How lock CTRL+ALT+DEL using SetWindowHookEx api?

Question

Good afternoon,

I need lock CTRL+ALT+DEL combination using SetWindowsHookEx and today i have done a code and don't is working until now.

This code is executing in a dll ( this dll is my software ) that is injected in other process.

So, how i can adapt this code below to work?

const
WH_KEYBOARD_LL = 13;
LLKHF_ALTDOWN = $20;

type
KBDLLHOOKSTRUCT = record
vkCode: DWORD;
scanCode: DWORD;
flags: DWORD;
time: DWORD;
dwExtraInfo: Longint ;
end;

var
hhkLowLevelKybd : HHOOK;
FoldProc : LongInt;
hSASWnd : HWND;
hThread : Cardinal;

{$R *.dfm}

Function LowLevelKeyboardProc(nCode : Integer; wParam : Longint; var LParam: KBDLLHOOKSTRUCT) : Longint; stdcall;
var
fEatKeystroke : Boolean;
dwThreadId : Cardinal;
begin

If (nCode = HC_ACTION) Then
begin
If (wParam = WM_KEYDOWN) Or
(wParam = WM_SYSKEYDOWN) Or
(wParam = WM_KEYUP) Or
(wParam = WM_SYSKEYUP) Then
begin
fEatKeystroke :=
(((GetKeyState(VK_CONTROL) And $8000) <> 0) And
((LParam.flags And LLKHF_ALTDOWN ) <> 0) And
 (LParam.vkCode = VK_DELETE));

End;

If fEatKeystroke Then
Result := -1
Else
Result := CallNextHookEx(0, nCode, wParam, LongInt(@LParam));
End;

end;

////////// FormCreate event here ///////////

hhkLowLevelKybd := 0;
hhkLowLevelKybd := SetWindowsHookEx(WH_KEYBOARD_LL, @LowLevelKeyboardProc,
HInstance, 0);

end.

Windows does not allow you to intercept that key combination. In earlier versions it was possible, but recent versions handle that key combination at a lower level that cannot be blocked. It's a security issue. Related: http://stackoverflow.com/q/17103682/62576 — Ken White, Nov 12 '16 at 20:49
See also [Set up a device for anyone to use (kiosk mode)](https://technet.microsoft.com/sv-se/itpro/windows/manage/set-up-a-device-for-anyone-to-use). — LU RD, Nov 12 '16 at 21:17
The easiest way is to remove one of those 3 keys from the keyboard. — Jerry Dodge, Nov 12 '16 at 21:32
It's the secure attention sequence. Once you read about it you will understand why you can't hook it. — David Heffernan, Nov 12 '16 at 21:36

Ken White · Accepted Answer · 2016-11-12T21:55:18.273

Windows does not allow you to intercept Ctrl+Alt+Del for security reasons. Earlier versions (pre-Vista?) used to allow it by replacing the GINA DLL, but it's not been allowed for years.

That key combination is known as a secure attention sequence which is guaranteed to be trustworthy as part of the login process.

If your goal is to only allow your application to be run, you can configure it to act in kiosk mode if you're running a suitable version of Windows, as shown in Set up a device for anyone to use (kiosk mode) at TechNet which @LURD kindly provided.

Remko · Answer 2 · 2016-11-13T11:48:59.147

0

By design it's impossible to trap or block Ctrl+Alt+Del (The Secure Attention Sequence). There is however a commercial library available (disclaimer: I am the author), SasLibEx.

SasLibEx: a library that can simulate or block the Secure Attention Sequence (Ctrl+Alt+Del) but it can even unlock a workstation or session without entering or needing the user’s credentials (and many more things)

See this screencast for a demo.

edited Nov 13 '16 at 11:48

answered Nov 13 '16 at 10:59

Remko

7,214
2
32
52

i saw that you understand fine about `WinSta and Secure Desktop` and i want that you give a help (if possible) with [this my another question here](http://stackoverflow.com/questions/40098364/how-execute-any-software-in-interactive-desktop-winsta0-from-windows-8-to-10?noredirect=1#comment67807295_40098364) – Nov 13 '16 at 11:44

score 0 · Answer 3 · answered Nov 13 '16 at 23:13

Impossible. The Ctl-Alt-Del gets trapped in the Kernel and never makes it to the user mode space where your app is running. I have had to do this on kiosks systems (using Win XP and Vista) and I did it with a keyboard filter driver (which runs in the kernel) that swaps out the scan codes when the key are pressed.

score 0 · Answer 4 · answered May 03 '18 at 19:37

Not is impossible, see the following code:

program Project1;

{$APPTYPE CONSOLE}
{$R *.res}

uses
  SysUtils,
  Windows,
  Registry,
  vcl.Dialogs;

procedure DisableCtrAltDel(boolState: Boolean);
var
  SystemReg: TRegistry;
  Data: Array [1 .. 48] of Byte;
  i: Byte;
begin
  try

    for i := 1 to 48 do
      Data[i] := $00;

    Data[9] := $09;
    Data[15] := $5B;
    Data[16] := $E0;
    Data[19] := $5C;
    Data[20] := $E0;
    Data[23] := $5D;
    Data[24] := $E0;
    Data[27] := $44;
    Data[31] := $1D;
    Data[35] := $38;
    Data[39] := $1D;
    Data[40] := $E0;
    Data[43] := $38;
    Data[44] := $E0;

    try
      SystemReg := TRegistry.Create;
      with SystemReg do
      begin
        RootKey := HKEY_LOCAL_MACHINE;
        OpenKey('\System\CurrentControlSet\Control\Keyboard Layout', True);

        if boolState then

          WriteBinaryData('Scancode Map', Data, SizeOf(Data))
        else
          DeleteValue('Scancode Map');

        MessageDlg('Restart Windows in order the changes to take effect!',
          mtInformation, [mbOK], 0);
        CloseKey;
      end;
    finally
      SystemReg.Free;
    end;
  except
    MessageDlg
      ('Error occurred while trying to disable ctrl+alt+del and Task Manager',
      mtWarning, [mbOK], 0);
  end;
end;

begin
  try
    DisableCtrAltDel(True);
  except
    on E: Exception do
      Writeln(E.ClassName, ': ', E.Message);
  end;

end.

Reference

How lock CTRL+ALT+DEL using SetWindowHookEx api?

4 Answers4