undefined | Better HN

0 pointsjaclaz8y ago0 comments

>Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break.

I think that even that is catchable (if needed), at least on old Windows XP Embedded, if you used minlogon (which happened very often) you lost ctrl+alt+del access to Task Manager, but there was a third-party service to restore the "hook":

http://www.mp3car.com/forum/mp3car-technical-software/softwa...

0 comments

gruez8y ago

but does it suppress the real thing? otherwise the user is going to see the (real) windows security dialog, followed by your fake one after they exited the real one.

jaclazOP8y ago

Really cannot remember how the mentioned little program worked with the "real" Winlogon, i.e. if it managed to hook "before" it the key sequence.

Anyway there are other ways, here is one:

http://www.oblita.com/interception.html

about midpage there is a sample to "intercept and block" the sequence.

gruez8y ago

but that requires a kernel mode component, and if you have kernel access all bets are off. for instance, you can directly patch out the login screen (which is in userspace) to steal the password for you.

1 more reply

j / k navigate · click thread line to collapse

0 pointsjaclaz8y ago0 comments

>Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break.

http://www.mp3car.com/forum/mp3car-technical-software/softwa...

0 comments

gruez8y ago

but does it suppress the real thing? otherwise the user is going to see the (real) windows security dialog, followed by your fake one after they exited the real one.

jaclazOP8y ago

Really cannot remember how the mentioned little program worked with the "real" Winlogon, i.e. if it managed to hook "before" it the key sequence.

Anyway there are other ways, here is one:

http://www.oblita.com/interception.html

about midpage there is a sample to "intercept and block" the sequence.

gruez8y ago

1 more reply

j / k navigate · click thread line to collapse