[Windows Mobile Development and Hacking General] vertur:
Hi all!

I disassembled shell32.exe (WM2005, 5.1.70) and found some dependence with "hardware" key name ( ...\Keys\40C1, ...\Keys\40C2, ...) and VK_APPn call sequences.

What is "40C1" ?

The low byte is the VK_APP1 virtual key code, the high byte is "some flags".

"Some flags"

0x40 <=> VK_LWIN is pressed

0x20 <=> VK_MENU is pressed

0x08 <=> VK_CONTROL is pressed

0x04 <=> VK_SHIFT is pressed

Example

All Windows Mobile devices have (by default) HKLM\Software\Microsoft\Shell\Keys\40Cx register keys for description hardware keys. For example, you have corrected description of hardware_key_1 in HKLM\Software\Microsoft\Shell\Keys\40C1, and, you want manualy call application binded to hardware_key_1.

If you do

keybd_event(VK_APP1, 0, 0, 0);
keybd_event(VK_APP1, 0, KEYEVENTF_KEYUP, 0);

- you get nothing, no result.

In order of correct solution, you MUST do next code:

keybd_event(VK_LWIN, 0, 0, 0);
keybd_event(VK_APP1, 0, 0, 0);
keybd_event(VK_APP1, 0, KEYEVENTF_KEYUP, 0);
keybd_event(VK_LWIN, 0, KEYEVENTF_KEYUP, 0);

IDA dump listed below:

.text:000487D8 ; --------------- S U B R O U T I N E ---------------------------------------
.text:000487D8
.text:000487D8
.text:000487D8 IsKey_VK_APPn ; CODE XREF: sub_48908+50p
.text:000487D8
.text:000487D8 var_238 = -0x238
.text:000487D8 var_234 = -0x234
.text:000487D8 var_230 = -0x230
.text:000487D8 var_22C = -0x22C
.text:000487D8 var_228 = -0x228
.text:000487D8 var_224 = -0x224
.text:000487D8 var_220_szBuf = -0x220
.text:000487D8 var_18 = -0x18
.text:000487D8
.text:000487D8 F0 40 2D E9 STMFD SP!, {R4-R7,LR}
.text:000487DC 89 DF 4D E2 SUB SP, SP, #0x224
.text:000487E0 01 70 A0 E1 MOV R7, R1
.text:000487E4 00 60 A0 E1 MOV R6, R0
.text:000487E8 14 31 9F E5 LDR R3, =dword_4DE54
.text:000487EC 00 30 93 E5 LDR R3, [R3]
.text:000487F0 20 32 8D E5 STR R3, [SP,#0x238+var_18]
.text:000487F4 5B 00 A0 E3 MOV R0, #0x5B ; VK_LWIN
.text:000487F8 00 50 A0 E3 MOV R5, #0
.text:000487FC 00 40 A0 E3 MOV R4, #0
.text:00048800 45 09 00 EB BL GetKeyState ; SHORT GetKeyState(
.text:00048800 ; int nVirtKey
.text:00048800 ; );
.text:00048804 00 38 A0 E1 MOV R3, R0,LSL#16
.text:00048808 23 38 B0 E1 MOVS R3, R3,LSR#16
.text:0004880C 12 00 A0 E3 MOV R0, #0x12 ; VK_MENU
.text:00048810 40 40 A0 13 MOVNE R4, #0x40
.text:00048814 40 09 00 EB BL GetKeyState ; SHORT GetKeyState(
.text:00048814 ; int nVirtKey
.text:00048814 ; );
.text:00048818 00 38 A0 E1 MOV R3, R0,LSL#16
.text:0004881C 23 38 B0 E1 MOVS R3, R3,LSR#16
.text:00048820 11 00 A0 E3 MOV R0, #0x11 ; VK_CONTROL
.text:00048824 20 40 84 13 ORRNE R4, R4, #0x20
.text:00048828 3B 09 00 EB BL GetKeyState ; SHORT GetKeyState(
.text:00048828 ; int nVirtKey
.text:00048828 ; );
.text:0004882C 00 28 A0 E1 MOV R2, R0,LSL#16
.text:00048830 22 28 B0 E1 MOVS R2, R2,LSR#16
.text:00048834 10 00 A0 E3 MOV R0, #0x10 ; VK_SHIFT
.text:00048838 08 40 84 13 ORRNE R4, R4, #8
.text:0004883C 36 09 00 EB BL GetKeyState ; SHORT GetKeyState(
.text:0004883C ; int nVirtKey
.text:0004883C ; );
.text:00048840 00 28 A0 E1 MOV R2, R0,LSL#16
.text:00048844 22 28 B0 E1 MOVS R2, R2,LSR#16
.text:00048848 B0 20 9F E5 LDR R2, =aSoftwareMic_12 ;
.text:00048848 ; Software\Microsoft\Shell\Keys
.text:0004884C A8 10 9F E5 LDR R1, =aS2_2x2_2x ; %s\%2.2X%2.2X
.text:00048850 04 40 84 13 ORRNE R4, R4, #4
.text:00048854 04 30 A0 E1 MOV R3, R4
.text:00048858 18 00 8D E2 ADD R0, SP, #0x238+var_220_szBuf
.text:0004885C 00 70 8D E5 STR R7, [SP,#0x238+var_238]
.text:00048860 85 09 00 EB BL wsprintfW
.text:00048864 08 30 8D E2 ADD R3, SP, #0x238+var_230
.text:00048868 00 30 8D E5 STR R3, [SP,#0x238+var_238]
.text:0004886C 00 30 A0 E3 MOV R3, #0
.text:00048870 00 20 A0 E3 MOV R2, #0
.text:00048874 18 10 8D E2 ADD R1, SP, #0x238+var_220_szBuf
.text:00048878 0A 01 A0 E3 MOV R0, #0x80000002
.text:0004887C CE 06 00 EB BL RegOpenKeyExW
.text:00048880 00 00 50 E3 CMP R0, #0
.text:00048884 15 00 00 1A BNE loc_488E0
.text:00048888 04 30 A0 E3 MOV R3, #4
.text:0004888C 10 30 8D E5 STR R3, [SP,#0x238+var_228]
.text:00048890 01 0C 56 E3 CMP R6, #0x100
.text:00048894 0F 00 00 1A BNE loc_488D8
.text:00048898 58 10 9F E5 LDR R1, =aFlags
.text:0004889C 08 00 9D E5 LDR R0, [SP,#0x238+var_230]
.text:000488A0 10 E0 8D E2 ADD LR, SP, #0x238+var_228
.text:000488A4 0C 40 8D E2 ADD R4, SP, #0x238+var_22C
.text:000488A8 14 30 8D E2 ADD R3, SP, #0x238+var_224
.text:000488AC 00 20 A0 E3 MOV R2, #0
.text:000488B0 04 E0 8D E5 STR LR, [SP,#0x238+var_234]
.text:000488B4 00 40 8D E5 STR R4, [SP,#0x238+var_238]
.text:000488B8 F7 05 00 EB BL RegQueryValueExW
.text:000488BC 00 00 50 E3 CMP R0, #0
.text:000488C0 04 00 00 1A BNE loc_488D8
.text:000488C4 0C 30 9D E5 LDR R3, [SP,#0x238+var_22C]
.text:000488C8 01 00 13 E3 TST R3, #1
.text:000488CC 01 00 00 0A BEQ loc_488D8
.text:000488D0 AB FF FF EB BL sub_48784
.text:000488D4 01 50 A0 E3 MOV R5, #1
.text:000488D8
.text:000488D8 loc_488D8 ; CODE XREF: IsKey_VK_APPn+BCj
.text:000488D8 ; IsKey_VK_APPn+E8j ...
.text:000488D8 08 00 9D E5 LDR R0, [SP,#0x238+var_230]
.text:000488DC B2 06 00 EB BL RegCloseKey
.text:000488E0
.text:000488E0 loc_488E0 ; CODE XREF: IsKey_VK_APPn+ACj
.text:000488E0 20 02 9D E5 LDR R0, [SP,#0x238+var_18]
.text:000488E4 87 05 00 EB BL sub_49F08
.text:000488E8 05 00 A0 E1 MOV R0, R5
.text:000488EC 89 DF 8D E2 ADD SP, SP, #0x224
.text:000488F0 F0 40 BD E8 LDMFD SP!, {R4-R7,LR}
.text:000488F4 1E FF 2F E1 BX LR
.text:000488F4 ; End of function IsKey_VK_APPn
.text:000488F4