- Status
- Offline
- Joined
- Mar 3, 2026
- Messages
- 104
- Reaction score
- 7
Anyone else diving into kernel-mode input lately? Been trying to move away from usermode mouse_event and SendInput because Vanguard and EAC are eating them alive during internal manual maps.
I am currently working on a driver-based input solution for a manual map project using KDMapper and wanted to see what the general consensus is on the most reliable approach for mouse movement. I want to keep this as stealthy as possible to avoid behavioral triggers.
Current options I am weighing:
The goal is to handle the movement in kernel space to bypass those pesky usermode hooks. I am already using a private mapper, but the input vector is my current weak point.
Has anyone here successfully moved their mouse via a custom driver without getting hit by a behavioral analysis ban? Are you guys using a specific method to humanize the movements inside the kernel, or are you just sending raw packets and praying?
Drop your experiences or point me toward some clean src if you've got a repo that isn't a total paste. Trying to avoid those instant frog bans.
I am currently working on a driver-based input solution for a manual map project using KDMapper and wanted to see what the general consensus is on the most reliable approach for mouse movement. I want to keep this as stealthy as possible to avoid behavioral triggers.
Current options I am weighing:
- HIDClass/HIDUSB drivers: Standard way to simulate a physical HID device. Seems like a solid route for KMBox/Fuser setups, but how is the stability for pure software-based kernel input?
- Direct IRPs to mousclass: Hooking the IRP flow directly. A bit more intrusive and easier for some ACs to track if they monitor the driver stack, but usually gets the job done without extra hardware.
- KMBox/Net integration: Considering picking up a hardware box if the software route gets flagged too quickly. Has anyone here had luck with pure software-kernel inputs remaining UD for long, or is it basically asking for a manual ban?
The goal is to handle the movement in kernel space to bypass those pesky usermode hooks. I am already using a private mapper, but the input vector is my current weak point.
Has anyone here successfully moved their mouse via a custom driver without getting hit by a behavioral analysis ban? Are you guys using a specific method to humanize the movements inside the kernel, or are you just sending raw packets and praying?
Drop your experiences or point me toward some clean src if you've got a repo that isn't a total paste. Trying to avoid those instant frog bans.
