Detecting simulated keyboard/mouse input

Question

Is there a way to detect simulated keyboard/mouse input on Windows. For example, a user types something on his keyboard vs sendKeys/PostMessage/On-screen keyboard. Is there

Answer 1

Starting form Windows 8 there's the GetCurrentInputMessageSource function. You can use it, and check the originId enum for the following value:

IMO_INJECTED - The input message has been injected (through the SendInput function) by an application that doesn't have the UIAccess attribute set to TRUE in its manifest file.

Answer 2

I might be wrong, but the on-screen keyboard (and other applications that simulate user input) most probably uses the SendInput API:

SendInput operates at the bottom level of the input stack. It is just a backdoor into the same input mechanism that the keyboard and mouse drivers use to tell the window manager that the user has generated input. Source: http://blogs.msdn.com/b/oldnewthing/archive/2010/12/21/10107494.aspx

So there is probably no way to tell whether the input is coming from a "real" keyboard or not.

Answer 3

The only way to distinguish between "real" input and "simulated" input (assuming it is being generated with keybd_event()/mouse_event() or SendInput()) is to use a low-level keyboard/mouse hook via SetWindowsHookEx(). The WH_KEYBOARD_LL and WH_MOUSE_LL hook callbacks provide INJECTED flags for simulated input.