Remapping the Special Macro Keys on an Asus Laptop (G752)

This was one of those really good puzzles that almost didn't pay off. Asus has a preinstalled macro key application for mapping the macro keys on their laptops, but as you have probably discovered, it only works for a subset of the keys, not all of them. Asus conveniently left the Stream/Record/Camera macro key out in an attempt to prevent you from changing it. The key looks like this:

(The key on the far left with the camera symbol)

I am using a G752VS, and by default, that key is bound to an application called XSplit. XSplit is great, but I favor OBS and wanted to remap the record macro key to OBS instead of XSplit. I searched plenty of Asus forums where users had found out how to remap the Steam or Shadowplay macros on older laptops, but no one had figured out how to remap the Record macro yet. Bummer for me, but I was determined so I set off to figure this out. Surely there had to be a way to change it. 

You've probably looked around and seen plenty of 3rd party programs that individuals have written, and though I am sure they do the job well, I didn't want such a heavy solution to the problem. The two that I considered work by intercepting the key event and redirecting it. This is a great work-around, but I wanted to deal with the root cause, and not just the symptom. (BTW, if you call Asus Support, they'll tell you it cannot be changed)

Thanks to 'RARES95' in this thread I used the HControl.exe binary as my starting point. Just as they did, I examined it in a hex editor to see what sort of clues I could dig up:

I did a search for 'XSplit' and found only a single instance of the string. Here is a more focused image of just the interesting stuff:

(XSplit.ControlMessage.XGC)

Surprisingly, the XSplit clue I was looking for was right next to the old 'Steam/Shadowplay' strings. Unfortunately, this time around the engineers didn't just place the application path into the executable which would have made remapping the key very similar to the Steam macro trick posted in the forum. I wrote down the surrounding clues, pretty much everything I highlighted, and went looking, starting with the registry. I do most of my work on Linux, and have very little technical prowess on the Windows platform, but I had a good feeling the registry editor might be a good place to start looking for more clues. 

Turns out I was wrong. One of the strings I wrote down was 'InstallPath', which as it happens, is actually a registry key under the SplitMediaLabs/XSplit registry group. The value was the launch executable for 'XSplit' so I changed it to point to my test application and restarted explorer. Didn't work, hitting the record macro key still opened XSplit. So I changed that back. Next I spent a few minutes Googling for the string 'XSplit.ControlMessage.XGC.' Nothing. Seems like it had to be something internal to the Asus application, not something you would find on the web. Then I started doing the equivalent of 'grepping' through every file related to the ATK package (Asus' macro key management software) and the XSplit program files. That string wasn't there, but I got a metric ton of results for things like 'XSplit' or 'ControlMessage' or especially the 'XGC', just not in the same string like I found in the hex editor. I was getting nowhere.

Just when I was about to give up, I looked again at some of the less obvious clues I had originally overlooked:

(schtasks & ATK Package)

Then I looked up ATK Package A22126881260 and found an XML file under the Asus ATK Package directory in program files. The XML file didn't give anything away though. It mentions an executable which is used for simulating apps run in the Windows' store, but it's a red herring. 

Like I previously stated, I am a not a Windows guru, but if I was, 'schtasks' probably would have stood out more to me earlier. I looked it up and it's actually a Windows cli tool for scheduling tasks or running programs; essentially a cron. So I opened the Windows' Task Scheduler program and looked through the list. Lo and behold, there it was:

(ATK Package A22126881260)

If you click the 'Actions' tab, you'll see this scheduled task makes a call to C:\Program Files\SplitMediaLabs\XSplit\...XSplit.Gamecaster. Found it! 

Since you've come this far, I'll make the last part short for you. If you edit this scheduled task, you can replace the action of calling XSplit with any other script of program you want. Once you've edited the task, close Task Scheduler and press the Stream/Camera/Recorder macro key. It doesn't open XSplit anymore does it? Congrats, your computer belongs to you again.

This was fun wasn't it?

Thanks for reading!

Update: I made a Youtube video on how to do this since that might be easier than a wall of text. Enjoy!