Detecting Win API mouse_event Call

Question

I would like to write a program that will determine whether the mouse is being moved by a human or by a different process calling the User32 SendInput function. I thought that perhaps it would be possible to use dll injection to detect when SendInput is called, but I don't have any experience with this - is this possible?

Many thanks.

Answer 1

You can use a low level mouse hook and check the LLMHF_INJECTED flag.

Answer 2

The Microsoft Detours library allows you to get notification for function calls.

Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.