The Windows Process Journey — “TabTip.exe” (Touch Keyboard and Handwriting Panel)

“TabTip.exe” (Touch Keyboard and Handwriting Panel) is also known as “Tablet Text Input Panel”. It is an interface developed by Microsoft which allows inputting text in different ways: handwriting to text, speech to text and by clicking on the screen like a keyboard (https://www.file.net/process/tabtip.exe.html).

The usage of “TabTip.exe” as a keyboard is very similar to “osk.exe” (https://medium.com/@boutnaru/the-windows-process-journey-osk-exe-accessibility-on-screen-keyboard-72823695321e). The main goal of “TabTip.exe” is to provide handwriting input. This means that even applications that don’t have this capability can use “TabTip.exe” to provide users with the ability of writing instead of typing (https://windowsreport.com/tabtip-exe/) — as shown in the screenshot below.

Overall, “TabTip.exe” is a 64-bit PE binary located at “%ProgramFiles%\Common Files\microsoft shared\ink\TabTip.exe”, which is digitally signed by Microsoft. When “TabTip.exe” is launched it is started as a child process of the service TabletInputService (Touch Keyboard and Handwriting Panel Service), similar to “ctfmon.exe” (https://medium.com/@boutnaru/the-windows-process-journey-ctfmon-exe-ctf-loader-148f10f5401) — as shown in the screenshot below. This service is hosted by “svchost.exe” (https://medium.com/@boutnaru/the-windows-process-journey-svchost-exe-host-process-for-windows-services-b18c65f7073f), which loads the “%windir%\System32\TabSvc.dll”.

See you next time ;-) You can also follow me on twitter — @boutnaru (https://twitter.com/boutnaru).