views:

2233

answers:

10

I'm writing a screen saver type app that needs to stop the user from accessing the system without typing a password. I want to catch/supress the various methods a user might try to exit the application, but all research I do seems to point me to "you can't".

Anything in C# or C++ would be great. I've thought of disabling the keyboard, but then I would have other issues.

+21  A: 

You can't. The whole point of Ctrl+Alt+Del is that only the system gets to handle it, 'cause that way the system can always handle it.

Fortunately, Windows has built-in support for password-protected screensavers (available as the "On resume, password protect" option in Display Properties, or via group policy). Just use that.

Shog9
There is never a can't.. Sorry mate. There is only an I don't know how yet. It's not a true screen saver, it has to work like a screen saver, but it's a stand alone app. Off the top of my head, remapping the keyboard, or disabling it would accomplish the effect. But it's a little stronger then I'd like.. Programmers should get rid of the term can't.
baash05
Ok, how about "shouldn't" then. I've no doubt there are ways to screw with a system enough that it would no longer respond to any keyboard input, but it's a Bad Idea. That's why this ability was removed in post-Win9x versions of Windows - prior to that, you could just tell the system you were a screensaver and get the behavior you're looking for... but it was abused and misused and now it's handled by the system. See also: http://blogs.msdn.com/oldnewthing/archive/2004/02/16/73780.aspx
Shog9
Yeah. This is for an OEM they want what they want. They want it to be an application, so I comply. I'd love to make it a screen saver and were it my call it would be. Sadly grunt work is what it is. I have to catch it all. I suppose I have to screw with the system.
baash05
To those who voted this answer up.. (not to disparage Shog9) but how does "you can't" answer the question. Sometimes I wonder what people are thinking when they vote up answers. How do you do make a pie? You can't! Good answer. Nooo!
baash05
I'm up-voting this answer as well. Sometimes "you can't" is the correct answer even if it is technically a falsehood. In this case the question askes how to do something that is such a TERRIBLE idea (I dont give a flying crap what the employer thinks) that "you can't" is the most responsible and correct answer. Good job Shog9.
Boo
Thanks, Boo. @baash05: I feel for ya, man. You're stuck between a rock and a hard place... But one of those is gonna have to give, and hopefully it's the one that's preventing you from using the group policy settings that were built in to Windows for this very purpose. If not, I fear this will only be the first of many headaches for you...
Shog9
I am stuck shog, I have to implement what I don't think is a good idea. (ageed with all it's not a thing to do, but when the man who signs your cheques says jump, in this economy, you jump). I still have to do it Boo. And I still don't think answers that don't answer the question should get voted up.. No matter how much I agree with the sentiment, they simply didn't answer the question.
baash05
Oh.. shog9.. this is nowhere near the first headache :)
baash05
"You can't" -- More specifically, your "application software" cannot: instead, by design, only "system software" can do this; and it isn't that you're not allowed to or not able to write system software, but your OP seemed to be quite clearly asking how to do it without writing system software ... and the answer to *that* is that you can't: because the system is designed to prevent an application from hooking these key combinations.
ChrisW
Can you give me direction to writing the system things.. I actually think this would be better if it were system level.. It's for an OEM so kind of the point really.
baash05
Also if I wrote it system level, I could write an app to control it.
baash05
"Can you give me direction to writing the system things" -- I added an edit to my answer above.
ChrisW
A: 

You could achieve that in XP and before, but with Vista not anymore.

kay.herzam
+3  A: 

I have not tested it but what about using SetWindowsHookEx()

From MSDN documentantion: WH_KEYBOARD_LL

Windows NT/2000/XP: Installs a hook procedure that monitors low-level keyboard input events. For more information, see the LowLevelKeyboardProc hook procedure.

Nick D
This doesn't work in Vista anymore
kay.herzam
And, people have said, doesn't catch Ctrl-Alt-Del.
ChrisW
Ok ChrisW, but the question is also about intercepting all key events.
Nick D
Yes it is; and the title says, "...including ctrl+alt+del and ctrl+tab".
ChrisW
+7  A: 

To add to what Shog9 said, if your application could intercept ctrl+alt+del, then your application would be able to pretend to be the Windows Login dialog, and by doing so trick the end-user into typing their credentials into your application.

If you do want to replace the Windows Login dialog, see Winlogon and GINA (but this says, "GINA DLLs are ignored in Windows Vista", and I haven't heard what's what for Vista).

if someone asked I'd not tell them they can't.

More specifically, your "application software" can't: instead, by design, only "system software" can do this; and it isn't that you're not allowed to or not able to write system software, but your OP seemed to be quite clearly asking how to do it without writing system software ... and the answer to that is that you can't: because the system is designed to prevent an application from hooking these key combinations.

Can you give me direction to writing the system things.. I actually think this would be better if it were system level.. It's for an OEM so kind of the point really. Also if I wrote it system level, I could write an app to control it.

A keyboard filter device driver, or a GINA DLL, for example, would be considered system software: installed by an administrator (or OEM) and run as part of the O/S.

I don't know about GINA beyond its name; and I've already (above) given a link it in MSDN. I expect that it's Win32 user-mode code.

Device drivers are a different topic: e.g. Getting Started on Driver Development.

Is there a way to remap the keyboard so that delete isn't where it was?

I still not sure that you and/or your boss have the right idea. IMHO you shouldn't be an application which prevents the user from pressing Ctrl-Alt-Del. If you want to stop the user from accessing the system without typing a password, then you ought to lock (password-protect) the system, as if the user had pressed Ctrl Alt Del and then selected "Lock this computer". To unlock the computer they would then need to press Ctrl Alt Del and enter their credentials into WinLogon.

However, ignoring what you ought to do and concentrating instead on what you're capable of doing, if you want to intercept the keyboard, apparently it can be done. I haven't studied keyboards myself, but this post and this post claim success, by writing a "Keyboard Filter Driver" (which is a kind of kernel-mode, not Win32, device driver). If you write one of these though you may get some push-back, e.g. like this reaction from a DDK MVP, or this reaction from an anti-snooping product.

ChrisW
ChrisW. So? I mean if I wanted to screw with people with my app, stealing their windows password is such a minor thing. It gives me access to nothing that I didn't have already as I'm running on their logged in system, and I can capture all other key strokes with ease. More to the point. You didn't answer the question. People are way to conversational with their answers here. Do you know how to do it? If not then why type anything at all. I don't know how to build a processor, so if someone asked I'd not tell them they can't. Rant over (for now)
baash05
I added a 2nd paragraph to mention GINA, in case that helps you.
ChrisW
Now we're moving Way to step up... thanks :)
baash05
You were not the only person to offer an answer I might not like, but an answer all the same. I thank you and all those who refuse to say "can't". We are coders."Argue for your limitations and sure enough they're yours" Richard Bach. <br>"Impossible is a term humans use far too often" 7of9
baash05
Is there a way to remap the keyboard so that delete isn't where it was?
baash05
Another option is to diable ctrl+alt+del with the registry. but a message still shows up.
baash05
I edited my answer again.
ChrisW
+2  A: 

It is possible to intercept crtl+alt+del, though obviously Microsoft made it very difficult to do, because then you could pop-up a fake lock dialog, and record people's passwords.

The answer is to write a device driver. I can't remember if you can just use a plain old keyboard filter, or if you have to write a keyboard ISR. Either way, its certainly possible, but with great pain if you have no driver experience.

Unknown
It's a good point. Often times, when a customer asks me to do something like that I say "if I could figure out a way, I would report it to MS as a bug." :)
JP Alioto
Ha ha.. Now see others (who say can't) this is good answer. It's a start. JP (funny)
baash05
A: 

Try investigating if you could write an application that starts itself as a password protected screensaver.

Screensavers can do more than just display pretty pictures - I've seen interactive screensavers before that used the mouse and keyboard to provide a simple game, though I can't remember which version of windows I saw this running on... It could well have been windows 95. (In which case all bets are off).

Arafangion
Yeah.. I started with a screen saver. Then the boss came over and said No.. I kept the code so I can have fun with it on my own though. Never thought of writing my own screen saver.
baash05
A: 

What about intercepting ctrl and alt keypresses while your program is running, and .cancel'ing those keypresses?

I don't know how well this would work, if at all in Vista, but it's worth a try.

I remember doing something like this around the year 2001, so it was probably running on 98. Been too long since I've even tried to mess with anything like locking out ctrl-alt-del.

drachenstern
A: 

Ok.. I'm not going to post the code here But the gyst is this

create a keyboard hook. when the user presses ctrl || alt || delete set bools to true.. if they press anything else set them all to false.

switch (p_key)
            {
                default: Clear(); break;

                case Keys.LMenu: altHit = true; break;
                case Keys.RMenu: altHit = true; break;
                case Keys.LControlKey: ctrlHit = true; break;
                case Keys.RControlKey: ctrlHit = true; break;
                case Keys.Delete: delHit = true; break;

when the screen has focus looses it to the task manager, close the bloody thing. The screen flashes so fast the user never notices it. And I can do what ever I want.

I'll admit this is a kludge, but it does result in the desired effect. (OH I wish I didn't have to do this)

baash05
Can't you just use Windows' default logic to show the login dialog when exiting the screen saver?
VVS
Na mate.. this isn't a screen saver app.. It has to work like one, but it also has to have the capacity to run as a true app, with the same functionality as a screen saver. The app takes info from a com port attached to some hardware in a car. When the car is moving the app has to prevent the user from doing anything at all.
baash05
A: 

"Process Explorer" by Mark Russinovich (http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx) does it, and it had been doing before Sysinternals was bought by Microsoft.

This article from 2002 updated in 2006 explains one way to do it without writing a keyboard driver. http://www.codeproject.com/KB/system/preventclose.aspx?msg=1666328

a rosa
A: 

You can still intercept ctrl+alt+del in windows 7. this is the way Process explorer does it:

http://mygreenpaste.blogspot.com/2005/07/image-file-execution-options-good-evil.html