Ans: Kernel Keyboard filter
From: Yorick <уθя¡ςκ@θβƪ¡τΔ.ςθм>
Date: Sat, 11 Jul 2009 14:29:50 -0300
To: Oscar Lain
Hmmm, you are the first one to tell that it's currently not working with gameguard, if the gameguard team is filtering my drivers on kernel32.dll through some detour it's related with the devices created by my drivers, their names and the DeviceIoControl API, CreateFile, etc. As I've shown you, my driver create the devices Keyboard0, Keyboard1, ... and the user mode dlls are plain standard dlls which communicate with this devices through the DeviceIoControl API, CreateFile, etc (e.g. kbd.Write maps to a DeviceIoControl call). So if there is a detour filtering my device names ( Keyboard0, ... ) in kernel32.dll, stoping the communication with them, you may try a simple tweak that may solve this easily. Using a binary editor like HxD you open KernelHotkey.dll and look for the string keyboard0 and change it to another one with the same amount of characters like k3yb04rd0 and save, you must do the same for mouse0. Now, open keyboard.sys and change all the keyboard0 unicode strings to look like the ones from the new KernelHotkey.dll (k3yb04rd0). Do the same with mouse.sys file. This binary edit will propably solve the problem with gameguard if there's such a problem. I've not heard from other sources of such a problem with KernelHotkey till now, good luck and report me whether you achieves success on this on Vista 32 and gameguard.
See Ya.
Oscar Lain wrote:
> Works great on Vista 32bit as expected, but still cant manage to work when funny ass gameguard is running...
> It does some changes/detours up Kerner32.dll.
> Copying Kernel32.dll to application directory gives me ability to write out some keystrokes but after like 10 it hangs up all system...
> Is there a way to bypass kernel32 in whole process?
> Does Write and Read Functions in kernel32.dll calls some other components/dll's?
> When gameguard is running kbd.Read returns null (if i dont put kernel32.dll in application directory) Thanks for you help so far =)
> Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! Try it!
Quote:
Originally Posted by kevzor
its not the driver thats detected (they just blocked the comunication function to talk to it aka: DeviceIOControl)
|