MouseHook+SendInput stopped working after fresh reinstall of Win7 x64

Question

I coded a small KeyMapper some month ago which was used on my desktop-PC and Notebook (PC: Win7 x64, Notebook: Win8.1 x64). It was always working flawless untill i decided to reinstall Windows on my main PC (from Win7 64bit to (again) Win7 x64).

So here is the code:

private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
{
    if (nCode >= 0)
    {
        if ((int)wParam == WM_MOUSEMOVE)
        {
            var hookStruct = (MSLLHOOKSTRUCT)Marshal.PtrToStructure(lParam, typeof(MSLLHOOKSTRUCT));
            Debug.WriteLine("dwExtraInfo: " + hookStruct.dwExtraInfo);

            // block all MouseEvents with dwExtraInfo not IntPtr(555)
            try
            {
                if (hookStruct.dwExtraInfo != new IntPtr(555))
                    return new IntPtr(1);
            }
            catch (Exception ex){ }                     
        }
    }
    // let all other mousemessages pass
    return CallNextHookEx(_hookID, nCode, wParam, lParam);
}

As you see i am filtering all MouseMoveMessages. My SendInput function sends custom MouseMoveMessages with ExtraInfo set to a random value (here 555) which should pass this filter.

INPUT[] iMM = new INPUT[1]
iMM[0].type = InputType.INPUT_MOUSE;
iMM[0].mkhi.mi.dx = 500;  // example
iMM[0].mkhi.mi.dy = 500;  // example
iMM[0].mkhi.mi.mouseData = 0;
iMM[0].mkhi.mi.dwFlags = (MOUSEEVENTF.MOVE | MOUSEEVENTF.ABSOLUTE);
iMM[0].mkhi.mi.time = 0;                                                   
iMM[0].mkhi.mi.dwExtraInfo = new IntPtr(555);

// Install MouseHook
LowLevelMouseProc _proc = HookCallback;
_hookID = SetWindowsHookEx(WH_MOUSE_LL, _proc, GetModuleHandle("user32"), 0);

// send MouseMessage
SendInput(1, iMM, Marshal.SizeOf(new INPUT()));

Whats going wrong: After the reinstall of Win7 64-bit dwExtraInfo is totally screwed, it shows values like -11054848 (when defined as IntPtr) and 4283912448 (when defined as UIntPtr). Please note that it was working for months before the reinstall and is still working in my Notebook.

I already tested the size of all objects (INPUT-struct, MSLLHOOKSTRUCT, dwExtraInfo...) but they are exactly the same on both machines. Target Platform is x86, Framework is 4.0.

On my Notebook (Win8.1 x64) everything is still working as intended, SendInput sends MouseMove messages which gets catched off and filtered by the LowLevelHook. dwExtraInfo is 555.

Answer 1

The general strategy to starting solving a problem like this is to convert the magic number to hex. You get 0xFF575100. Which is a number that Google really likes, it takes you straight to this MSDN Forums post.

Long story short, you acquired a broken security patch, MS14-039. Identified by a PenPower engineer:

After update KB2973201, Windows will return "0XFF575100" and mouse does not work properly
dwExtraInfo = 0XFF575100

Microsoft released a fix for the problem, described here. If you still have trouble and then follow-up at superuser.com or contact Microsoft Support directly.