How to hook windows keyboard ISR?

Question

I am trying to hook keyboard ISR with my code below but I cannot because DeviceIoControl API returns ERROR_INVALID_FUNCTION. Here is my code:

invoke DefineDosDevice,[raw],filename1,devicename
    lea     rcx,[filename2]
    invoke  CreateFileA,rcx,GENERIC_WRITE,0,0,OPEN_EXISTING,0,0
    MOV [HI8042KBDHOOKISR],RAX
    MOV RAX,0
    MOV RCX,sizeof._INTERNAL_I8042_START_INFORMATION
    LEA RDI,[INTERNAL_I8042_START_INFORMATION]
    REP STOSB
    MOV RCX,sizeof._INTERNAL_I8042_START_INFORMATION
    MOV [INTERNAL_I8042_START_INFORMATION.Size1],RCX
    invoke DeviceIoControl,[HI8042KBDHOOKISR],[Intel8042],INTERNAL_I8042_START_INFORMATION,sizeof._INTERNAL_I8042_START_INFORMATION,INTERNAL_I8042_START_INFORMATION,sizeof._INTERNAL_I8042_START_INFORMATION,NIL,0
    LEA RBX,[MYKBDISR]
    MOV [INTERNAL_I8042_START_INFORMATION.InterruptObject],RBX
    RET
MYKBDISR:
CALL GET_SCANCODE
...

section '.data' data writeable readable

devicename       db '\Device\KeyboardClass0',0
filename1        db 'keyboard',0
filename2        db '\\.\keyboard',0
filename3        db '\\.\Keybd',0
raw              dq 1
HI8042KBDHOOKISR dq 0
NIL              dq 0
Intel8042        dq 0B3FCFh

See the code and answer me: where I am wrong in the code above? Why DeviceIoControl returns ERROR_INVALID_FUNCTION?

score 0 · Answer 1 · edited Jun 20 '20 at 09:12

IOCTL_INTERNAL_I8042_KEYBOARD_START_INFORMATION this is internal device io control code (IRP_MJ_INTERNAL_DEVICE_CONTROL). this kind of control can not be send by DeviceIoControl (it send only IRP_MJ_DEVICE_CONTROL) and at all from user mode. and interrupt can not be handled in user mode too. also are you read this:

I8042prt sends this request synchronously to the top of the device stack after the keyboard interrupt object is created.

so - not you must send this request, but visa versa - you must be filter driver, attached to keyboard device. and handle this request

How to hook windows keyboard ISR?

1 Answers1