SetWindowsHookEx callback function does not work on SYSTEM authority

Question

Environment :
I am using VS2010 on Win10 x64 [16299.431].
I want to log some keys on my PC using SetWindowsHookEx function.

Ultimate goal :
If someone type correct password in order, my PC will unlock automatically.

Problem :
It doesn't work on SYSTEM authority.

Implementation:

#define LOCK_ENABLE 0
#define LOCK_DISABLE 1

DWORD g_locker = LOCK_DISABLE;
DWORD g_selwrd = -2;
CHAR* g_szpaswd = "heaven";

LRESULT CALLBACK LowLevelKeyboardProc(int nCode, WPARAM wParam, LPARAM lParam);
HOOKPROC LockerPraq();

LRESULT CALLBACK LowLevelKeyboardProc(int nCode, WPARAM wParam, LPARAM lParam)
{
    PKBDLLHOOKSTRUCT p = (PKBDLLHOOKSTRUCT) lParam;

    if(HC_ACTION == nCode)
    {
        switch (wParam)
        {
        case WM_KEYDOWN:        case WM_SYSKEYDOWN:
            switch (p->vkCode)          {
            case VK_HOME:
                g_locker = LOCK_ENABLE;
                g_selwrd = -1;
                break;
            case VK_END:
                g_locker = LOCK_DISABLE;
                g_selwrd = 0;
                break;
            }

            if (LOCK_ENABLE == g_locker)
            {
                if (-1 == g_selwrd)
                    g_selwrd = 0;
                else
                {
                    CHAR szKbdstate[MAX_PATH] = {0};
                    WORD theChar = 0x0000;

                    ToAsciiEx(p->vkCode, p->scanCode, (BYTE*)szKbdstate, &theChar, 0, GetKeyboardLayout(0));
                    if (theChar != g_szpaswd[g_selwrd])
                        g_selwrd = 0;
                    else
                    {
                        g_selwrd++;
                        if (g_selwrd >= strlen(g_szpaswd))
                            UnLockPC();
                    }
                }
            }

            break;
        }

    }


    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

HOOKPROC LockerPraq()
{
    HHOOK hook_install = SetWindowsHookEx(WH_KEYBOARD_LL, LowLevelKeyboardProc, NULL, 0);
    if (NULL == hook_install)
        return(0);

    MSG msg;
    while (GetMessage(&msg, NULL, 0, 0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    UnhookWindowsHookEx(hook_install);

    return(0);
}

Answer 1

The reason why you're not seeing any key presses when Windows is locked or logged off (if that is indeed your issue) is because Winlogon runs on its own Desktop.

Winlogon is the process that handles the login and lock screens, and it does so in a secure way. It is not well documented by Microsoft but there's an article here that talks about sessions and desktops in general which you might find helpful.

'SetWindowsHookEx' is documented as only hooking applications running on the same desktop as the calling application, so that's the likely cause of your problem.

I doubt there's a way round this. Winlogon runs on its own desktop for a reason and Microsoft don't want you anywhere near it.

Edit: Well, OK, maybe you can sneak your own process in there, see: Running a process at the Windows 7 Welcome Screen