Universal keyboard and mouse simulations (including USB and PS2)

The keyboard driver is sent directly to the upper level by directly calling the Kbdclass callback function Keyboardclassservicecallback. This method has been published online, reference hook keyboardclassservicecallback to achieve keyboard Logger, there are many others, you can go online to check.

To put it simply, there is no public part, which is to press and release the simulation, has already extended the key simulation.

The simulation mainly constructs the keyboard_input_data structure, presses and releases the flags respectively corresponding Key_make, the Key_break, then calls Keyboardclassservicecallback. Here the direct use of Sudami code, in this thanked, lazy to change. The code is as follows:

 case ioctl_key_down :
  {
   if (iobuf)
   {
    lkeycode = * (ulong*) iobuf;
    dprintf ("[keymouse] Keymousedispatchdevicecontrol Ioctl_key_down = 0x%x/n", lKeyCode);
    dwsize = sizeof (Keyboard_input_data);
    __asm {
     push eax
       mov kid. unitid,0  ; Construct Keyboard_input_data
      mov eax,lkeycode
       mov kid. Makecode,ax
      mov kid. The flags,key_make ; simulation presses the
      mov kid. reserved,0
      mov kid. extrainformation,0

Lea Eax,dwret
Push EAX
Lea Eax,kid
Add Eax,dwsize
Push EAX
Lea Eax,kid
Push EAX
Push G_kbdeviceobject
Call orig_keyboardclassservicecallback; use Keyboardclassservicecallback analog keys

Pop eax
}
status = Status_success;
}
Break
}
Case IOCTL_KEY_UP:
{
if (IOBUF)
{
Lkeycode = * (ulong*) iobuf;
Dprintf ("[keymouse] Keymousedispatchdevicecontrol ioctl_key_up = 0x%x/n", lkeycode);
dwsize = sizeof (Keyboard_input_data);
__asm {
Push EAX
MOV kid. unitid,0; Structural Keyboard_input_data
MOV Eax,lkeycode
MOV kid. Makecode,ax
MOV kid. Flags,key_break; simulate release
MOV kid. reserved,0
MOV kid. extrainformation,0

Lea Eax,dwret
Push EAX
Lea Eax,kid
Add Eax,dwsize
Push EAX
Lea Eax,kid
Push EAX
Push G_kbdeviceobject
Call orig_keyboardclassservicecallback; use Keyboardclassservicecallback analog keys

Pop eax
}
status = Status_success;
}
Break
}

The difference between the extension keys is to press and release the flags corresponding to KEY_E0, key_e1 respectively. As with the above, there is no code here. What are the key words of the extension key: (Front is makecode, behind the button)

0x1d-right control 0x38-right ALT 0x48-↑ key 0x50-↓ key 0x4b-← key 0x4d-→ win 0x5b-left win

Focus on the mouse simulation, the principle and the same as the keyboard. Find the Mouseclassservicecallback function in the drive Mouclass.sys, then get the //device//pointerclass0 device object pointer, construct the MOUSE_INPUT_DATA structure, Then call Mouseclassservicecallback. The difficulty lies with the structural mouse_input_data structure.

typedef struct _MOUSE_INPUT_DATA {
USHORT Unitid;
USHORT Flags;
Union {
ULONG Buttons;
struct {
USHORT Buttonflags;
USHORT Buttondata;
};
};
ULONG rawbuttons;
LONG Lastx;
LONG lasty;
ULONG extrainformation;
} mouse_input_data, *pmouse_input_data;

Mouseclassservicecallback parameters are invoked by debugging the operating system, with 3 main marks.

The flags flag is the coordinate property of the mouse (i.e. relative coordinates, absolute coordinates, etc.)

The BUTTONFLAGS flag is a sign that the left and right keys are pressed and loosened

LASTX is the mouse x coordinate, which is related to the flags flag

Lasty is the mouse y coordinate, which is related to the flags flag

Several other items can be filled in 0.

The simulation code is as follows:

Case Ioctl_mouse_left_button_down:
{
Mouseflags = Mouse_left_button_down;
Goto __mousecallback;
}
Case IOCTL_MOUSE_LEFT_BUTTON_UP:
{
Mouseflags = mouse_left_button_up;
Goto __mousecallback;
}
Case Ioctl_mouse_right_button_down:
{
Mouseflags = Mouse_right_button_down;
Goto __mousecallback;
}
Case IOCTL_MOUSE_RIGHT_BUTTON_UP:
{
Mouseflags = mouse_right_button_up;
Goto __mousecallback;
}
Case Ioctl_mouse_middle_button_down:
{
Mouseflags = Mouse_middle_button_down;
Goto __mousecallback;
}
Case IOCTL_MOUSE_MIDDLE_BUTTON_UP:
{
Mouseflags = mouse_middle_button_up;
__mousecallback:
Mid. Unitid = 0;
Mid. Flags = mouse_move_relative;
Mid. Buttons = 0;
Mid. Buttonflags = Mouseflags;
Mid. rawbuttons = 0;
Mid. LASTX = * ((ulong*) iobuf);
Mid. lasty = * ((ulong*) iobuf+1);
Mid. extrainformation = 0;

Inputdatastart = ∣
Inputdataend = inputdatastart+1;

Orig_mouseclassservicecallback (
G_moudeviceobject,
Inputdatastart,
Inputdataend,
&inputdataconsumed
);

status = Status_success;
Break
}
Case Ioctl_mouse_move_relative:
{
Mid. Flags = mouse_move_relative; Relative coordinates
Goto __mousemovecallback;
}
Case Ioctl_mouse_move_absolute:
{
Mid. Flags = Mouse_move_absolute; Absolute coordinates
Goto __mousemovecallback;
}
Case Ioctl_mouse_virtual_desktop:
{
Mid. Flags = Mouse_virtual_desktop; Virtual Desktop
__mousemovecallback:
Mid. Unitid = 1;
Mid. Buttons = 0;

Mid. rawbuttons = 0;
Mid. LASTX = * ((ulong*) iobuf);
Mid. lasty = * ((ulong*) iobuf+1);
Mid. extrainformation = 0;

Inputdatastart = ∣
Inputdataend = inputdatastart+1;

Orig_mouseclassservicecallback (
G_moudeviceobject,
Inputdatastart,
Inputdataend,
&inputdataconsumed
);
status = Status_success;
Break
}

The driver passed on the Windows XP SP2 test.