I did it differently, but you can give it a try,
KbFilter_IsrHook(
PDEVICE_OBJECT DeviceObject,
PKEYBOARD_INPUT_DATA CurrentInput,
POUTPUT_PACKET CurrentOutput,
UCHAR StatusByte,
PUCHAR DataByte,
PBOOLEAN ContinueProcessing,
PKEYBOARD_SCAN_STATE ScanState
)
*DataByte
gives you the actual intercepted keyboard value. You can create a buffer and add to it in a
DPCforISR
. Once in a while you can have IOCTL call from your application and write it to file.