did you know? the syscall for WinAPI function GetAsyncKeyState queries the global keymap gafAsyncKeyState (exported) in the kernel. you can poll for keystrokes w/o registering a hook, installing a filter driver, or calling the WinAPI func- bypassing like 100% of A/Vs and ACs lol
Conversation
I remember this tweet, and a Google search got me here again. Any idea why GetAsyncKeyState doesn't work in a service? Any idea for an alternative? I wanted to implement a safe mode key combination in my service, sth like:
init() { if (key1 && key2) exit(); /*...*/ }
1
1
I’m going to guess it’s because the service is running in session 0, and it can’t grab the keystrokes from the current user running in session 1 by calling the GetAsyncKeyState userland API function.
1
1
Can different sessions have different keyboard states? I assumed that since gafAsyncKeyState is global af, the state is shared. If so, is that an arbitrary limitation for session 0? And is it enforced in user mode or kernel mode?
3
For sure. I hoped to find a way to query the main/physical keyboard. The keyboard that can get me into bios setup on boot, or that controls Windows Recovery Environment. Apparently there's no easy/documented way to do that except for communicating with another session.