On my keyboard, there's a button that opens Windows 7 calculator when pressed. How would you capture what's calling/opening it?

Because it's a Logitech keyboard, common sense would say it's via SetPoint software/service, so I would normally start by observing those in Process Monitor. But because I'm doing this as a hands-on reversing exercise rather than merely reprogramming a keyboard button, I'd like to approach it as if I didn't have background knowledge of SetPoint or third-party keyboard software.

Is there a way I could trace/capture the behind-the-scenes activity from keypress to calc.exe opening?

  • You would need a USB traffic monitor/capture tool; assuming the keyboard uses a USB interface for communication.
    – 0xec
    Commented May 16, 2015 at 13:50

1 Answer 1


You could use Process Monitor to monitor the process creation.

If you'd like more granular detail, use Rohitab's API Monitor and monitor on CreateProcess* functions. Here's an answer I gave on this site with regard to monitoring registry reading.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.