Working Apc Back

Keystroke monitoring

Written by:
Vladimir Sabanov,
Junior Software Developer of Network Security Team

In this article we will consider the methods of hooking keyboard data in the kernel mode. The described approaches can be used for solving the tasks of keystroke analysis, blocking and also redefining some combinations.

Table of Content

• Devices and drivers
• Method 1 (the simplest): IRP and driver stack
  • Attaching the unknown keyboard device
  • I/O completion routine
  • Log information storage
  • APC routine patch and example of  active window detection
• Method 2 (universal): kbdclass.sys driver patch
• About WDM keyboard filter
• Demo project class architecture
• Supported MS Windows Versions
• Recommended reading

2. Devices and drivers

Before starting to implement hooking it's necessary to understand how the interaction between devices and drivers is performed.

Drivers frequently have multilevel architecture and represent stack based on the driver that works directly with the device. The task of the underlying driver is to read data from the device and transmit them upwards by the stack for the further processing.

The scheme beneath represents the relations between drivers and devices for PS/2 and USB keyboards, but this model is the same for any other device.

The task of the port driver (i8042prt and usbhid) is to get all data stored in the keyboard buffer and transmit them upwards by the chain of drivers. Data exchange between drives is performed by means of IRP, that are moving in the stack in both directions. After reaching the top of the stack data from IRP are copied to the user space in the context of csrss service, and then are transmitted to the active application as the window message. Thus placing our own driver in this chain we get possibility not only to hook keystrokes but also replace them by our own or block.

3. Method 1 (the simplest): IRP and driver stack

IRP is created in the moment when I/O Manager sends its request. The first to accept IRP is the highest driver in the stack, and correspondingly the last one to get it is the driver responsible for the interaction with the real device. By the moment of IRP creation the number of drivers in the stack is known. I/O Manager allocates some space in IRP for IO_STACK_LOCATION structure for each driver. Also the index and pointer of the current IO_STACK_LOCATION structure are stored in the IRP header.

As it was mentioned before the drivers form the chain with IRP as the data medium. Correspondingly the simplest way to hook data from the device driver (and keyboard driver in particular) is to attach own specially developed driver to the stack with the existing ones.

3.1. Attaching the unknown keyboard device

To attach the device to the existing chain we should create it first:

PDEVICE_OBJECT pKeyboardDeviceObject = NULL;
NTSTATUS lStatus = IoCreateDevice(pDriverObject,
0,
NULL,
FILE_DEVICE_KEYBOARD,
0,
FALSE,
&pKeyboardDeviceObject);

To attach the device to the stack it is recommended to use the call of IoAttachDeviceToDeviceStack. But first we should get the pointer of the device class:

UNICODE_STRING usClassName;

RtlInitUnicodeString(&usClassName, L"\Device\KeyboardClass0");

PDEVICE_OBJECT pClassDeviceObject = NULL;
PFILE_OBJECT pClassFileObject = NULL;

//Get pointer for \Device\KeyboardClass0
lStatus = IoGetDeviceObjectPointer(&usClassName,
FILE_READ_DATA,
&pClassFileObject,
&pClassDeviceObject);

if (!NT_SUCCESS(lStatus)){
throw(std::runtime_error(
"[KBHookDriver]Cannot get device object of \Device\KeyboardClass0."));
}

g_pFilterManager = new CFilterManager();
g_pSimpleHookObserver = new CKeyLoggerObserver(L"\DosDevices\c:\KeyboardClass0.log");
g_pFilterManager->RegisterFilter(pKeyboardDeviceObject,
pClassDeviceObject,
g_pSimpleHookObserver);
g_pFilterManager->GetFilter(pKeyboardDeviceObject)->AttachFilter();

You should pay attention that we get the pointer to the device DeviceKeyboardClass0, that is PS/2 keyboard. It’s the only class, pointer to which can be obtained directly (how to hook the packages sent by USB keyboard will be described in the section 4).

And then:

void CKBFilterObject::AttachFilter(void){

m_pNextDevice = IoAttachDeviceToDeviceStack(m_pKBFilterDevice, m_pNextDevice);

if (m_pNextDevice == NULL){
throw(std::runtime_error("[KBHookDriver]Cannot attach filter."));
}

m_bIsAttached = true;

return;
}

Thus the current IRP handlers registered for our driver will get the packages containing the information about the keyboard controller events.

3.2 I/O completion routine

To read data from the keyboard controller (i8042prt or usbhid) the driver of the class (kbdclass) sends IRP_MJ_READ request to the port driver. Kbdclass is also the filter and is absolutely “transparent”. It’s naturally to assume that we should hook the needed IRP when scan codes are already written and the package is going upwards by the stack. For this purpose the functions of I/O completion exist (I/O completion routine). I/O completion routine is called after the current I/O request is completed (IoCompleteRequest).

The registration of I/O completion routine is performed as follows:

void IOCompletionRoutine(IIRPProcessor *pContext, PIRP pIRP){

//Copy parameters to low level driver
IoCopyCurrentIrpStackLocationToNext(pIRP);

//Set I/O completion routine
IoSetCompletionRoutine(pIRP, OnReadCompletion, pContext, TRUE, TRUE, TRUE);

//Increment pending IRPs count
pContext->AddPendingPacket(pIRP);

return;

}

And at the end it’s necessary to transmit IRP down by the stack:

return(IofCallDriver(m_pNextDevice, pIRP));

3.3 Log information store

In the demo project all information about keystrokes is saved to the file, but for the better code flexibility the handler of keyboard events implements the interface of IKBExternalObserver and basically can perform any actions with the hooked data.

The function of the completion and processing of the hooked data:

static NTSTATUS OnReadCompletion(PDEVICE_OBJECT pDeviceObject, PIRP pIRP, PVOID pContext){
IIRPProcessor *pIRPProcessor = (IIRPProcessor*)pContext;

//Checks completion status success
if (pIRP->IoStatus.Status == STATUS_SUCCESS){
PKEYBOARD_INPUT_DATA keys = (PKEYBOARD_INPUT_DATA)pIRP->AssociatedIrp.SystemBuffer;

//Get data count
unsigned int iKeysCount = pIRP->IoStatus.Information / sizeof(KEYBOARD_INPUT_DATA);

for (unsigned int iCounter = 0; iCounter < iKeysCount; ++iCounter){
KEY_STATE_DATA keyData;

keyData.pusScanCode = &keys[iCounter].MakeCode;

//If key have been pressed up, it’s marked with flag KEY_BREAK
if (keys[iCounter].Flags & KEY_BREAK){
keyData.bPressed = false;
}
else{
keyData.bPressed = true;
}

try{
//OnProcessEvent is a method of IKBExternalObserver.
pIRPProcessor->GetDeviceObserver()->OnProcessEvent(keyData);
keys[iCounter].Flags = keyData.bPressed ? KEY_MAKE : KEY_BREAK;
}
catch(std::exception& ex){
DbgPrint("[KBHookLib]%sn", ex.what());
}
}
}

if(pIRP->PendingReturned){
IoMarkIrpPending(pIRP);
}

pIRPProcessor->RemovePendingPacket(pIRP);

return(pIRP->IoStatus.Status);
}

3.4 APC Routine patch

Besides the documented method of IRP completion using I/O completion routine, there exists also more flexible however undocumented way – APC routine patch.

When completing IRP, besides the call of the registered I/O completion routine, pIRP->Overlay.AsynchronousParameters.UserApcRoutine is called in the csrss context anisochronously. Correspondingly the replacing of this function is as follows:

void APCRoutinePatch(IIRPProcessor *pIRPProcessor, PIRP pIRP){
CAPCContext *pContext =
new CAPCContext(pIRP->Overlay.AsynchronousParameters.UserApcContext,
pIRP->Overlay.AsynchronousParameters.UserApcRoutine,
pIRP->UserBuffer,
pIRPProcessor->GetDeviceObserver(),
pIRP);

pIRP->Overlay.AsynchronousParameters.UserApcRoutine = Patch_APCRoutine;
pIRP->Overlay.AsynchronousParameters.UserApcContext = pContext;

return;
}

The handler is almost the same to the I/O completion dispatch:

void NTAPI Patch_APCRoutine(PVOID pAPCContext,
PIO_STATUS_BLOCK pIoStatusBlock,
ULONG ulReserved){
std::auto_ptr<CAPCContext> pContext((CAPCContext*)pAPCContext);
PKEYBOARD_INPUT_DATA pKeyData =
PKEYBOARD_INPUT_DATA)pContext->GetUserBuffer();
KEY_STATE_DATA keyData;

keyData.pusScanCode = &pKeyData->MakeCode;

if (pKeyData->Flags == KEY_MAKE){
keyData.bPressed = true;
}
else{
if (pKeyData->Flags == KEY_BREAK){
keyData.bPressed = false;
}
else{
pContext->GetOriginalAPCRoutine()(pContext->GetOriginalAPCContext(),
pIoStatusBlock,
ulReserved);

return;
}
}

try{
pContext->GetObserver()->OnProcessEvent(keyData);
pKeyData->Flags = keyData.bPressed ? KEY_MAKE : KEY_BREAK;
}
catch(std::exception& ex){
DbgPrint("[KBHookLib]%sn", ex.what());
}

pContext->GetOriginalAPCRoutine()(pContext->GetOriginalAPCContext(),
pIoStatusBlock,
ulReserved);

return;

}

In APC routine there is a possibility to detect the current active window where the keystroke was performed.  It can be performed by calling NtUserGetForegroundWindow, that is located in SSDT Shadow. SSDT Shadow is not exported by the graphical subsystem (win32k.sys), but it can be called in the csrss context by means of SYSENTER. For Windows XP it will be like this:

__declspec(naked) HANDLE NTAPI NtUserGetForegroundWindow(void){
__asm{
mov eax, 0x1194; //NtUserGetForegroundWindows number in SSDT Shadow for Windows XP
int 2eh; //Call SYSENTER gate
retn;
}
}
………
PEPROCESS pProcess = PsGetCurrentProcess();
KAPC_STATE ApcState;

KeStackAttachProcess(pProcess, &ApcState);

HANDLE hForeground = NtUserGetForegroundWindow(); //returns HWND of current window

KeUnstackDetachProcess(&ApcState);
………

To make the process of getting the active window universal it’s necessary to implement the search for NtUserGetForegroundWindow function in SSDT Shadow or get its number from Ntdll.dll.

4. Method 2 (universal): kbdclass.sys driver patch

Direct utilizing of the previously described methods without any additional implementations is possible only for PS/2 keyboards since only pointer to DeviceKeyboardClass0 can be obtained directly. Unfortunately it’s impossible for USB keyboards. But after research of this question I came to the rather simple and natural solution: if the driver of the class kbdclass.sys gets all data from the port drivers (usbhid, i8042prt etc.), then we can hook its handlers IRP_MJ_READ.

It’s easy to do it:

void CKbdclassHook::Hook(void){
UNICODE_STRING usKbdClassDriverName;

RtlInitUnicodeString(&usKbdClassDriverName, m_wsClassDrvName.c_str());

//Get pointer to class driver object
NTSTATUS lStatus = ObReferenceObjectByName(&usKbdClassDriverName,
OBJ_CASE_INSENSITIVE,
NULL,
0,
(POBJECT_TYPE)IoDriverObjectType,
KernelMode,
NULL,
(PVOID*)&m_pClassDriver);

if (!NT_SUCCESS(lStatus)){
throw(std::exception("[KBHookLib]Cannot get driver object by name."));
}

KIRQL oldIRQL;

KeRaiseIrql(HIGH_LEVEL, &oldIRQL);

//IRP_MJ_READ patching
m_pOriginalDispatchRead = m_pClassDriver->MajorFunction[IRP_MJ_READ];
m_pClassDriver->MajorFunction[IRP_MJ_READ] = m_pHookCallback;

m_bEnabled = true;

KeLowerIrql(oldIRQL);

return;
}

Thus the handler IRP_MJ_READ for kbdclass.sys is our function, pointer to which is stored in m_pHookCallback.

Handler:

NTSTATUS CKbdclassHook::Call_DispatchRead(PDEVICE_OBJECT pDeviceObject, PIRP pIRP){
//KBDCLASS_DEVICE_EXTENSION is equal DEVICE_EXTENSION for kbdclass from DDK
PKBDCLASS_DEVICE_EXTENSION pDevExt =
(PKBDCLASS_DEVICE_EXTENSION)pDeviceObject->DeviceExtension;

if (pIRP->IoStatus.Status == STATUS_SUCCESS){
PKEYBOARD_INPUT_DATA key = (PKEYBOARD_INPUT_DATA)pIRP->UserBuffer;
KEY_STATE_DATA keyData;

keyData.pusScanCode = &key->MakeCode;

if (key->Flags & KEY_BREAK){
keyData.bPressed = false;
}
else{
keyData.bPressed = true;
}

m_pObserver->OnProcessEvent(pDevExt->TopPort, keyData);
}

//Original function calling for data translation to user space.
return(m_pOriginalDispatchRead(pDeviceObject, pIRP));
}

In the case when the information about the lowest driver in the stack is important, it can be get from the structure DEVICE_EXTENSION from the project kbdclass.sys in DDK.

5. About WDM keyboard filter

Demo project is the legacy driver. But all methods described in this article are applicable for the WDM drivers too. The only essential difference is that in WDM driver the hooking method described in section 3 will work for all connection interfaces (USB and PS/2). Naturally to do this the calling of device creation and attaching it to the stack should be placed in the AddDevice function of the driver.

6. Demo project Class architecture

Demo project is based on the KBHookLib library. It contains all described methods of the keystroke hooking and also necessary interfaces for the further integration.

Class diagram of KBHookLib:

7. Supported MS Windows Versions

• MS Windows XP – SP1, SP2, SP3 – x86/x64
• MS Windows 2003 Server – all versions  – x86/x64
• MS Windows Vista – all version – x86

8. Recommended reading

• Russinovich, Mark; Solomon, David – Microsoft Windows Internals
• Oney, Walter – Programming The Microsoft Windows Driver Model
• Hoglund, Greg – Rootkits, Subverting the Windows Kernel

Downloads

Download the source files of demo project.

About the Author

APC BACK-UPS HS 500VA 230V $145.36 APC BACK-UPS HS 500VA 230V

The Working Back $111 A systems approach to understanding and minimizing the causes of low back pain in the workplace Low back pain affects 80% of the population at some point during their lifetime; it is responsiblefor over 40% of the compensation costs for work-related injuries. This book provides an understanding of the mechanisms influencing low back pain in the workplace and indicates how low back pain might be prevented, saving employers extraordinary amounts in medical costs and protecting workers from the most common on-the-job injury. With a unique, multidisciplinary perspective that shows how various influences or risk factors can be considered collectively, The Working Back: A Systems View: Explains basic concepts in anatomy and physiology that are essential to understanding and preventing low back pain Provides a systems perspective on the occupational causes of back pain, not only addressing factors such as spine loading, but also considering the potential impact of psychosocial and organizational interactions, genetics, and physiology Discusses implementing preventive engineering and administrative controls and integrating risk interventions into the workplace Offers an expert analysis of current medical research on low back pain in one comprehensive, accessible reference This book gives readers the knowledge to assess a work environment and prescribe effective interventions. It is a hands-on reference for ergonomists, manufacturing engineers, process engineers, industrial engineers and managers, safety engineers, nurses, therapists, chiropractors, physicians, and workers with back pain. It is also an excellent resource for graduate or undergraduate students of kinesiology, physiology, ergonomics, physical therapy, nursing, industrial design, engineering, and general medicine.

APC / APC BACK-UPS RS LCD 600 Power Saving 600Watts Input 120V Output 120V Retail / BR1000G $179.57 APC - APC BACK-UPS RS LCD 600 Power Saving 600Watts Input 120V Output 120V Retail - BR1000G

Universal / APC Back-UPS ES 550VA Replacement Battery / UB1270ALT26 $19.75 Universal - APC Back-UPS ES 550VA Replacement Battery - UB1270ALT26

American Power Conversion / APC BACK-UPS ES 750VA / BE750G $119.71 American Power Conversion - APC BACK-UPS ES 750VA - BE750G

Universal / Compatible UPS Battery for APC BACK-UPS 650- UPG / D5775EBALT1 $25.99 Universal - Compatible UPS Battery for APC BACK-UPS 650- UPG - D5775EBALT1

Universal / APC Back UPS ES 350 Battery / UB1234ALT5 $18.99 Universal - APC Back UPS ES 350 Battery - UB1234ALT5

Universal / APC Back-UPS 550 BE550G Battery / UB1270ALT32 $18.95 Universal - APC Back-UPS 550 BE550G Battery - UB1270ALT32

APC 24V Back-UPS Pro External Battery Pack BR24BPG $196.36 APC 24V Back-UPS Pro External Battery Pack BR24BPG

APC 500VA Back UPS 4-out 230V Serial/USB BK500EI $125.91 APC 500VA Back UPS 4-out 230V Serial/USB BK500EI

700VA/450W APC BACK-UPS RS BR700G UPS System BR700G $134.48 700VA/450W APC BACK-UPS RS BR700G UPS System BR700G

APC BACK-UPS ES 8-out 550VA 120V BE550R UPS External $39.05 APC BACK-UPS ES 8-out 550VA 120V BE550R UPS External

APC Back-UPS BR1500GI Line-interactive UPS - 1.50 kVA/865 WTower $464.24 APC Back-UPS BR1500GI Line-interactive UPS - 1.50 kVA/865 WTower

APC Back-UPS BR1000G Line-interactive UPS - 1 kVA/600 WTower $171.96 APC Back-UPS BR1000G Line-interactive UPS - 1 kVA/600 WTower

APC BACK-UPS ES 550VA 8-out 120V UPS System A1821653 $89.54 APC BACK-UPS ES 550VA 8-out 120V UPS System A1821653

1500VA/865W APC BACK-UPS RS 1500 10-out UPS System BR1500G $215.03 1500VA/865W APC BACK-UPS RS 1500 10-out UPS System BR1500G

APC BE500R BACK-UPS ES 8-out 500VA 120V UPS System $59.37 APC BE500R BACK-UPS ES 8-out 500VA 120V UPS System

650VA APC BACK-UPS ES 8-out 120V UPS System BE650G $55.54 650VA APC BACK-UPS ES 8-out 120V UPS System BE650G

1500VA APC Back-UPS XS 865 Watt BX1500LCD UPS External $246.04 1500VA APC Back-UPS XS 865 Watt BX1500LCD UPS External

APC 1000VA Battery Back-Up System $139.99 This APC BX1000G battery back-up system features a 355-joule rating to protect your equipment from power surges and spikes and powers your components for up to 121 minutes in the event of a power failure.

APC 650VA Battery Back-Up System $89.99 This APC BE650MC battery back-up system features 8 surge-protected outlets to protect your computer and peripherals from power surges and spikes. The 340-joule rating absorbs a high quantity of energy for improved performance.

APC Back-UPS CS 500 $102.99 0 ft to 10000 ft Operating 0 ft to 50000 ft Storage 0 to 95% Non-condensing Relative Humidity Storage 0 to 95% Relative Humidity Operating 0.04 Hour 0.04 Hour 300 W Full Load 0.23 Hour 0.23 Hour 150 W Half Load 1 x DB-9 RS-232 Serial 1 x IEC 320-C13 - Battery/Surge-protected 1 x USB 13.90 lb 160 V AC to 300 V AC Adjustable Mains Operation 196 V AC to 280 V AC Mains Operation 2 2 Year 220 V AC 230 V AC Nominal 24 BTU/h 26297.44 Hour to 52594.88 Hour 3 x IEC 320-C13 300 J 32°F (0°C) to 104°F (40°C) Operating 4 Hour Typical 50 Hz 500 VA 500 VA/300 W 52594.88 Hour 5°F (-15°C) to 113°F (45°C) Storage 6.50" Height x 3.60" Width x 11.20" Depth 60 Hz On Battery Replace Battery Overload Back-UPS CS Software CD USB cable User Manual C-tick CE EN 50091-1 EN 50091-2 GOST PCBC VDE UL 1449 Lightning and Surge Protection QuickSwap Battery Replacement Unattended Safe & Graceful Shutdown APC APC Smart-UPS protects your data by supplying reliable, network-grade power in either traditional Tower or Rack-optimized form factors for space constrained business critical applications. Award winning APC Smart-UPS® is the perfect UPS for protecting business critical fileservers (Intel or UNIX based), minicomputers, network switches and hubs, Point of Sale, retail/bank back office and ATM's. Rack Mount versions are the choice for rack optimized servers, server appliances, blade servers, other blade devices and rack-mounted network switches and hubs. American Power Conversion Corp BK500EI Back-UPS Back-UPS CS Back-UPS CS 500 Battery Fault Beige CS Full time multi-pole noise filtering, 5% IEEE surge let-through, zero clamping response time, meets UL 1449 IEC 320-C14 Low Battery On Battery Overload RJ-45 Modem/Fax Resettable circuit breaker Spill Proof, Maintenance Free Sealed Lead Acid User-replaceable Hot-swappable Standby UPS Stepped Sine Wave www.apc.com

APC SurgeArrest Essential 7 Outlets Surge Suppressor $14.99 0 ft to 10000 ft Operating 0 ft to 50000 ft Storage 0% to 95% Relative Humidity Operating 0% to 95% Relative Humidity Storage 1.40 lb 12.50" Height x 3" Width x 1.40" Depth 120 V AC 15 A Line Current/30 kA Surge Current 32°F (0°C) to 104°F (40°C) Operating 490 J 50 Hz ±5Hz 5°F (-15°C) to 113°F (45°C) Storage 60 Hz ±5Hz 7 7 x NEMA 5-15R 72" CSA UL 1363 UL 1449 (TVSS Rating 330 V) Fail Safe Mode Transformer Block Spacing Let Through Voltage Rating: < 330 Volts SurgeArrest Essential 7 Outlets Surge Suppressor 2 x 1.8 Meter Telephone Cable User Manual APC surge SurgeArrest Essential 7 Outlets Surge Suppressor undergo stringent testing by IEEE, and are awarded "let-through ratings", which indicate the maximum voltage level that can possibly reach your equipment after a surge or voltage spike has passed through a surge protector. SurgeArrest components such as MOVs and Thermal fuse ensure instantaneous reaction to lightning strikes and wiring faults. If the surge components are damaged due to power spike or over voltage, excess power cannot reach your equipment. Protection of phone lines ensures complete protection of your equipment from surges. It is very important to protect your equipment from "back door" surges traveling through data lines, as they can be as damaging to your equipment as surges traveling over power lines. APC American Power Conversion Corp Building Wiring Fault Charcoal EMI/RFI Noise rejection (100 kHz to 10 mHz): 20 dB Essential Lifetime Modem/Fax/DSL NEMA 5-15P P7T Protection Working RJ-11 Modem/Fax/DSL Surge Suppressor SurgeArrest SurgeArrest Essential SurgeArrest Essential 7 Outlets Surge Suppressor www.apc.com

APC Back-UPS CS 500VA $90.99 0 ft to 10000 ft Operating 0 ft to 50000 ft Non-operating 0 to 95% Non-condensing Non-operating 0 to 95% Operating 0.05 Hour 0.05 Hour 300 W Full Load 0.25 Hour 0.25 Hour 150 W Half Load 1 x DB-9 Serial 1 x USB 110 V AC 120 V AC 13.80 lb 2 Year 24 BTU/h 3 x NEMA 5-15R 300 W Operating 32°F (0°C) to 104°F (40°C) Operating 45 dB(A) 480 J 500 VA 5°F (-15°C) to 113°F (45°C) Non-operating 6.50" Height x 3.60" Width x 11.20" Depth 72" 8 Hour Typical Additional Surge Protected Outlets Cord Management Software USB compatible FCC Part 15 Class B Industry Canada UL 1778 cUL Listed User Manual Velcro Cord Management Straps Kit CD with software USB cable APC American Power Conversion Corp BK500 Back-UPS Back-UPS CS Back-UPS CS 500VA Beige CS Full time multi-pole noise filtering, 5% IEEE surge let-through, Zero clamping response time, Meets UL 1449 LED status display with On Line, On Battery, Replace Battery, Site wiring fault and Overload Indicators Line-interactive UPS Low Battery NEMA 5-15P On Battery Overload RJ-11 Modem/Fax/DSL Spill Proof, Maintenance Free Sealed Lead Acid User-replaceable Step Wave The effects of power problems include keyboard lockup, complete data loss, hardware degradation, damaged motherboards, and more, making downtime inevitable. An APC Back-UPS CS 500VA instantly switches your computer to emergency battery backup power and allows you to work through brief power outages or to shut down your system in the event of an extended outage. High-performance surge suppression protects your computer from electrical noise and damaging power surges - even lightning. www.apc.com

APC Back-UPS CS 350VA $65.99 0 ft to 10000 ft Operating 0 ft to 50000 ft Non-operating 0 to 95% Non-condensing Non-operating 0 to 95% Operating 0.11 Hour 0.11 Hour 210 W Full Load 0.40 Hour 0.40 Hour 105 W Half Load 1 x DB-9 Serial 1 x USB 110 V AC 12.50 lb 120 V AC 2 Year - Aruba, Venezuela, Belize, Canada, Mexico, Puerto Rico, Ecuador, Honduras, Guatemala, Costa Rica, Salvador, Panama, Nicaragua, Jamaica, Barbados, United States 20 BTU/h 210 W Operating 3 x NEMA 5-15R 32°F (0°C) to 104°F (40°C) Operating 350 VA 45 dB(A) 480 J 5°F (-15°C) to 113°F (45°C) Non-operating 6.50" Height x 3.60" Width x 11.20" Depth 72" 8 Hour Typical Additional Surge Protected Outlets Cord Management Overload Indicator Software Unattended Shutdown USB compatible CD with software User Manual USB cable Velcro Cord Management Straps Kit FCC Part 15 Class B Industry Canada UL 1778 cUL Listed APC American Power Conversion Corp BK350 Back-UPS Back-UPS CS Back-UPS CS 350VA Beige CS Full time multi-pole noise filtering, 5% IEEE surge let-through, Zero clamping response time, Meets UL 1449 Intelligent Battery Management LED status display with On Line, On Battery, Replace Battery, Site wiring Fault and Overload indicators Low Battery Maintenance-free Sealed Lead Acid User-replaceable NEMA 5-15P Not Provided On Battery Overload RJ-11 Modem/Fax/DSL Standby UPS Step Wave The effects of power problems include keyboard lockup, complete data loss, hardware degradation, damaged motherboards, and more, making downtime inevitable. An APC Back-UPS ES 350VA instantly switches your computer to emergency battery backup power and allows you to work through brief power outages or to shut down your system in the event of an extended outage. High-performance surge suppression protects your computer from electrical noise and damaging power surges - even lightning. www.apc.com

APC Back-UPS RS 900VA $130.99 0 ft to 10000 ft Operating 0 ft to 50000 ft Storage 0 to 95% Relative Humidity Operating 0 to 95% Relative Humidity Storage 0.09 Hour 0.09 Hour 540 W Full Load 0.29 Hour 0.29 Hour 270 W Half Load 110 V AC 120 V AC Nominal 170 BTU/h 2 Year 20.50 lb 23°F (-5°C) to 113°F (45°C) Storage 3 x NEMA 5-15R - Surge-protected 320 J 32°F (0°C) to 104°F (40°C) Operating 4 x NEMA 5-15R - Battery Backup System 45 dB(A) 47 to 63 Hz Input 72" 78 V AC to 152 V AC Adjustable Mains Operation 8 Hour Typical 88 V AC to 139 V AC Mains Operation 9" Height x 4" Width x 12.75" Depth 900 VA 900 VA/540 W Back-UPS RS 900VA CD with software Cord Management Straps USB cable User Manual CSA UL 1449 UL 1778 FCC Part 68 FCC Part 15 Class B Included Battery Modules: 1 Replacement battery cartridge quantity: 1 Units per Pallet: 40 Cold-start capable Power conditioning Adjustable voltage sensitivity Adjustable voltage-transfer points Automatic Voltage Regulation (AVR) Automatic restart of loads after UPS shutdown LED status display with: On Line On Battery Replace Battery Overload Best solution for poor power regions and applications requiring longer run times. APC Back-UPS RS 900VA can be placed on the floor, or on a shelf. Four battery backup outlets with automatic voltage regulation (AVR) enable you to work through even the most frequent brownouts and power sags. For printers and other devices that do not store or process information, three additional outlets provide surge protection. Both Ethernet 10/100BaseT and telephone dataline surge protection safeguards against surges entering via network connections. The PowerChute Personal Edition software features easy-to-use safe system shutdown with sophisticated power management. Resettable circuit breakers APC American Power Conversion Corp BR900 Back-UPS Back-UPS RS Back-UPS RS 900VA Beige Configurable Delay Full time multi-pole noise filtering, 5% IEEE surge let-through, zero clamping response time Intelligent battery management Line-interactive UPS Low Battery NEMA 5-15P Not Provided On Battery PowerChute Personal Edition software RJ-11 Modem/Fax/DSL RJ-45 10/100Base-T RS Spill Proof, Maintenance Free Sealed Lead Acid User-replaceable Hot-swappable Tower USB www.apc.com

Apc Back-Ups Cs 350va $89.99 0 ft to 10000 ft Operating 0 ft to 50000 ft Non-operating 0 to 95% Non-condensing Non-operating 0 to 95% Operating 0.08 Hour 0.08 Hour 210 W Full Load 0.30 Hour 0.30 Hour 105 W Half Load 1 x IEC 320-C13 - Battery/Surge-protected 1 x USB 13.90 lb 19 BTU/h 196 V AC to 280 V AC Mains Operation 2 2 Year Repair/Replace 220 V AC 230 V AC 3 x IEC 320-C13 300 J 32°F (0°C) to 104°F (40°C) Operating 350 VA 350 VA/210 W 40 dB 50 Hz 5°F (-15°C) to 113°F (45°C) Storage 6 Hour 6.50" Height x 3.60" Width x 11.20" Depth 60 Hz Automatic Self Test Unattended Safe & Graceful Shutdown This UPS is a European/International version Back-UPS CS 350VA Software CD User Manual USB cable EN 50091-2 CE GOST PCBC VDE C-tick EN 50091-1 On Battery Replace Battery Overload APC American Power Conversion Corp BACK-UPS CS 350VA BK350EI Back-UPS Back-UPS CS Beige CS Fax/Modem/Phone Full time multi-pole noise filtering, 5% IEEE surge let-through, zero clamping response time, meets UL 1449 IEC 320-C14 Low Battery Maintenance-free Sealed Lead Acid User-replaceable Hot-swappable On Battery Overload Standby UPS Stepped Sine Wave The Back-UPS CS provides professional-grade power protection for office and home office systems. Battery powered & surge protected power outlets, built-in phone/fax/modem line (DSL compatible) protection, safe system shutdown software with sophisticated power management features and pro-active audio-visual status indicators ensure office systems and their valuable data are protected from dangerous power surges, spikes and blackouts. Serial or USB connectivity gives users more flexibility making installation quicker and easier. Easy access to a hot-swappable, user-replaceable battery also makes servicing the Back-UPS CS hassle-free. These features along with its classic styling make the Back-UPS CS a perfect choice for protecting your important office and home office systems. www.apc.com

APC Back-UPS RS 550VA Tower UPS $134.99 0.05 Hour 0.17 Hour 14.40 lb 220 V AC 3 x IEC 60320 C13 550 VA 550 VA/330 W 7.56" Height x 3.58" Width x 12.20" Depth APC Back-UPS RS 550VA Tower UPS offers high performance protection for your business and office computer systems. It provides abundant battery backup power, allowing you to work through medium and extended length power outages. It also safeguards your equipment from damaging surges and spikes that travel along utility, phone and network lines. Resettable circuit breakers APC American Power Conversion Corp BR550GI Back-UPS Back-UPS RS Back-UPS RS 550VA Tower UPS IEC 60320 C14 Line-interactive UPS Nominal RS RoHS Serial Tower User-replaceable Hot-swappable Yes www.apc.com

APC Back-UPS HS 500VA - UPS - 500 VA. Each $156.31 Manufacturer: APC. Each. APC Back-UPS HS 500 is a compete management and power protection solution for structured wiring and home networking applications. It provides the flexibility to remotely manage the UPS and control the outlets via Web browser. Dev

APC Back-UPS RS 1000VA TOWER $209.99 When it comes to safeguarding your important computer data, don't take any chances, get the APC Back-UPS RS. This 1000VA Tower offers high performance protection for your business and office computer systems. It provides abundant battery backup power, allowing you to work through medium and extended length power outages. It also protects your PC from damaging surges and spikes that travel along utility, phone, and network lines. One of the nice features of the APC Back-UPS RS is that it has automatic voltage regulation (AVR), meaning it instantly adjusts both low and high voltages to safe levels. This allows you to work continuously during brownouts and overvoltage situations, saving the battery for power outages when you need it most. In addition, the award-winning shutdown software automatically powers down your computer system in the event of an extended power outage. UPC: 731304278788 Manufacturer's Part Number: BR1000GCA

APC 650VA Back-UPS 8 Outlet. Each $98.1 Manufacturer: APC. Each. Lightning and surge protection. Resettable circuit breaker. Audible alarms. Automatic self-test. Transformer block spacing Device Type: UPS - external Dimensions (WxDxH): 7.1 in x 11.2 in x 3.4 in Weight: 13.7 lbs Localization: U

APC Back-UPS XS 1300 VA Tower UPS - Black $179.99 APC Back-UPS XS 1300 VA Tower UPS - 1300VA/780W - 4.2 Minute Full Load - 5 x NEMA 5-15R - Battery Backup System, 5 x NEMA 5-15R - Surge-protected

APC Back-UPS XS 1500 VA Tower UPS - Black $209.99 APC Back-UPS XS 1500 VA Tower UPS - 1500VA/865W - 5 x NEMA 5-15R - Battery Backup System, 5 x NEMA 5-15R - Surge-protected

Washday in the Back Court of a Working-Class Home, York $24.99 Washday in the Back Court of a Working-Class Home, York - Photographic Print

APC Serial Extension Cable $33.99 1 1 lb 1 x 9-pin DB-9 Female 1 x 9-pin DB-9 Male 15 ft 2 Year American Power Conversion UPS with all APC UPS product lines - Back-UPS, Back-UPS Pro, Smart-UPS, Smart-UPS v/s, Matrix-UPS and Symmetra Power Array. AP9815 APC American Power Conversion Corp American Power Conversion's UPS serial interface cables that provide direct communication between UPSs and desktops, workstations, and servers. Copper DB-9 Data Transfer Cable Extension Cable Gray Serial Serial Extension Cable www.apc.com

APC Back-UPS BK500 UPS $124.99 Series: Back-UPS Input Voltage Range: 98 - 140 V Input Frequency: 50/60 Hz Output Voltage: 120Vac +/- 5% Outlets: 6 Battery Run Time: 2.4 minutes Interface Port: USB Management Software: YES

APC Back-UPS BK350 UPS $81.99 Series: Back-UPS Input Voltage Range: 98 - 140 V Input Frequency: 50/60 Hz Output Voltage: 120Vac +/- 5% Outlets: 6 Battery Run Time: 18.1 minutes Interface Port: RS-232, USB Management Software: YES

APC Back-UPS ES 550VA Desktop UPS $60.99 0.06 Hour 0.06 Hour 330 W Full Load 0.23 Hour 0.23 Hour 165 W Half Load 110 V AC 120 V AC Nominal 13 lb 24 Hour Typical 3 Year 3.30" Height x 12" Width x 7" Depth 4 x NEMA 5-15R - Battery Backup System 4 x NEMA 5-15R - Surge-protected 550 VA 550 VA/330 W 60 Hz 88 V AC to 139 V AC Mains Operation Back-UPS ES 550VA Desktop UPS CD with software USB cable User Manual APC's Back-UPS ES 550VA Desktop UPS is now "greener" than ever. The ES 550 utilizes an ultra-efficient design that consumes less power during normal operation than any other battery backup in its class, saving you money on your electricity bill. It's also RoHS compliant, which means its manufacture and ultimate disposal is easier on the environment. APC American Power Conversion Corp BE550G Back-UPS Back-UPS ES Back-UPS ES 550VA Desktop UPS Desktop ES Full time multi-pole noise filtering : 5% IEEE surge let-through : zero clamping response time NEMA 5-15P RJ-11 Modem/Fax/DSL Resettable circuit breakers RoHS Spill Proof, Maintenance Free Sealed Lead Acid User-replaceable Hot-swappable Standby UPS UL 1449, cUL Listed, FCC Part 15 Class B, FCC Part 68, NOM, UL 1778, UL 497A, UL 497B USB Yes www.apc.com

APC - USB cable - 4 pin USB Type A - for Back-UPS LS 500 $44.99 APC - USB cable - 4 pin USB Type A - for Back-UPS LS 500

This entry was posted on Wednesday, December 8th, 2010 at 7:34 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.