Click here to Skip to main content
16,006,475 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
Generalworking with streams Pin
ra_sasi10-May-04 12:44
ra_sasi10-May-04 12:44 
GeneralRe: working with streams Pin
Paul Ranson10-May-04 13:01
Paul Ranson10-May-04 13:01 
GeneralRe: working with streams Pin
ra_sasi11-May-04 6:40
ra_sasi11-May-04 6:40 
GeneralNOT a Site Search? Search text within tables and display results. Pin
thefreebay10-May-04 12:41
thefreebay10-May-04 12:41 
GeneralRe: NOT a Site Search? Search text within tables and display results. Pin
Anthony_Yio10-May-04 16:17
Anthony_Yio10-May-04 16:17 
Questionprint screen hook? Pin
Miguel Lopes10-May-04 11:38
Miguel Lopes10-May-04 11:38 
AnswerRe: print screen hook? Pin
Toby Opferman10-May-04 16:29
Toby Opferman10-May-04 16:29 
GeneralRe: print screen hook? Pin
Toby Opferman10-May-04 18:26
Toby Opferman10-May-04 18:26 
I took a quick look again here in a little more detail and here's what I think is happening.

The keyboard generates the keydown event and it's most likely passed and filtered by the WH_KEYBOARD_LL hooks first. Eventually, it makes it way as a WM_KEYDOWN message into the active window. In the case where I saw it in CSRSS's message queue, was since I had the command window debugger active.

So, then the ScanQueue is called and there's a call to get the next message. Then, it's checked if it's a keydown. If it is, it then checks specific scan codes and performs certain system actions.

kd> r
eax=e1ba81e8 ebx=e1cb0a48 ecx=00000001 edx=00005d6e esi=00000000 edi=00000001
eip=a0025769 esp=f766fbac ebp=f766fc8c iopl=3 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003246
win32k!xxxScanSysQueue+0xa2:
a0025769 e80d0f0000 call win32k!xxxGetNextSysMsg (a002667b)
kd> p;r

...
kd>
eax=00000000 ebx=e1cb0a48 ecx=f766fc20 edx=00000000 esi=00000000 edi=00000001
eip=a00257bf esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003283
win32k!xxxScanSysQueue+0x10c:
a00257bf 8b4dac mov ecx,[ebp-0x54] ss:0010:f766fc38=00000100
kd>
eax=00000000 ebx=e1cb0a48 ecx=00000100 edx=00000000 esi=00000000 edi=00000001
eip=a00257c2 esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003283
win32k!xxxScanSysQueue+0x10f:
a00257c2 6a23 push 0x23
kd>
eax=00000000 ebx=e1cb0a48 ecx=00000100 edx=00000000 esi=00000000 edi=00000001
eip=a00257c4 esp=f766fbb4 ebp=f766fc8c iopl=3 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003283
win32k!xxxScanSysQueue+0x111:
a00257c4 5a pop edx
kd>
eax=00000000 ebx=e1cb0a48 ecx=00000100 edx=00000023 esi=00000000 edi=00000001
eip=a00257c5 esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003283
win32k!xxxScanSysQueue+0x112:
a00257c5 894d08 mov [ebp+0x8],ecx ss:0010:f766fc94=e1cb0a48
kd>
eax=00000000 ebx=e1cb0a48 ecx=00000100 edx=00000023 esi=00000000 edi=00000001
eip=a00257c8 esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003283
win32k!xxxScanSysQueue+0x115:
a00257c8 2bca sub ecx,edx
kd>
eax=00000000 ebx=e1cb0a48 ecx=000000dd edx=00000023 esi=00000000 edi=00000001
eip=a00257ca esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei pl nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003216
win32k!xxxScanSysQueue+0x117:
a00257ca 0f841b0c0000 je win32k!xxxScanSysQueue+0xe3f (a00263eb) [br=0]
kd>
eax=00000000 ebx=e1cb0a48 ecx=000000dd edx=00000023 esi=00000000 edi=00000001
eip=a00257d0 esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei pl nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003216
win32k!xxxScanSysQueue+0x11d:
a00257d0 81e9dd000000 sub ecx,0xdd
kd>
eax=00000000 ebx=e1cb0a48 ecx=00000000 edx=00000023 esi=00000000 edi=00000001
eip=a00257d6 esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003246
win32k!xxxScanSysQueue+0x123:
a00257d6 0f84ce070000 je win32k!xxxScanSysQueue+0x6d2 (a0025faa) [br=1]

... 100h == WM_KEYDOWN.

kd>
eax=00000000 ebx=e1cb0a48 ecx=00000008 edx=00000036 esi=00000000 edi=a0187e21
eip=a0025ff0 esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003246
win32k!xxxScanSysQueue+0x767:
a0025ff0 837dfc2c cmp dword ptr [ebp-0x4],0x2c ss:0010:f766fc88=0000002c

I think 2c is the scancode for print (or the VK_xxx) but I'd have to look that up.


kd>
eax=00000000 ebx=e1cb0a48 ecx=00000008 edx=00000036 esi=00000000 edi=a0187e21
eip=a0025ff0 esp=f766fbb8 ebp=f766fc8c iopl=3 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003246
win32k!xxxScanSysQueue+0x767:
a0025ff0 837dfc2c cmp dword ptr [ebp-0x4],0x2c ss:0010:f766fc88=0000002c

eax=f766fc2c ebx=e1cb0a48 ecx=00000008 edx=00000036 esi=00000000 edi=a0187e21
eip=a00c39e3 esp=f766fbb0 ebp=f766fc8c iopl=3 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003246
win32k!xxxScanSysQueue+0x1005:
a00c39e3 e8252ff6ff call win32k!xxxSkipSysMsg (a002690d)

SkipSysMsg is called, then

eax=a03106e0 ebx=e1cb0a48 ecx=f766fbd4 edx=00000001 esi=00000000 edi=a0187e21
eip=a00c3a2f esp=f766fbb4 ebp=f766fc8c iopl=3 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00003206
win32k!xxxScanSysQueue+0x1051:
a00c3a2f e86efc0300 call win32k!xxxSnapWindow (a01036a2)

SnapWindow is called.

So, what do you want to do if you don't want a keyboard filter? A kernel hook on xxxSnapWindow?



GeneralRe: print screen hook? Pin
Miguel Lopes10-May-04 23:42
Miguel Lopes10-May-04 23:42 
GeneralRe: print screen hook? Pin
Toby Opferman11-May-04 2:42
Toby Opferman11-May-04 2:42 
GeneralRe: print screen hook? Pin
Miguel Lopes11-May-04 3:05
Miguel Lopes11-May-04 3:05 
GeneralRe: print screen hook? Pin
Toby Opferman11-May-04 6:00
Toby Opferman11-May-04 6:00 
GeneralRe: print screen hook? Pin
Miguel Lopes12-May-04 2:58
Miguel Lopes12-May-04 2:58 
GeneralC2065 Compiler error. Pin
bin892210-May-04 11:30
bin892210-May-04 11:30 
GeneralRe: C2065 Compiler error. Pin
Christian Graus10-May-04 12:09
protectorChristian Graus10-May-04 12:09 
GeneralRe: C2065 Compiler error. Pin
bin892210-May-04 12:27
bin892210-May-04 12:27 
GeneralRe: C2065 Compiler error. Pin
Christian Graus10-May-04 12:32
protectorChristian Graus10-May-04 12:32 
GeneralRe: C2065 Compiler error. Pin
Ionut L.10-May-04 20:32
Ionut L.10-May-04 20:32 
GeneralRe: C2065 Compiler error. Pin
Robert A. T. Káldy10-May-04 22:46
Robert A. T. Káldy10-May-04 22:46 
GeneralError when closing application Pin
Krugger40410-May-04 11:04
Krugger40410-May-04 11:04 
GeneralRe: Error when closing application Pin
Blake Miller10-May-04 11:26
Blake Miller10-May-04 11:26 
GeneralRe: Error when closing application Pin
Mil1010-May-04 19:47
suss Mil1010-May-04 19:47 
GeneralRe: Error when closing application Pin
10-May-04 19:46
suss10-May-04 19:46 
GeneralControll Access Pin
Grahamfff10-May-04 9:32
Grahamfff10-May-04 9:32 
GeneralRe: Controll Access Pin
Anthony_Yio10-May-04 16:32
Anthony_Yio10-May-04 16:32 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.