpp" rel="nofollow">here</a>, at github. I'll leave it here for reference:</p> <pre><code>#include &lt;iostream&gt; #include &lt;utils.h&gt; #include &lt;interception.h&gt; using namespace std; namespace scancode { enum { esc = 0x01, ctrl = 0x1D, alt = 0x38, del = 0x53, }; } InterceptionKeyStroke ctrl_down = {scancode::ctrl, INTERCEPTION_KEY_DOWN , 0}; InterceptionKeyStroke alt_down = {scancode::alt , INTERCEPTION_KEY_DOWN , 0}; InterceptionKeyStroke del_down = {scancode::del , INTERCEPTION_KEY_DOWN | INTERCEPTION_KEY_E0, 0}; InterceptionKeyStroke ctrl_up = {scancode::ctrl, INTERCEPTION_KEY_UP , 0}; InterceptionKeyStroke alt_up = {scancode::alt , INTERCEPTION_KEY_UP , 0}; InterceptionKeyStroke del_up = {scancode::del , INTERCEPTION_KEY_UP | INTERCEPTION_KEY_E0 , 0}; bool operator==(const InterceptionKeyStroke &amp;first, const InterceptionKeyStroke &amp;second) { return first.code == second.code &amp;&amp; first.state == second.state; } bool shall_produce_keystroke(const InterceptionKeyStroke &amp;kstroke) { static int ctrl_is_down = 0, alt_is_down = 0, del_is_down = 0; if (ctrl_is_down + alt_is_down + del_is_down &lt; 2) { if (kstroke == ctrl_down) { ctrl_is_down = 1; } if (kstroke == ctrl_up ) { ctrl_is_down = 0; } if (kstroke == alt_down ) { alt_is_down = 1; } if (kstroke == alt_up ) { alt_is_down = 0; } if (kstroke == del_down ) { del_is_down = 1; } if (kstroke == del_up ) { del_is_down = 0; } return true; } if (ctrl_is_down == 0 &amp;&amp; (kstroke == ctrl_down || kstroke == ctrl_up)) { return false; } if (alt_is_down == 0 &amp;&amp; (kstroke == alt_down || kstroke == alt_up)) { return false; } if (del_is_down == 0 &amp;&amp; (kstroke == del_down || kstroke == del_up)) { return false; } if (kstroke == ctrl_up) { ctrl_is_down = 0; } else if (kstroke == alt_up) { alt_is_down = 0; } else if (kstroke == del_up) { del_is_down = 0; } return true; } int main() { InterceptionContext context; InterceptionDevice device; InterceptionKeyStroke kstroke; raise_process_priority(); context = interception_create_context(); interception_set_filter(context, interception_is_keyboard, INTERCEPTION_FILTER_KEY_ALL); while (interception_receive(context, device = interception_wait(context), (InterceptionStroke *)&amp;kstroke, 1) &gt; 0) { if (!shall_produce_keystroke(kstroke)) { cout &lt;&lt; "ctrl-alt-del pressed" &lt;&lt; endl; continue; } interception_send(context, device, (InterceptionStroke *)&amp;kstroke, 1); if (kstroke.code == scancode::esc) break; } interception_destroy_context(context); return 0; } </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload