The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is not silver bullet and (for example) the bot software can use PS/2 driver to emulate hardware input. Is this question let's assume that the PS/2 problem has already been solved.
WH_KEYBOARD_LL installs a hook procedure that monitors low-level keyboard input events. For more information, see the LowLevelKeyboardProc hook procedure.
WH_KEYBOARD_LL is used (instead of WH_KEYBOARD) because of just LowLevelKeyboardProc contains pointer to KBDLLHOOKSTRUCT with event-injected flags, context code, and transition-state flag. The sample protection code is quite simple:
LRESULT CALLBACK KeyboardProc(int code, WPARAM wParam, LPARAM lParam) {
if (code < 0)
return CallNextHookEx(_hookKeybrd, code, wParam, lParam);
KBDLLHOOKSTRUCT& ll = *(KBDLLHOOKSTRUCT*)lParam;
if (ll.flags & LLKHF_INJECTED)
return 1; //emulation case
return CallNextHookEx(_hookKeybrd, code, wParam, lParam);
}
...
SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardProc, GetModuleHandle(NULL), 0);
But if application uses this code it sould be system wide.
Questions:
- If any way to limit this to specific application?
- Is any other ways to prevent input emulation in specific application?
