Module memflow_win32::win32::keyboard

Module for reading a target’s keyboard state.

The gafAsyncKeyState array contains the current Keyboard state on Windows targets. This array will internally be read by the GetAsyncKeyState() function of Windows.

Although the gafAsyncKeyState array is exported by the win32kbase.sys kernel module it is only properly mapped into user mode processes. Therefor the Keyboard will by default find the winlogon.exe or wininit.exe process and use it as a proxy to read the data.

Examples:

use std::{thread, time};

use memflow::mem::{PhysicalMemory, VirtualTranslate2};
use memflow::os::{Keyboard, KeyboardState};
use memflow_win32::win32::{Win32Kernel, Win32Keyboard};

fn test<T: 'static + PhysicalMemory + Clone, V: 'static + VirtualTranslate2 + Clone>(kernel: &mut Win32Kernel<T, V>) {
    let mut kbd = Win32Keyboard::with_kernel_ref(kernel).unwrap();

    loop {
        let kbs = kbd.state().unwrap();
        println!("space down: {:?}", kbs.is_down(0x20)); // VK_SPACE
        thread::sleep(time::Duration::from_millis(1000));
    }
}

Structs

Win32Keyboard

Interface for accessing the target’s keyboard state.

Win32KeyboardState

Represents the current Keyboardstate.