0

On my keyboard, there's a button that opens Windows 7 calculator when pressed. How would you capture what's calling/opening it?

Because it's a Logitech keyboard, common sense would say it's via SetPoint software/service, so I would normally start by observing those in Process Monitor. But because I'm doing this as a hands-on reversing exercise rather than merely reprogramming a keyboard button, I'd like to approach it as if I didn't have background knowledge of SetPoint or third-party keyboard software.

Is there a way I could trace/capture the behind-the-scenes activity from keypress to calc.exe opening?

  • You would need a USB traffic monitor/capture tool; assuming the keyboard uses a USB interface for communication. – 0xec May 16 '15 at 13:50
2

You could use Process Monitor to monitor the process creation.

If you'd like more granular detail, use Rohitab's API Monitor and monitor on CreateProcess* functions. Here's an answer I gave on this site with regard to monitoring registry reading.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.