How to detect if a process has moved the mouse cursor and not the user?

Question

It is possible to move the mouse calling the mouse_event function or by using System.Windows.Forms.Cursor.Position property. What I want to know is, if it's possible to know if a user using my software is using one of these methods or not.

I know it is possible to check the users mouse movement and, for example, see if it happened too quick or not. But I'm wondering if there are other more accurate ways, like checking if a certain WinApi function is being called or not.

When a mouse is moved physically, is it mouse_event function that gets triggered?

Or does the call to the mouse_event function makes another system call and calls the actual function the 'physical mouse move' uses?

Answer 1

I don't think that be warned if another process changed the cursor position by code and that is not the user that moved it is possible unless some WinAPI to move it by code has an event that can be registered.

I tested that if a code change the cursor position, no MouseMove is raised on a WinForm or by using a global hook.

So using GetLastInputInfo does not work and it seems that you can't detect if a process has changed the move position.

That said, you can use a timer with this MouseMove global hook.

https://www.codeproject.com/Articles/7294/Processing-Global-Mouse-and-Keyboard-Hooks-in-C

• On app start you will save the mouse position as previous.

• You start a timer having interval 100ms for example.

• On MouseMove you will update this previous position and set a conditional variable to true.

• On the timer tick, you will get the current position and compare it to previous and the conditional variable: if it is not the same, it is not the user that moves.

It is heavy but that works.

If the user moves the mouse same time a process, you will only get that it is the user that moves.

Using a WinForms Timer

public partial class FormTest : Form
{

  Point PreviousMousePosition;
  bool UserMovedMouse;

  public FormTest()
  {
    InitializeComponent();
    PreviousMousePosition = Cursor.Position;
    TimerCheckMouseMove.Start();
    TimerMoveMouse.Start();
    HookManager.MouseMove += HookManager_MouseMove;
  }

  private void HookManager_MouseMove(object sender, MouseEventArgs e)
  {
    PreviousMousePosition = Cursor.Position;
    UserMovedMouse = true;
  }

  private void TimerCheckMouseMove_Tick(object sender, EventArgs e)
  {
    TimerCheckMouseMove.Enabled = false;
    try
    {
      var pos = Cursor.Position;
      if ( !UserMovedMouse && pos != PreviousMousePosition)
        MessageBox.Show("Mouse moved by a process");
      PreviousMousePosition = Cursor.Position;
      UserMovedMouse = false;
    }
    finally
    {
      TimerCheckMouseMove.Enabled = true;
    }
  }

  private void TimerMoveMouse_Tick(object sender, EventArgs e)
  {
    Cursor.Position = new Point(100, 100);
  }

}

Using a threaded timer

System.Threading.Timer TimerCheckMouseMove;

TimerCheckMouseMove = new System.Threading.Timer(TimerCheckMouseMove_Tick, null, 0, 100);

private bool TimerCheckMouseMoveMutex;

private void TimerCheckMouseMove_Tick(object state)
{
  if ( TimerCheckMouseMoveMutex ) return;
  TimerCheckMouseMoveMutex = true;
  try
  {
    var pos = Cursor.Position;
    if ( !UserMovedMouse && pos != PreviousMousePosition)
      MessageBox.Show("Mouse moved by a process");
    PreviousMousePosition = Cursor.Position;
    UserMovedMouse = false;
  }
  finally
  {
    TimerCheckMouseMoveMutex = false;
  }
}

Answer 2

It is possible to detect whether mouse input was generated by code using the API calls SendInput() or mouse_event(). To do so, use SetWindowsHookEx() to set up a low-level mouse hook. This hook procedure is passed a MSLLHOOKSTRUCT whose flags member indicates whether mouse events were the result of being injected by code, or the result of user input.

In case an attacker is sending mouse messages to your application, you can call InSendMessage from your mouse message handlers. Genuine mouse messages are posted to the message queue. Fake mouse messages are usually sent. If InSendMessage returns TRUE you can be sure to have gotten a fake input message. If the attacker does indeed post messages, you'll have to rely on identifying mismatches between the actual input device state and the expected state. GetKeyState can be used for this.

There's no immediate way to detect calls to SetCursorPos. In isolation, those calls do not generate user input, and cannot be used to automate an application. They are always accompanied by other schemes to inject input, and you know how to identify those.