-2

I coded a small KeyMapper some month ago which was used on my desktop-PC and Notebook (PC: Win7 x64, Notebook: Win8.1 x64). It was always working flawless untill i decided to reinstall Windows on my main PC (from Win7 64bit to (again) Win7 x64).

So here is the code:

private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
{
    if (nCode >= 0)
    {
        if ((int)wParam == WM_MOUSEMOVE)
        {
            var hookStruct = (MSLLHOOKSTRUCT)Marshal.PtrToStructure(lParam, typeof(MSLLHOOKSTRUCT));
            Debug.WriteLine("dwExtraInfo: " + hookStruct.dwExtraInfo);

            // block all MouseEvents with dwExtraInfo not IntPtr(555)
            try
            {
                if (hookStruct.dwExtraInfo != new IntPtr(555))
                    return new IntPtr(1);
            }
            catch (Exception ex){ }                     
        }
    }
    // let all other mousemessages pass
    return CallNextHookEx(_hookID, nCode, wParam, lParam);
}

As you see i am filtering all MouseMoveMessages. My SendInput function sends custom MouseMoveMessages with ExtraInfo set to a random value (here 555) which should pass this filter.

INPUT[] iMM = new INPUT[1]
iMM[0].type = InputType.INPUT_MOUSE;
iMM[0].mkhi.mi.dx = 500;  // example
iMM[0].mkhi.mi.dy = 500;  // example
iMM[0].mkhi.mi.mouseData = 0;
iMM[0].mkhi.mi.dwFlags = (MOUSEEVENTF.MOVE | MOUSEEVENTF.ABSOLUTE);
iMM[0].mkhi.mi.time = 0;                                                   
iMM[0].mkhi.mi.dwExtraInfo = new IntPtr(555);

// Install MouseHook
LowLevelMouseProc _proc = HookCallback;
_hookID = SetWindowsHookEx(WH_MOUSE_LL, _proc, GetModuleHandle("user32"), 0);

// send MouseMessage
SendInput(1, iMM, Marshal.SizeOf(new INPUT()));

Whats going wrong: After the reinstall of Win7 64-bit dwExtraInfo is totally screwed, it shows values like -11054848 (when defined as IntPtr) and 4283912448 (when defined as UIntPtr). Please note that it was working for months before the reinstall and is still working in my Notebook.

I already tested the size of all objects (INPUT-struct, MSLLHOOKSTRUCT, dwExtraInfo...) but they are exactly the same on both machines. Target Platform is x86, Framework is 4.0.

On my Notebook (Win8.1 x64) everything is still working as intended, SendInput sends MouseMove messages which gets catched off and filtered by the LowLevelHook. dwExtraInfo is 555.

Maric Slorat
  • 67
  • 2
  • 12

1 Answers1

2

The general strategy to starting solving a problem like this is to convert the magic number to hex. You get 0xFF575100. Which is a number that Google really likes, it takes you straight to this MSDN Forums post.

Long story short, you acquired a broken security patch, MS14-039. Identified by a PenPower engineer:

After update KB2973201, Windows will return "0XFF575100" and mouse does not work properly
dwExtraInfo = 0XFF575100

Microsoft released a fix for the problem, described here. If you still have trouble and then follow-up at superuser.com or contact Microsoft Support directly.

Hans Passant
  • 922,412
  • 146
  • 1,693
  • 2,536
  • thanks for the enlightenment but unfortunately this does not work http://gyazo.com/72dfb7633a1d6f31cece781a9174130a ("Update KB2973201 is not installed") as i already deinstalled it (+reboot). – Maric Slorat Sep 02 '14 at 22:14
  • 4 billion numbers don't have a lot of accidental matches. *Especially* not after you reinstall the OS. This answer is 99.999999976% accurate. Not nearly the same odds for getting that hotfix installed properly, pick up the phone to get the help you need. – Hans Passant Sep 02 '14 at 22:22
  • looks like Windows doesn't like to deinstall updates. The hotfix did not remove the broken patch, it was still there after reboot. After manually removing the patch and rebooting it was gone but the problem stayed. So i installed all pending windows updates, rebooted, manually removed KB2973201 again and rebooted again. Now dwExtraInfo is working as intended. Just make sure to hide/deactivate KB2973201 in windows update so it won't get installed again. Thanks Hans. It would be great if this community would be a bit more friendly to new members though. – Maric Slorat Sep 02 '14 at 23:01
  • 2
    It would be great if this web site had questioners that didn't bitch at the help they got. I can only wish. – Hans Passant Sep 02 '14 at 23:27
  • Update: this answer is not complete. Problem was back even with hotfix installed and broken patch deinstalled. I found that if you start up your PC with the tablet connected then dwExtraInfo is still broken, if you plug in your tablet AFTER your PC started then it's working. I was able to pinpoint the culprit. TabletPCInputService (windows services) causes this (even without the broken patch), just deactivate it and you can start with your tablet connected just fine. – Maric Slorat Sep 03 '14 at 15:51