disclaimer, I am a bit new to kernel and driver programing so excuse me if I don’t use the correct terms.

I am trying to write a keyboard filter driver in windows 10 that will log and save the user’s keystrokes.

what I want to do is basically read the info from the IRP that contains the keystroke, that will be done by setting up a dispatch routine for IRP_MJ_READ with my own dispatch routine fucntion. However I don’t really understand where the info about the keyatroke is in the IRP and how I can accsess it.

As most of you know, this is how an IRP looks like :

    typedef struct _IRP {
    CSHORT Type;
    USHORT Size;
    PMDL MdlAddress;
    ULONG Flags;
    union {
        struct _IRP *MasterIrp;
        LONG IrpCount;
        PVOID SystemBuffer;
    } AssociatedIrp;
    LIST_ENTRY ThreadListEntry;
    IO_STATUS_BLOCK IoStatus;
    KPROCESSOR_MODE RequestorMode;
    BOOLEAN PendingReturned;
    CHAR StackCount;
    CHAR CurrentLocation;
    BOOLEAN Cancel;
    KIRQL CancelIrql;
    CCHAR ApcEnvironment;
    UCHAR AllocationFlags;
    PIO_STATUS_BLOCK UserIosb;
    PKEVENT UserEvent;
    union {
        struct {
            PIO_APC_ROUTINE UserApcRoutine;
            PVOID UserApcContext;
        } AsynchronousParameters;
        LARGE_INTEGER AllocationSize;
    } Overlay;
    PDRIVER_CANCEL CancelRoutine;
    PVOID UserBuffer;
    union {
        struct {
            union {
                KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
                struct {
                    PVOID DriverContext[4];
                };
            };
            PETHREAD Thread;
            PCHAR AuxiliaryBuffer;
            struct {
                LIST_ENTRY ListEntry;
                union {
                    struct _IO_STACK_LOCATION *CurrentStackLocation;
                    ULONG PacketType;
                };
            };
            PFILE_OBJECT OriginalFileObject;
        };
    } Tail;
} IRP, *PIRP;

Using another question asked on here long ago about about a filter driver for a mouse (this is the question How can I modfy mouse_input_data in irp) I assume that the info is here Irp->AssociatedIrp.SystemBuffer but how can I read it? and is it even a correct assumption? considering that the user that asked that question had problems with their code.