How does on-screen (virtual) keyboard works in Win10

Question

I haven't find anything relevant in Google or any Microsoft site about it so I decided to ask a question here.

Everybody knows that in Win-based OS there is a virtual keyboard . I also know that *nix based OS, have it too. So, the question is about:

HOW DOES IT WORK INSIDE?

I mean, let's have an example that I opened on screen keyboard in Windows 10. What's the actual difference between:

1. input via hardware keyboard: when I'm using it, like I press X button
2. ..and using a virtual keyboard, when I press the same button

Imagine, I have an admin access to terminal/computer, is there any option to track/distinguish that in the second time I pressed button not on hardware keyboard, but on-screen (by mouse clicking) version of it?

And there are also many different software, like AutoIt ( yes, it's a language , but it's relevant to this example) that emulating pressing the X button . How does they work in Win-based OS? Do they "in-common" with default on-screen keyboard and using the same driver/WinAPI or there is a difference between them?

And the second case, between:

1. default on-screen keyboard
2. compilated AutoIt script
3. ..any other software that emulating press X button

I guess the only way to find out "how exactly button was pressed" is to check current processes list via taskmgr and find out have anything been launched or not. Or I'm totally wrong here, and missing something?

THE SCOPE

I have written a node.js script which emulates button pressing behaviour in windows app.

TL:DR business logic short => open notepad.exe and type `Hello world`

And could someone give me any advice/recommend any powershell/bat script ( or any other solution ) with demonstration of GetAsyncKeyState check behavior? With which I could easily check my own node.js script (not by functional of it, but by triggering press the X button event) I found an answer for node.js case here: Detecting Key Presses Across Applications in Powershell

Answer 1

SendInput is the preferred method to generate user input in software. The Windows on-screen keyboard probably uses it for everything except Ctrl+Alt+Delete which I believe has some kind of special handling. The on-screen keyboard is only able to generate Ctrl+Alt+Delete in certain configurations.

Software-generated input is merged with normal hardware input in the RIT (Raw Input Thread) in the kernel.

A low-level keyboard hook can detect software-generated input.