Several methods of kernel programming keyboard filtering

First: Bind KBDCALSS Drive Object

The Kbdclass class-driven object is the topmost driver of the keyboard, and its distribution functions are handled without the underlying compatibility issues.

Idea: First use the Obreferenceobjectbyname function to open the Kbdclass drive object, and then use the DeviceObject pointer and the Nextdevice pointer to traverse all the device objects under the Kbdclass drive object. Each traversal one creates a device object attached to it, so that we write a distribution function of the drive object that can handle the IRP of the Kbdclass class-driven object.

The second type: direct substitution of kbdclass distribution functions

Third: Replace the Kbdclass callback function in the I8042PRT or Kbdhid driver object, and first search for the Kbdhid class-driven object in the i8042prt or Kbdclass-driven object. Then search for the function address in the Kbdclass class-driven object, and finally replace the callback function,

Fourth: Modifying the processing of 0x93 interrupts in the IDT table

Fifth: For the Ioapic interrupt controller, the IRQ1 corresponding interrupt number is replaced with the interrupt number outside the 0x93 (custom interrupt number and processing function)

Several methods of kernel programming keyboard filtering