Kernel extension : keyboard shortcut trigger

Question

Hi everybody !
I have been stuck for two weeks on this problem now. Not by lack of research ; most probably because I am new to kernel ext programming.
I would like the user to be able to trigger specific low level actions, that needs to be executed from within the kernel space. However, I could not find a way, for instance, to register for notifications about keyboard-related events in a kernel extension. (such as specific sets of key being pressed)
Does anyone knows how to achieve such programming ?
The former solution is preferred, however, on a last resort, I am also willing to consider listening to all keyboards events, and sort them out. But I could not find any (recent) info on that one and I understand that such discussion topic is most unwelcomed...
Any idea ?
Thx

Answer 1

Actually, I am not using the kext because I don't want to have to interact with the graphic server / windows manager.
I found a post about this, from people who tried to add a "CDROM Eject key" kind of functionality on a mac. Below is what they did.
But it only worked with 10.0 to 10.2 I think. Clearly it does not work for 10.6.
I want to do something very similar. If you have a suggestion... I will try it !
*Intercepting at the IOHIDSystem Driver*
The best place to intercept the data flow with current knowledge turned out to be the IOHIDSystem class in the kernel. Unfortunately this class is statically linked into the kernel, it's not possible to replace it with a custom driver. The main challenge was to replace the kernel's implementation of IOHIDSystem with a slightly modified version.
If the IOKit had been written in Objective-C instead of C++ (like its ancestor, the DriverKit), things had been simple: We could create a subclass of IOHIDSystem and tell it to "Pose As" the IOHIDSystem class. Every creation of an IOHIDSystem object would have been an instance of our subclass.
Since this is real life and not fiction, it has not been so easy. We nevertheless implemented it the Objective-C way as posing subclass, but we had to do some low-level C++ runtime hacking. iJect contains a subclass of IOHIDSystem which overwrites two virtual methods which process keyboard events. The modified versions of the methods simply call the superclass implementations, or they ignore the event by not calling the superclass implementation. The tricky part is how to make the kernel use our subclass instead of IOHIDSystem. It's necessary to understand how virtual C++ methods work. Instances of classes which have virtual methods have an additional (hidden) instance variable: a pointer to a v-table. This v-table is a function pointer table pointing to the implementations of the virtual methods. To implement the posing, we simply overwrite the pointer to IOHIDSystem's vtable with a pointer to our class' v-table. This turns the IOHIDSystem instance into an instance of our class.
Message was edited by: Eskadi