HidHide

https://docs.nefarius.at/projects/HidHide/
Admin
HidHide is an input device firewall that blocks individual applications from accessing HID and...
Tokens:5,272
Snippets:68
Trust Score:7.1
Update:5 months ago
Show doc for...
Tokens:
Raw
### Install HidHide Driver with nefcon

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Installs the HidHide driver using nefcon. Ensure you are in the directory containing HidHide.inf, HidHide.sys, and HidHide.cat.

```powershell
nefconc install HidHide.inf root\HidHide

```

--------------------------------

### Get Whitelist

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Retrieves the current list of applications allowed to see blocked devices.

```APIDOC
## Get Whitelist

Retrieves the current whitelist/allow-list of absolute DOS device paths to applications which are currently allowed to see blocked devices.

### Parameters

- `dwIoControlCode` (IOCTL_GET_WHITELIST) - The IOCTL code to get the whitelist.
- `lpInBuffer` (NULL) - No input buffer is required.
- `nInBufferSize` (0) - The size of the input buffer is 0.
- `lpOutBuffer` (Pre-allocated buffer) - A buffer to receive the list of whitelisted process paths in DOS device notation as a double-null-terminated wide-character string.
- `nOutBufferSize` (Size of buffer) - The size of the output buffer in bytes.
- `lpBytesReturned` (Pointer to DWORD) - Receives the required buffer size in bytes.
```

--------------------------------

### Obtain HidHide Control Device Handle in C#

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Use the CreateFile Windows API to obtain a handle to the HidHide control device. Ensure PInvoke.Kernel32 is installed. The handle should be closed promptly after operations to avoid blocking other processes.

```C#
using (var handle = Kernel32.CreateFile("\\.\\HidHide",
    Kernel32.ACCESS_MASK.GenericRight.GENERIC_READ,
    Kernel32.FileShare.FILE_SHARE_READ | Kernel32.FileShare.FILE_SHARE_WRITE,
    IntPtr.Zero,
    Kernel32.CreationDisposition.OPEN_EXISTING,
    Kernel32.CreateFileFlags.FILE_ATTRIBUTE_NORMAL,
    Kernel32.SafeObjectHandle.Null
))
{
    // call DeviceIoControl here
}
```

--------------------------------

### Get Blacklist

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Retrieves the current list of Device Instance IDs that are blocked from access.

```APIDOC
## Get Blacklist

Retrieves the current blacklist/block-list/deny-list of Device Instance IDs which are currently blocked access to.

### Parameters

- `dwIoControlCode` (IOCTL_GET_BLACKLIST) - The IOCTL code to get the blacklist.
- `lpInBuffer` (NULL) - No input buffer is required.
- `nInBufferSize` (0) - The size of the input buffer is 0.
- `lpOutBuffer` (Pre-allocated buffer) - A buffer to receive the list of blocked device instance identifiers as a double-null-terminated wide-character string.
- `nOutBufferSize` (Size of buffer) - The size of the output buffer in bytes.
- `lpBytesReturned` (Pointer to DWORD) - Receives the required buffer size in bytes.
```

--------------------------------

### Get Status

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Retrieves the current global status of blocking capabilities. Returns a boolean value indicating if the driver is currently blocking configured devices (`true`) or on pass-through (`false`).

```APIDOC
## Get Status

### Description
Retrieves the current global status of blocking capabilities. Returns a boolean value if the the driver is currently blocking configured devices (`true`) or on pass-through (`false`).

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Method
IOCTL

### Endpoint
`IOCTL_GET_ACTIVE`

### Parameters
#### Input Buffer
- **`lpInBuffer`** (pointer) - `NULL`
- **`nInBufferSize`** (size_t) - `0`

#### Output Buffer
- **`lpOutBuffer`** (pointer) - Gets the current state of the hiding capabilities (`1` = device hiding active, `0` = device hiding inactive).
- **`nOutBufferSize`** (size_t) - `sizeof(BOOLEAN)` (1 byte)

### Request Example
None

### Response
#### Success Response
- **`BOOLEAN`** (byte) - `1` if device hiding is active, `0` if inactive.
```

--------------------------------

### Obtain Control Device Handle

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Demonstrates how to obtain a handle to the HidHide control device using the CreateFile Windows API in C# and C/C++.

```APIDOC
## Obtain Control Device Handle

This section shows how to obtain a handle to the HidHide control device using the `CreateFile` Windows API.

### C# Example
```csharp
// Use e.g. https://github.com/dotnet/pinvoke/
// Install-Package PInvoke.Kernel32
using (var handle = Kernel32.CreateFile("\\.\\HidHide",
    Kernel32.ACCESS_MASK.GenericRight.GENERIC_READ,
    Kernel32.FileShare.FILE_SHARE_READ | Kernel32.FileShare.FILE_SHARE_WRITE,
    IntPtr.Zero,
    Kernel32.CreationDisposition.OPEN_EXISTING,
    Kernel32.CreateFileFlags.FILE_ATTRIBUTE_NORMAL,
    Kernel32.SafeObjectHandle.Null
))
{
    // call DeviceIoControl here
}
```

### C/C++ Example
```cpp
#include <Windows.h>

HANDLE handle = CreateFile(
    "\\.\\HidHide", 
    GENERIC_READ, 
    (FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE), 
    NULL, 
    OPEN_EXISTING, 
    FILE_ATTRIBUTE_NORMAL, 
    NULL);

// call DeviceIoControl here

CloseHandle(handle);
```

**Note:** Exclusive handle access is enforced. Only one process can hold the handle and issue requests at a time. Ensure the handle is closed promptly after operations are completed.
```

--------------------------------

### Set Whitelist

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Submits a new list of applications that will be allowed to see blocked devices.

```APIDOC
## Set Whitelist

Submits a new whitelist/allow-list of absolute DOS device paths to applications which will then be allowed to see blocked devices.

### Parameters

- `dwIoControlCode` (IOCTL_SET_WHITELIST) - The IOCTL code to set the whitelist.
- `lpInBuffer` (Buffer) - A buffer containing the new list of whitelisted process paths in DOS device notation as a double-null-terminated wide-character string.
- `nInBufferSize` (Size of buffer) - The size of the input buffer in bytes.
- `lpOutBuffer` (NULL) - No output buffer is required.
- `nOutBufferSize` (0) - The size of the output buffer is 0.
```

--------------------------------

### Set Blacklist

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Submits a new list of Device Instance IDs to be blocked from access.

```APIDOC
## Set Blacklist

Submits a new blacklist/block-list/deny-list of Device Instance IDs which are then blocked access to.

### Parameters

- `dwIoControlCode` (IOCTL_SET_BLACKLIST) - The IOCTL code to set the blacklist.
- `lpInBuffer` (Buffer) - A buffer containing the new list of blocked device instance identifiers as a double-null-terminated wide-character string.
- `nInBufferSize` (Size of buffer) - The size of the input buffer in bytes.
- `lpOutBuffer` (NULL) - No output buffer is required.
- `nOutBufferSize` (0) - The size of the output buffer is 0.
```

--------------------------------

### Obtain HidHide Control Device Handle in C/C++

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Use the CreateFile Windows API to obtain a handle to the HidHide control device. The handle must be closed using CloseHandle after operations are complete to avoid blocking other processes.

```C/C++
#include <Windows.h>

HANDLE handle = CreateFile(
    "\\.\\HidHide", 
    GENERIC_READ, 
    (FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE), 
    NULL, 
    OPEN_EXISTING, 
    FILE_ATTRIBUTE_NORMAL, 
    NULL);

// call DeviceIoControl here

CloseHandle(handle);
```

--------------------------------

### Add nefcon to PATH

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Adds the directory containing nefcon.exe to the system's PATH environment variable for easier access. This is an optional step.

```powershell
setx PATH "$Env:PATH;C:\Tools\nefcon\ARM64"

```

--------------------------------

### Add XNA Composite Class Filter

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Adds the HidHide filter to the XNA Composite device class. This is relevant for certain game controllers.

```powershell
nefconc --add-class-filter --position upper --service-name HidHide --class-guid d61ca365-5af4-4486-998b-9db4734c6ca3

```

--------------------------------

### Set Status

Source: https://docs.nefarius.at/projects/HidHide/API-Documentation

Submits the new global status of blocking capabilities. Sets a boolean value to indicate if the driver should block configured devices (`true`) or operate on pass-through (`false`).

```APIDOC
## Set Status

### Description
Submits the new global status of blocking capabilities. Sets a boolean value if the the driver is currently blocking configured devices (`true`) or on pass-through (`false`).

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Method
IOCTL

### Endpoint
`IOCTL_SET_ACTIVE`

### Parameters
#### Input Buffer
- **`lpInBuffer`** (pointer) - Sets the new state of the hiding capabilities (`1` = device hiding active, `0` = device hiding inactive).
- **`nInBufferSize`** (size_t) - `sizeof(BOOLEAN)` (1 byte)

#### Output Buffer
- **`lpOutBuffer`** (pointer) - `NULL`
- **`nOutBufferSize`** (size_t) - `0`

### Request Example
None

### Response
#### Success Response
None (operation is acknowledged by absence of errors)
```

--------------------------------

### Remove XNA Composite Class Filter

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Removes the HidHide filter from the XNA Composite device class.

```powershell
nefconc --remove-class-filter --position upper --service-name HidHide --class-guid d61ca365-5af4-4486-998b-9db4734c6ca3

```

--------------------------------

### Add HIDClass Filter

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Adds the HidHide filter to the HIDClass device class. This ensures HidHide intercepts HID device events.

```powershell
nefconc --add-class-filter --position upper --service-name HidHide --class-guid 745a17a0-74d3-11d0-b6fe-00a0c90f57da

```

--------------------------------

### Remove HidHide Device Node

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Removes the HidHide driver package and its associated device nodes from the system.

```powershell
nefconc --remove-device-node --hardware-id root\HidHide --class-guid 4D36E97D-E325-11CE-BFC1-08002BE10318

```

--------------------------------

### Add Xbox Composite Class Filter

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Adds the HidHide filter to the Xbox Composite device class. This is relevant for Xbox controllers.

```powershell
nefconc --add-class-filter --position upper --service-name HidHide --class-guid 05f5cfe2-4733-4950-a6bb-07aad01a3a84

```

--------------------------------

### Remove Xbox Composite Class Filter

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Removes the HidHide filter from the Xbox Composite device class.

```powershell
nefconc --remove-class-filter --position upper --service-name HidHide --class-guid 05f5cfe2-4733-4950-a6bb-07aad01a3a84

```

--------------------------------

### Remove HIDClass Filter

Source: https://docs.nefarius.at/projects/HidHide/Manual-Installation-ARM64

Removes the HidHide filter from the HIDClass device class.

```powershell
nefconc --remove-class-filter --position upper --service-name HidHide --class-guid 745a17a0-74d3-11d0-b6fe-00a0c90f57da

```
Tokens:
Raw