Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Development
  New Posts New Posts RSS Feed - RegisterHotkey - list ?
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

RegisterHotkey - list ?

 Post Reply Post Reply Page  12>
Author
Message
Matts_User_Name View Drop Down
Senior Member
Senior Member
Avatar

Joined: 10 August 2006
Location: USA
Status: Offline
Points: 687
Post Options Post Options   Thanks (0) Thanks(0)   Quote Matts_User_Name Quote  Post ReplyReply Direct Link To This Post Topic: RegisterHotkey - list ?
    Posted: 08 May 2009 at 4:15pm


I am curious if anyone knows of a way to list registered hotkeys from apps which used the RegisterHotkey API.


I have seen apps which can do it so I know it is possible:
Hotkey Commander - http://hkcmdr.anymania.com/help.html
Deep System Explorer - http://tds.diamondcs.com.au/dse/screenshots.php


I looked into the internals of RegisterHotkey from ReactOS and it appears that it calls NtUserRegisterHotkey inside win32k.sys and there is a Linked List (named gHotkeyList) which stores all the HOT_KEY_ITEM structures:
http://doxygen.reactos.org/da/d2f/subsystems_2win32_2win32k_2ntuser_2hotkey_8c-source.html

although I am unsure how that would be actually located. (perhaps it is somewhere within some other kernel data structre storing some kernel variables, or maybe it is at a static address?)


Here is what the HOT_KEY_ITEM structure looks like:
http://doxygen.reactos.org/d5/dda/hotkey_8h-source.html

typedef struct _HOT_KEY_ITEM
{
  LIST_ENTRY ListEntry;
  struct _ETHREAD *Thread;
  HWND hWnd;
  int id;
  UINT fsModifiers;
  UINT vk;
} HOT_KEY_ITEM, *PHOT_KEY_ITEM;



Any info would be great.



Edited by Matts_User_Name - 08 May 2009 at 4:16pm
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17516
Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 4:34pm
Hi Matt,

Do the referenced apps get the information from usermode or kernel mode?  Win32K.sys exports gpHotKeyList...
Daily affirmation:
net helpmsg 4006
Back to Top
Matts_User_Name View Drop Down
Senior Member
Senior Member
Avatar

Joined: 10 August 2006
Location: USA
Status: Offline
Points: 687
Post Options Post Options   Thanks (0) Thanks(0)   Quote Matts_User_Name Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 6:03pm


Interesting, I didn't know it exports that.

I think DSE uses its driver, but it appears HC does not use a driver nor a dll (maybe it uses a driver and then unloads it after it gets the info...)

How would a driver access this exported variable?


Edited by Matts_User_Name - 08 May 2009 at 8:49pm
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17516
Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 7:03pm
It's an exported global variable, presumably much like a variable exported by a DLL in usermode.
Daily affirmation:
net helpmsg 4006
Back to Top
Matts_User_Name View Drop Down
Senior Member
Senior Member
Avatar

Joined: 10 August 2006
Location: USA
Status: Offline
Points: 687
Post Options Post Options   Thanks (0) Thanks(0)   Quote Matts_User_Name Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 7:39pm

I see.

So could this be read from WinDbg using a mem dump command (like "dd")?
If so, then how would I locate the address of this exported global variable within the kernel space?


Edited by Matts_User_Name - 08 May 2009 at 7:40pm
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17516
Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 8:23pm
LiveKD, dd win32k!gpHotKeyList

...
Daily affirmation:
net helpmsg 4006
Back to Top
GamingMasteR View Drop Down
Senior Member
Senior Member
Avatar

Joined: 10 August 2008
Status: Offline
Points: 245
Post Options Post Options   Thanks (0) Thanks(0)   Quote GamingMasteR Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 8:33pm
it's unexported !
Back to Top
Matts_User_Name View Drop Down
Senior Member
Senior Member
Avatar

Joined: 10 August 2006
Location: USA
Status: Offline
Points: 687
Post Options Post Options   Thanks (0) Thanks(0)   Quote Matts_User_Name Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 8:45pm


Hmm, I tried that command in both LiveKD and WinDbg, although they both return the following:
Couldn't resolve error at 'win32k!gpHotKeyList'

Perhaps it is not exported after all?
If it is unexported, I wonder how these other apps are going it then (even if by use of a driver)
Maybe registering a hotkey, and then scanning the kernel memory for a pattern of what the bytes of that structure should look like? (thus locating the linked list)


Edited by Matts_User_Name - 08 May 2009 at 8:50pm
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17516
Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 9:11pm
Originally posted by GamingMasteR GamingMasteR wrote:

it's unexported !
D'oh! You're correct, of course.  (Was not thinking...) Embarrassed It's not exported, and would need to be found using some other technique. 
Daily affirmation:
net helpmsg 4006
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17516
Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2009 at 9:13pm
Yes - GamingMasteR is correct.  Sorry about that - I misspoke.  It's not exported, and you'll need the public symbols for Win32k.sys, from the symbol server, for the dd command to work.

Quote If it is unexported, I wonder how these other apps are going it then (even if by use of a driver)
Perhaps, memory scanning, or hardcoded offsets based on file characteristics, etc...
Daily affirmation:
net helpmsg 4006
Back to Top
 Post Reply Post Reply Page  12>
  Share Topic   

Forum Jump Forum Permissions View Drop Down