Can't block capslock with CGEventTap

Question

I'm using Quartz CGEventTap in an attempt to globally intercept capslock presses and block them (to have them do something useful instead). I succesfully detect capslock presses but have so far been unable to block them. My code (originating from this stackoverflow answer) is something like this:

eventTap = CGEventTapCreate(kCGHIDEventTap,
                            kCGTailAppendEventTap, 
                            kCGEventTapOptionDefault, 
                            eventMask,
                            myCGEventCallback,
                            &oldFlags);

runLoopSource = CFMachPortCreateRunLoopSource(kCFAllocatorDefault, eventTap, 0);

CFRunLoopAddSource(CFRunLoopGetCurrent(), runLoopSource, kCFRunLoopCommonModes);
CGEventTapEnable(eventTap, true);

CGEventRef myCGEventCallback(CGEventTapProxy proxy, CGEventType type, CGEventRef theEvent, void *refcon)
{
    CGEventFlags *oldFlags = (CGEventFlags *)refcon; 

    switch (type)
    {
        case kCGEventFlagsChanged:
        {
            CGEventFlags newFlags = CGEventGetFlags(theEvent);
            CGEventFlags changedFlags = *oldFlags ^ newFlags; 
            *oldFlags = newFlags;

            if (changedFlags == 65536)
            {
                NSLog(@"Capslock pressed. Let's not return the event");
                return NULL;
            }
            break;
        }
        default:
            break;
    }

    NSLog(@"Different modifier than capslock. Returning the event");
    return theEvent;
}

If I understand correctly returning NULL should effectively block the keypress from propagating. Indeed it also does for "normal" keyup and -down events. However capslock toggles regardless. Any ideas why that is? Am I making incorrect assumptions? And/or how can I do things differently to achieve my goal?

Thanks,

Thor

Answer 1

You cannot block capslock like that. Capslock is a condition, that is handled by the keyboard driver, not by the Window Server or the individual applications. A keypress event propagates in OS X like that:

Keyboard Driver -> Window Server -> User Session -> Active Application

At each level propagation (indicated by "->") you can place an event tap and block and/or modify key events. Keyboard Driver and Window Server are both privileged components, the other two are normal user level components.

The earliest you can catch a keyboard event is when the event propagates from the Driver (kernel space) to the Window Server (user space, but still privileged). However, as noted above, the capslock state is handled internally in the driver, thus catching an event there is already too late. The driver will already have enabled the capslock light on the keyboard (if necessary at all and not performed by the hardware on its own) and remembered the capslock state being on, which has an effect on all future key presses.

You can turn off the capslock light programmatically for HID devices (Apple has even sample code for that), but this will not turn-off capslock, it just turns off the light.

The only way I see to implement that using event taps is to manually re-write every key press with capslock to a key press without capslock (one where the capslock flag is not set and the attached letter, if any, is lower case). Further, to not confuse the user, you'd turn off the capslock light as shown by Apple's sample code.

Other alternatives are: Write your own keyboard driver, that takes control over the keyboard instead of Apple's standard driver (not as hard as you think, but still hard hard enough) or hacking your way into the driver (evil, but works). E.g. some keyboard remappers override only single methods of the driver (drivers are C++ in OS X, thus they are OO-objects and you can dynamically override C++ methods at runtime; not really override them, but rather manipulate method tables). The problems with those two solutions are: The first one means that unless your driver is as good as the one from Apple, some USB keyboards may not work with your driver, while others do, the second one means if you make any mistake, the system punishes this mistake with a kernel panic.

I'm looking myself for a way to programmatically toggle capslock on Mac, without success so far. But I can assure you, event taps are not the way to go.