Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Capturing Ctrl+Alt+Del. VMWare does it, but it shouldn't, right?

Tags:

vmware

I've been spending my entire computing life (since Windows NT 4.0 at least) on the assumption that the Ctrl+Alt+Del key combination is held sacred by the operating system - that no program can usurp this key combination and it will always be captured by the kernel's security layer and issue the highest-priority interruption that causes the Security screen to be displayed (except on Windows XP Home Edition when it shell-invoked the Task Manager directly).

However I was using VMWare Player today and I let it capture my mouse and keyboard, but after I was done I wanted to get out and I forgot the hotkey combination (note for future reference, I need to double-tap Ctrl +Alt ). I thought I'd Ctrl+Alt+Del to invoke the security screen and switch focus to the Task Manager, however when I pressed the keys VMWare Player rebooted my VM - somehow it had captured the keypress.

So this experience taught me that processes can capture CAD, but how did it do it?

Update:

  • I'm running Windows 7 x64.
  • I want to know how VMWare is able to capture CAD keystrokes.

Update2:

Having looked at the QA that you linked to, I took a look at my Device Manager and saw that there's the vmkbd keyboard class filter that looks like it's VMWares - so it's possible they capture the SAS/CAD keystroke from there.

like image 904
Dai Avatar asked Nov 12 '22 11:11

Dai


1 Answers

Answering my own question, though Chris Morgan (see third comment to my original question) deserves the credit.

Having looked at the QA that you linked to, I took a look at my Device Manager and saw that there's the vmkbd keyboard class filter that looks like it's VMWares - so it's possible they capture the SAS/CAD keystroke from there.

I did a bit more research (read: I googled for for "vmkbd ctrl alt del") and found other articles and forum threads that corroborate this explanation.

Even so, the idea that a driver can intercept CAD is a bit unnerving, though it makes sense. I do miss the old days before USB when CAD triggered a CPU interrupt in hardware. No drivers required.

like image 63
Dai Avatar answered Nov 15 '22 08:11

Dai