Detecting Ctrl-Alt-Del in Windows

[Den]

Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

Also, is there a corresponding key-sequence in Mac and Linux? And how
might one detect those too?

Den

 

[Nobody]

Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

Not reliably. You might infer that Ctrl-Alt-Del has been used by the way
that certain operations behave, but that's fairly error-prone.

Also, is there a corresponding key-sequence in Mac and Linux? And how
might one detect those too?

I don't know about Mac. Linux has some support for Ctrl-Alt-Del on the
console, and the optional "Magic SysRq" feature. But there's no easy way
to detect these (if the sequence is recognised by the kernel, it's not
reported by the usual mechanisms).

 

[Dennis Lee Bieber]

Not reliably. You might infer that Ctrl-Alt-Del has been used by the way
that certain operations behave, but that's fairly error-prone.

No kidding... <ctrl-alt-del> is used to open the Login/password
screen in Windows specifically because it does not propagate to user
applications. Otherwise someone could write a trojan program that
emulated the login/password window and capture someone's
username/password.

 

[Gregory Ewing]

The nearest equivalent in MacOSX is Command-Option-Escape, which
brings up the force-quit dialog. I don't know how deep down in
the system it's implemented.

It's possible to use SetSystemUIMode to put an app into a "kiosk
mode" where force-quitting is disabled, but I don't know whether
the app can intercept Command-Option-Escape in that situation and
do something else with it.

 

[Stephen Hansen]

Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

IIUC, by definition, Ctrl-Alt-Delete can't be responded to in any way.
Its the entire point of the sequence: when you type it you can be
entirely, totally, 100% certain that what happens next is the true OS
and not any app faking things.

That's why you have to hit CAD to get to the login form in some versions
of Windows. The whole point of that secure sequence is that the OS and
only the OS responds.

--

Stephen Hansen
... Also: Ixokai
... Mail: me+list/python (AT) ixokai (DOT) io
... Blog: http://meh.ixokai.io/


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.10 (Darwin)

iQEcBAEBAgAGBQJOYIBrAAoJEKcbwptVWx/l5H8H/0yU1UvO9vxE+gQqxe0H2qzD
A4hnElThv0NJIsLAtBKs9xFta2vd3FUWteScFQ/yD/fW+6DHvcr/bU55GD6bFw40
eO8XCJR1kna7x3rNXI+QzrnxBq3GA29eFb9WLX2EQxzD6jQcmVO2ivJsYut2CEUy
gpliEp5vS4iS1AIUJoUp0EAuEnpuXBVJGLPAsQyjomT0a8tTZB5bhXgOC8ok7gNA
27awuqAPM4/G8MZE2umQWEFts7djB3O7Chh2cH01m7d1WV0rlMSszmtgUDHRspJL
WSyr5yIIV3QRNlY6iRl5PeuWeXDKwEhFWi6mB2YJIrAU6Rw1SMaOoK7ZFwREElc=
=5U0V
-----END PGP SIGNATURE-----

 

[Chris Angelico]

That's why you have to hit CAD to get to the login form in some versions
of Windows. The whole point of that secure sequence is that the OS and
only the OS responds.

Although I heard somewhere that that's more gimmick than guarantee,
and that it IS possible for an app to hook CAD - just that it's a lot
harder than building a simple window that looks like the login... but
it's pretty easy to fool a lot of people. Just look at the emails in
your spam box one day, find the ones spoofing a bank, and see what a
poor job they do. And yet they work.

ChrisA

 

[Thomas Jollans]

Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

Also, is there a corresponding key-sequence in Mac and Linux? And how
might one detect those too?

On Linux Ctrl+Alt+Delete is typically configured to reboot the machine
when in console mode. In X11 (graphical), as far as I know, it's no
different than other keys. To catch it globally, you'd probably have to
go through the individual window manager.

As m'colleague Nobody mentions, there's also the SysRq feature, but that
always goes straight to the kernel and is, like Ctrl+Alt+Delete on
Windows, impossible to handle in userspace code.

Thomas

 

[sjm]

Obviously, this is a windows-based question.  I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

If you manage to write a program that can detect CTRL-ALT-DEL, please
report it as a bug in Windows! CTRL-ALT-DEL is Windows' "secure
attention sequence" which must only be handled by the OS.

-- Steve

 

[Web Dreamer]

Den a écrit ce jeudi 1 septembre 2011 17:52 dans <6e602a19-8cca-4924-bd95-
(e-mail address removed)> :

Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

Also, is there a corresponding key-sequence in Mac and Linux?

Ctrl-Alt-Syst <- while keeping these 3 pressed alternately press S (Sync
disks) then U (Unmount all partitions) then B (Boot).
For this to work you Need to have it enabled in the kernel and to have the
line:
kernel.sysrq = 1
in /etc/sysctl.conf

And how
might one detect those too?

I "think" you can't as explained by others in this thread.

 

[Tim Golden]

Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
Others have pointed out that this shouldn't really be possible for
reasons of security. (And I agree). However, if what you're really
after is to detect a session switch or a logon then this might
be of some use:

http://timgolden.me.uk/python/win32_how_do_i/track-session-events.html

TJG

 

[Den]

If you manage to write a program that can detect CTRL-ALT-DEL, please
report it as a bug in Windows!  CTRL-ALT-DEL is Windows' "secure
attention sequence" which must only be handled by the OS.

-- Steve

I have already done that, in AutoHotKey ... or at least it used to
work. AHK can detect when a window opened. And when CAD was pressed
the ... well, I've forgotten what it was called ... but a window
opened asking if you wanted to open the task manager, or quit or log
off or what. Then you would know that CAD was pressed. There was
nothing you could do to stop it, but you could at least detect that it
had been pressed.

That's why I was wondering if there was a similar technique which
could be used in Python.

Den

 

[Den]

If you manage to write a program that can detect CTRL-ALT-DEL, please
report it as a bug in Windows!  CTRL-ALT-DEL is Windows' "secure
attention sequence" which must only be handled by the OS.

-- Steve

I'm not trying to hook it or stop it, just detect it.

Den

 

[Den]

Obviously, this is a windows-based question.  I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

Also, is there a corresponding key-sequence in Mac and Linux?  And how
might one detect those too?

Den

I've been doing some more thinking on what I want. This may be a
better explanation. Is there a way of detecting if my program has
lost "focus" (I'm not sure the correct term)? For example, if someone
is typing in my program, but some other program takes control (or CAD
has been pressed) I would like simply to log that. I have no interest
in trying to hijack or interfere with anything, simply log it.

Den

 

[Chris Angelico]

I've been doing some more thinking on what I want.  This may be a
better explanation.  Is there a way of detecting if my program has
lost "focus" (I'm not sure the correct term)?  For example, if someone
is typing in my program, but some other program takes control (or CAD
has been pressed) I would like simply to log that.  I have no interest
in trying to hijack or interfere with anything, simply log it.

Ah, then yes most definitely! If you're writing a GUI program, a
LostFocus event is a normal thing to be able to catch.

Now, if you're writing a console program, that mightn't be so easy.
But certainly you can detect loss of focus to any window that you
control.

ChrisA

 

[Gregory Ewing]

Although I heard somewhere that that's more gimmick than guarantee,
and that it IS possible for an app to hook CAD - just that it's a lot
harder than building a simple window that looks like the login...

And of course it's possible that someone has snuck in
during the night and installed Linux on the machine,
with a program that fakes a Windows login screen,
with Ctrl-Alt-Delete and everything...

 

[Nobody]

Although I heard somewhere that that's more gimmick than guarantee,
and that it IS possible for an app to hook CAD

It's possible to configure how CAD is handled, but this requires
Administrator privilege, so it's not exploitable (i.e. it doesn't gain you
anything you can't obtain by other means).