KbFilter_ServiceCallback -- inserting and deleting packets

Hello,

Presently I'm adapting a simple 'kbfiltr.sys' driver. Have it working and
performing some modifications in the scan-code/key-press stream.

Now would like to insert and delete packets from the stream. No luck
finding an example of how exactly it's done. Seems the incoming packet array
is typically a section of a ring queue, but have no way to know when to wrap
the pointers or where the beginning of the buffer lies. Don't see a way to
replace the buffer either. Is it possible to insert an event? Or are the
comments misleading in this regard? Does one perhaps have to hold DataEnd as
constant and adjust the entries that precede it and the count? If so ring
wrap remains a concern.

Thanks,

Umm, if you're a filter you can do anything you want with that buffer, including discarding it
entirely and sending exactly whatever keystrokes you want when you call the higher-level callback.

You typically just replace the mouclass callback in the IRP when it's registered with your own
callback, and save the pointer so you can call it when you want to. Then the lower-level driver only
sees your callback and you have full control of the data that is passed up.

On 5/3/2010 2:03 PM, Starlight wrote:
> Hello,
>
> Presently I'm adapting a simple 'kbfiltr.sys' driver. Have it working and
> performing some modifications in the scan-code/key-press stream.
>
> Now would like to insert and delete packets from the stream. No luck
> finding an example of how exactly it's done. Seems the incoming packet array
> is typically a section of a ring queue, but have no way to know when to wrap
> the pointers or where the beginning of the buffer lies. Don't see a way to
> replace the buffer either. Is it possible to insert an event? Or are the
> comments misleading in this regard? Does one perhaps have to hold DataEnd as
> constant and adjust the entries that precede it and the count? If so ring
> wrap remains a concern.
>
> Thanks,
>


--
Ray

Oh cancel my pointless question!

Too may interruptions the last couple of days--my brain stuttered over the
call that passes packets to the next layer, thinking that changes had to be
made in place. Obviously one can construct and pass a new key-press packet
array to the next layer.

Thank you for replying Ray--much appreciated. Sorry I didn't unconfound
myself my faster and save you effort.