通过直接调用Kbdclass的回调函数KeyboardClassServiceCallback直接给上层发送键盘驱动。这个方法网上已经公开，参考Hook KeyboardClassServiceCallback实现键盘 Logger，其他的还有很多，可以到网上去查。
简单说一下没有公开的部分，就是按下和松开的模拟，已经扩展键的模拟。
模拟主要是构造KEYBOARD_INPUT_DATA结构，按下和松开的Flags分别对应KEY_MAKE、KEY_BREAK，然后调用KeyboardClassServiceCallback。这里直接用的sudami的代码，在此谢过，懒得改了。代码如下：
case IOCTL_KEY_DOWN :
{
if (ioBuf)
{
lKeyCode = *(ULONG*)ioBuf;
dprintf("[KeyMouse] KeymouseDispatchDeviceControl IOCTL_KEY_DOWN = 0x%x/n", lKeyCode);
dwSize = sizeof(KEYBOARD_INPUT_DATA);
__asm {
push eax
mov kid.UnitId,0 ; 构造 KEYBOARD_INPUT_DATA
mov eax,lKeyCode
mov kid.MakeCode,ax
mov kid.Flags,KEY_MAKE ;模拟按下
mov kid.Reserved,0
mov kid.ExtraInformation,0
lea eax,dwRet
push eax
lea eax,kid
add eax,dwSize
push eax
lea eax,kid
push eax
push g_kbDeviceObject
call orig_KeyboardClassServiceCallback ;利用 KeyboardClassServiceCallback 模拟按键
pop eax
}
status = STATUS_SUCCESS;
}
break;
}
case IOCTL_KEY_UP:
{
if (ioBuf)
{
lKeyCode = *(ULONG*)ioBuf;
dprintf("[KeyMouse] KeymouseDispatchDeviceControl IOCTL_KEY_UP = 0x%x/n", lKeyCode);
dwSize = sizeof(KEYBOARD_INPUT_DATA);
__asm {
push eax
mov kid.UnitId,0 ; 构造 KEYBOARD_INPUT_DATA
mov eax,lKeyCode
mov kid.MakeCode,ax
mov kid.Flags,KEY_BREAK ;模拟松开
mov kid.Reserved,0
mov kid.ExtraInformation,0
lea eax,dwRet
push eax
lea eax,kid
add eax,dwSize
push eax
lea eax,kid
push eax
push g_kbDeviceObject
call orig_KeyboardClassServiceCallback ;利用 KeyboardClassServiceCallback 模拟按键
pop eax
}
status = STATUS_SUCCESS;
}
break;
}
扩展键的区别是按下和松开的Flags分别对应KEY_E0、KEY_E1。其他和上面的一样，这里就不贴代码出来了。主要说一下扩展键有哪几个：(前面是MakeCode，后面代表按钮)
0x1D-RIGHT CONTROL 0x38-RIGHT ALT 0x48-↑ 键 0x50-↓ 键 0x4b-← 键 0x4d-→ 键 0x5B-LEFT WIN 0x5C-RIGHT WIN
重点说一下鼠标的模拟，原理和键盘的一样。查找驱动mouclass.sys中的MouseClassServiceCallback函数，然后获取//Device//PointerClass0设备对象指针，构造MOUSE_INPUT_DATA结构，然后调用MouseClassServiceCallback。难点就在与构造MOUSE_INPUT_DATA结构上面。
typedef struct _MOUSE_INPUT_DATA {
USHORT UnitId;
USHORT Flags;
union {
ULONG Buttons;
struct {
USHORT ButtonFlags;
USHORT ButtonData;
};
};
ULONG RawButtons;
LONG LastX;
LONG LastY;
ULONG ExtraInformation;
} MOUSE_INPUT_DATA, *PMOUSE_INPUT_DATA;
通过调试操作系统调用MouseClassServiceCallback的参数，主要的标示有3个。
Flags标志是标示鼠标的坐标属性(即相对坐标、绝对坐标等)
ButtonFlags标志是左右中键按下和松开的标志
LastX是鼠标X坐标，与Flags标志有关
LastY是鼠标Y坐标，与Flags标志有关
其他几项可以填0。
具体模拟代码如下：
case IOCTL_MOUSE_LEFT_BUTTON_DOWN:
{
MouseFlags = MOUSE_LEFT_BUTTON_DOWN;
goto __MouseCallBack;
}
case IOCTL_MOUSE_LEFT_BUTTON_UP:
{
MouseFlags = MOUSE_LEFT_BUTTON_UP;
goto __MouseCallBack;
}
case IOCTL_MOUSE_RIGHT_BUTTON_DOWN:
{
MouseFlags = MOUSE_RIGHT_BUTTON_DOWN;
goto __MouseCallBack;
}
case IOCTL_MOUSE_RIGHT_BUTTON_UP:
{
MouseFlags = MOUSE_RIGHT_BUTTON_UP;
goto __MouseCallBack;
}
case IOCTL_MOUSE_MIDDLE_BUTTON_DOWN:
{
MouseFlags = MOUSE_MIDDLE_BUTTON_DOWN;
goto __MouseCallBack;
}
case IOCTL_MOUSE_MIDDLE_BUTTON_UP:
{
MouseFlags = MOUSE_MIDDLE_BUTTON_UP;
__MouseCallBack:
mid.UnitId = 0;
mid.Flags = MOUSE_MOVE_RELATIVE;
mid.Buttons = 0;
mid.ButtonFlags = MouseFlags;
mid.RawButtons = 0;
mid.LastX = *((ULONG*)ioBuf);
mid.LastY = *((ULONG*)ioBuf+1);
mid.ExtraInformation = 0;
InputDataStart = ∣
InputDataEnd = InputDataStart+1;
orig_MouseClassServiceCallback(
g_mouDeviceObject,
InputDataStart,
InputDataEnd,
&InputDataConsumed
);
status = STATUS_SUCCESS;
break;
}
case IOCTL_MOUSE_MOVE_RELATIVE:
{
mid.Flags = MOUSE_MOVE_RELATIVE; //相对坐标
goto __MouseMoveCallBack;
}
case IOCTL_MOUSE_MOVE_ABSOLUTE:
{
mid.Flags = MOUSE_MOVE_ABSOLUTE; //绝对坐标
goto __MouseMoveCallBack;
}
case IOCTL_MOUSE_VIRTUAL_DESKTOP:
{
mid.Flags = MOUSE_VIRTUAL_DESKTOP; //虚拟桌面
__MouseMoveCallBack:
mid.UnitId = 1;
mid.Buttons = 0;
mid.RawButtons = 0;
mid.LastX = *((ULONG*)ioBuf);
mid.LastY = *((ULONG*)ioBuf+1);
mid.ExtraInformation = 0;
InputDataStart = ∣
InputDataEnd = InputDataStart+1;
orig_MouseClassServiceCallback(
g_mouDeviceObject,
InputDataStart,
InputDataEnd,
&InputDataConsumed
);
status = STATUS_SUCCESS;
break;
}
驱动在windows XP SP2上测试通过。
