Windows operates based on layers, sort of like an onion. Every time you peel off the outside layer there is a layer below that. I'm simplifying but picture something like this, where the top is the outside layer and the bottom is the inner layers:
Program
Windows API
Windows HAL (Hardware Abstraction Layer)
Hardware
When Hero runs it starts up xTrap. Part of xTrap sits on the outside Program layer. Another part connects to different parts of the Windows API layer using a method called hooks. A hook is basically like a gate keeper. It guards the path and every time you want to go down that route you have to go through it.
The Windows API contains built in functions that programs can use to do certain things such as check if the spacebar has been pressed. In addition to checking for keypresses, a program can actually set a keypress state to true. This is what macro programs use to fake keypress and mouse movements. But remember from above, xTrap put a hook into the Windows API and sits between the macro program and the real Windows API. Every time your macro program tries to set a key to the 'held down' state, xTrap sees the request and doesn't let it through.
Macro Program -> xTrap -> API -> Hero Program
As seen above, the keypress request gets blocked before reaching the real API function and thus Hero never sees a keypress.
Now if we look at the layer model again, we can see that Windows HAL sits under the Windows API. Since the hook only attaches to the Windows API then if we sneak something in at the HAL layer then it would go undetected. Fortunately Windows allows for multiple input devices (keyboards/mice), which means if you plugged in a 2nd keyboard and installed the drivers you would be able to type on either keyboard and it would work with your programs.
My idea is to place a fake keyboard driver to pretend like a 2nd keyboard is installed. Since we don't actually have a real 2nd keyboard installed we would also install a program that talks with the fake keyboard driver and tells it what keys is supposedly being pressed on the fake keyboard.
Fake Keyboard Program -> HAL (fake keyboard driver) -> xTrap -> API -> Hero
Since the keypress is originated in the HAL, xTrap has no choice but to assume it is legitimate. Further down the line, if they decided to block this type of trick, they would probably need to create signatures of legitimate keyboard drivers on the market and then not allow unapproved drivers to pass keystrokes up the chain. I doubt this would ever happen because even Microsoft's attempt with 'Genuine' MS-approved drivers didn't take hold and is really too difficult to manage on a global scale.
whew... I guess that post quickly turned long winded.
Who is online