Detecting Ctrl-Alt-Del in Windows

[Den]

Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

Also, is there a corresponding key-sequence in Mac and Linux? And how
might one detect those too?

Den

[Nobody]

Post by Den
Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

Not reliably. You might infer that Ctrl-Alt-Del has been used by the way
that certain operations behave, but that's fairly error-prone.

Post by Den
Also, is there a corresponding key-sequence in Mac and Linux? And how
might one detect those too?

I don't know about Mac. Linux has some support for Ctrl-Alt-Del on the
console, and the optional "Magic SysRq" feature. But there's no easy way
to detect these (if the sequence is recognised by the kernel, it's not
reported by the usual mechanisms).

[Gregory Ewing]

Post by Den
Also, is there a corresponding key-sequence in Mac and Linux?

The nearest equivalent in MacOSX is Command-Option-Escape, which
brings up the force-quit dialog. I don't know how deep down in
the system it's implemented.

It's possible to use SetSystemUIMode to put an app into a "kiosk
mode" where force-quitting is disabled, but I don't know whether
the app can intercept Command-Option-Escape in that situation and
do something else with it.

[Stephen Hansen]

Post by Den
Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

IIUC, by definition, Ctrl-Alt-Delete can't be responded to in any way.
Its the entire point of the sequence: when you type it you can be
entirely, totally, 100% certain that what happens next is the true OS
and not any app faking things.

That's why you have to hit CAD to get to the login form in some versions
of Windows. The whole point of that secure sequence is that the OS and
only the OS responds.
--
Stephen Hansen
... Also: Ixokai
... Mail: me+list/python (AT) ixokai (DOT) io
... Blog: http://meh.ixokai.io/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 487 bytes
Desc: OpenPGP digital signature
URL: <http://mail.python.org/pipermail/python-list/attachments/20110902/6c0ebc09/attachment.pgp>

[Chris Angelico]

Post by Stephen Hansen
That's why you have to hit CAD to get to the login form in some versions
of Windows. The whole point of that secure sequence is that the OS and
only the OS responds.

Although I heard somewhere that that's more gimmick than guarantee,
and that it IS possible for an app to hook CAD - just that it's a lot
harder than building a simple window that looks like the login... but
it's pretty easy to fool a lot of people. Just look at the emails in
your spam box one day, find the ones spoofing a bank, and see what a
poor job they do. And yet they work.

ChrisA

[Gregory Ewing]

Post by Chris Angelico
Although I heard somewhere that that's more gimmick than guarantee,
and that it IS possible for an app to hook CAD - just that it's a lot
harder than building a simple window that looks like the login...

And of course it's possible that someone has snuck in
during the night and installed Linux on the machine,
with a program that fakes a Windows login screen,
with Ctrl-Alt-Delete and everything...

[Nobody]

Post by Chris Angelico

Post by Stephen Hansen
That's why you have to hit CAD to get to the login form in some versions
of Windows. The whole point of that secure sequence is that the OS and
only the OS responds.

Although I heard somewhere that that's more gimmick than guarantee,
and that it IS possible for an app to hook CAD

It's possible to configure how CAD is handled, but this requires
Administrator privilege, so it's not exploitable (i.e. it doesn't gain you
anything you can't obtain by other means).

[Thomas Jollans]

Post by Den
Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?
Also, is there a corresponding key-sequence in Mac and Linux? And how
might one detect those too?

On Linux Ctrl+Alt+Delete is typically configured to reboot the machine
when in console mode. In X11 (graphical), as far as I know, it's no
different than other keys. To catch it globally, you'd probably have to
go through the individual window manager.

As m'colleague Nobody mentions, there's also the SysRq feature, but that
always goes straight to the kernel and is, like Ctrl+Alt+Delete on
Windows, impossible to handle in userspace code.

Thomas

[sjm]

Obviously, this is a windows-based question. ?I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

If you manage to write a program that can detect CTRL-ALT-DEL, please
report it as a bug in Windows! CTRL-ALT-DEL is Windows' "secure
attention sequence" which must only be handled by the OS.

-- Steve

[Den]

Post by sjm

Obviously, this is a windows-based question. ?I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

If you manage to write a program that can detect CTRL-ALT-DEL, please
report it as a bug in Windows! ?CTRL-ALT-DEL is Windows' "secure
attention sequence" which must only be handled by the OS.
-- Steve

I have already done that, in AutoHotKey ... or at least it used to
work. AHK can detect when a window opened. And when CAD was pressed
the ... well, I've forgotten what it was called ... but a window
opened asking if you wanted to open the task manager, or quit or log
off or what. Then you would know that CAD was pressed. There was
nothing you could do to stop it, but you could at least detect that it
had been pressed.

That's why I was wondering if there was a similar technique which
could be used in Python.

Den

[Den]

Post by sjm

Obviously, this is a windows-based question. ?I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

If you manage to write a program that can detect CTRL-ALT-DEL, please
report it as a bug in Windows! ?CTRL-ALT-DEL is Windows' "secure
attention sequence" which must only be handled by the OS.
-- Steve

I'm not trying to hook it or stop it, just detect it.

Den

[Tim Golden]

Post by Den
Obviously, this is a windows-based question. I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?

Others have pointed out that this shouldn't really be possible for
reasons of security. (And I agree). However, if what you're really
after is to detect a session switch or a logon then this might
be of some use:

http://timgolden.me.uk/python/win32_how_do_i/track-session-events.html

TJG

[Den]

Obviously, this is a windows-based question. ?I know that Ctrl-Alt-Del
is handled deep inside the OS, and I'm not trying to interrupt that.
But is there some way to detect that a C-A-D has been pressed?
Also, is there a corresponding key-sequence in Mac and Linux? ?And how
might one detect those too?
Den

I've been doing some more thinking on what I want. This may be a
better explanation. Is there a way of detecting if my program has
lost "focus" (I'm not sure the correct term)? For example, if someone
is typing in my program, but some other program takes control (or CAD
has been pressed) I would like simply to log that. I have no interest
in trying to hijack or interfere with anything, simply log it.

Den

[Chris Angelico]

I've been doing some more thinking on what I want. ?This may be a
better explanation. ?Is there a way of detecting if my program has
lost "focus" (I'm not sure the correct term)? ?For example, if someone
is typing in my program, but some other program takes control (or CAD
has been pressed) I would like simply to log that. ?I have no interest
in trying to hijack or interfere with anything, simply log it.

Ah, then yes most definitely! If you're writing a GUI program, a
LostFocus event is a normal thing to be able to catch.

Now, if you're writing a console program, that mightn't be so easy.
But certainly you can detect loss of focus to any window that you
control.

ChrisA