Detecting simulated keyboard/mouse input

The only way to distinguish between “real” input and “simulated” input (assuming it is being generated with keybd_event()/mouse_event() or SendInput()) is to use a low-level keyboard/mouse hook via SetWindowsHookEx(). The WH_KEYBOARD_LL and WH_MOUSE_LL hook callbacks provide INJECTED flags for simulated input.

Leave a Comment