Теперь уже и я ничего не понимаю
Решил упростить код до минимума, чтобы нам с Вами легче разобраться, а он вообще перестал почему-то работать. Похоже к драйверу просто не поступают IRP`ы
.386p
option casemap:none
.model flat, stdcall
include \masm32\include\ntstatus.inc
include \masm32\include\ntddk.inc
include \masm32\include\ntdef.inc
include \masm32\include\ntoskrnl.inc
include \masm32\include\ntddkbd.inc
include \masm32\include\ntddmou.inc
include \masm32\include\hal.inc
includelib \masm32\lib\ntoskrnl.lib
includelib \masm32\lib\hal.lib
includelib \masm32\lib\wdm.lib
include \masm32\Macros\Strings.mac
zlpproc proto stdcall
remapproc proto stdcall :PDEVICE_OBJECT
oszlp proto stdcall :PDEVICE_OBJECT
POVTSTRUCT STRUCT
UnitId WORD ?
MakeCode WORD ?
Flags WORD ?
Reserved WORD ?
ExtraInformation DWORD ?
pTime DWORD ?
One BYTE ?
loctimer BYTE ?
pDevObj PDEVICE_OBJECT ?
keEvent2 KEVENT <>
dpc KDPC <>
POVTSTRUCT ENDS
PPOVTSTRUCT typedef ptr POVTSTRUCT
EY_VALUE_PARTIAL_INFORMATION STRUCT ; sizeof = 10h
TitleIndex DWORD ?
_Type DWORD ? ; original field name Type
DataLength DWORD ?
Data BYTE ? ; Variable size
db 3 dup(?) ; padding
EY_VALUE_PARTIAL_INFORMATION ENDS
KKEY_VALUE_PARTIAL_INFORMATION typedef PTR EY_VALUE_PARTIAL_INFORMATION
ICONNECT_DATA STRUCT
ClassDeviceObject PDEVICE_OBJECT ?
ClassService PVOID ?
ICONNECT_DATA ENDS
PICONNECT_DATA typedef ptr ICONNECT_DATA
MOUSE_DEVICE_EXTENSION STRUCT
TopOfStack PDEVICE_OBJECT ?
UPPER_CONNECT_DATA ICONNECT_DATA <>
UpperContext PVOID ?
MOUSE_DEVICE_EXTENSION ENDS
PMOUSE_DEVICE_EXTENSION typedef ptr MOUSE_DEVICE_EXTENSION
BUS_DEVICE_EXTENSION STRUCT
TopOfStack PDEVICE_OBJECT ?
UPPER_CONNECT_DATA ICONNECT_DATA <>
UpperContext PVOID ?
BUS_DEVICE_EXTENSION ENDS
PBUS_DEVICE_EXTENSION typedef ptr BUS_DEVICE_EXTENSION
NotStarted equ 0 ; Not started yet
Started equ 1 ; Device has received the START_DEVICE IRP
StopPending equ 3 ; Device has received the QUERY_STOP IRP
Stopped equ 4 ; Device has received the STOP_DEVICE IRP
RemovePending equ 5 ; Device has received the QUERY_REMOVE IRP
SurpriseRemovePending equ 6 ; Device has received the SURPRISE_REMOVE IRP
Deleted equ 7 ; Device has received the REMOVE_DEVICE IRP
IOCTL_INTERNAL_KEYBOARD_CONNECT equ CTL_CODE(FILE_DEVICE_KEYBOARD, 0080h, METHOD_NEITHER, FILE_ANY_ACCESS)
IOCTL_INTERNAL_KEYBOARD_DISCONNECT equ CTL_CODE(FILE_DEVICE_KEYBOARD, 0100h, METHOD_NEITHER, FILE_ANY_ACCESS)
IOCTL_INTERNAL_MOUSE_CONNECT equ CTL_CODE(FILE_DEVICE_MOUSE, 0080h, METHOD_NEITHER, FILE_ANY_ACCESS)
IOCTL_INTERNAL_MOUSE_DISCONNECT equ CTL_CODE(FILE_DEVICE_MOUSE, 0100h, METHOD_NEITHER, FILE_ANY_ACCESS)
IOCTL_zlp equ CTL_CODE(FILE_DEVICE_UNKNOWN, 800h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_rem equ CTL_CODE(FILE_DEVICE_UNKNOWN, 802h, METHOD_BUFFERED, FILE_ANY_ACCESS)
.data
nkk dd ?
mkk dd ?
ckk db ?
ikk dd 0
okk dd 0
zl1 db 0
zl1zo db 0
zlos db 0
calllock db 0
calllock2 db 0
povtlock db 0
remlock db 0
remmm db 0
remzlp db 0
povt db 0
readkey db 0
poolkey dd 0
cbpoolkey dd 0
oMakeCode WORD ?
oFlags WORD ?
kkkk db 0
povtprov db 0
busguid dd 0C05EAD84h
dw 0E34Ch, 04ee2h, 0BF6Ah
db 05Dh, 04Bh, 0B7h, 0D2h, 0B1h, 022h
NumberDevices dw 0
CCOUNTED_UNICODE_STRING "\\Device\\KeyMouse", Qg_usDeviceName, 4
;CCOUNTED_UNICODE_STRING "\\HID\\LlirikHIDKeyMouse", hidDeviceName, 4
;CCOUNTED_UNICODE_STRING "LlirikHIDKeyMouse", hidDeviceName2, 4
BusDeviceName dw "L","l","i","r","i","k","B","u","s","\","K","e","y","M","o","u","s","e", 0, 0
hidDeviceName dw "R","O","O","T","\","K","e","y","m","o","u","s","e", 0, 0
hidDeviceName2 dw "K","e","y","m","o","u","s","e", 0, 0
;CCOUNTED_UNICODE_STRING "\\HID\\HIDKeyMouse", hidDeviceName, 4
;CCOUNTED_UNICODE_STRING "HID_DEVICE_SYSTEM_MOUSE", hidDeviceName2, 4
CCOUNTED_UNICODE_STRING "\\??\\KeyMouse", g_usSymbolicLinkName, 4
CCOUNTED_UNICODE_STRING "\\Registry\\Machine\\Software\\Kmkm", g_usUserKeyName, 4
gzlpKeyDataValueName dw "K","e","y","D","a","t","a"
wee dw "1"
weuuuee dw 0
zlpKeyDataValueName UNICODE_STRING {sizeof gzlpKeyDataValueName +2, sizeof gzlpKeyDataValueName +4, offset gzlpKeyDataValueName}
;;;;;;;;CCOUNTED_UNICODE_STRING "zlpKeyData1", zlpKeyDataValueName, 4
CCOUNTED_UNICODE_STRING "ghKeyData2", KeyData2ValueName, 4
CCOUNTED_UNICODE_STRING "zlpKeyFlag", zlpKeyFlagValueName, 4
CCOUNTED_UNICODE_STRING "KeyFlag2", KeyFlag2ValueName, 4
CCOUNTED_UNICODE_STRING "KeyFlag", KeyFlagValueName, 4
CCOUNTED_UNICODE_STRING "KeyFlag5", KeyFlag5ValueName, 4
CCOUNTED_UNICODE_STRING "KeyFlag4", KeyFlag4ValueName, 4
CCOUNTED_UNICODE_STRING "KeyFlag3", KeyFlag3ValueName, 4
poool dd ?
povtpool dd ?
zlpRegScanCode dd ?
zlpRegScanCodeDop dd ?
zlpRegScanCode2 dd ?
zlpcbCode dd ?
zlpcbCode2 dd ?
remRegScanCode dd ?
remcbCode dd ?
povtRegScanCode dd ?
povtcbCode dd ?
MouseDeviceObject PDEVICE_OBJECT ?
BusDeviceRel dd 0
ozUnitId WORD ?
;KKEYBOARD_INPUT_DATA STRUCT
UnitId WORD ?
MakeCode WORD ?
Flags WORD ?
; Reserved WORD ?
;; ExtraInformation DWORD ?
;KKEYBOARD_INPUT_DATA ENDS
;PKKEYBOARD_INPUT_DATA typedef ptr KKEYBOARD_INPUT_DATA
VInputDataStart PKEYBOARD_INPUT_DATA offset UnitId
VInputDataEnd PKEYBOARD_INPUT_DATA offset UnitId + 12
VInputDataConsumed PULONG ?
jkInputDataConsumed ULONG ?
keEvent KEVENT <>
.code
SetValueKey proc
local as:ANSI_STRING
local oa:OBJECT_ATTRIBUTES
local hKey:HANDLE
lea ecx, oa
InitializeObjectAttributes ecx, offset g_usUserKeyName, OBJ_CASE_INSENSITIVE, NULL, NULL
invoke ZwOpenKey, addr hKey, KEY_SET_VALUE, ecx
invoke ZwSetValueKey, hKey, addr KeyFlagValueName, 0, REG_DWORD, \
addr ikk, sizeof ikk
invoke ZwSetValueKey, hKey, addr KeyFlag2ValueName, 0, REG_DWORD, \
addr okk, sizeof okk
invoke ZwSetValueKey, hKey, addr KeyFlag3ValueName, 0, REG_BINARY, \
addr ckk, sizeof ckk
invoke ZwSetValueKey, hKey, addr KeyFlag4ValueName, 0, REG_DWORD, \
addr mkk, sizeof mkk
invoke ZwSetValueKey, hKey, addr KeyFlag5ValueName, 0, REG_DWORD, \
addr nkk, sizeof nkk
invoke ZwClose, hKey
ret
SetValueKey endp
spbloc proc pcalllock:DWORD, pbytte:DWORD
invoke KeGetCurrentIrql
.if eax == DISPATCH_LEVEL
mov ecx, pbytte
mov [ecx], al
invoke KeAcquireSpinLockAtDpcLevel, pcalllock
.else
invoke KeAcquireSpinLock, pcalllock, pbytte
.endif
ret
spbloc endp
relsbbloc proc pcalllock:DWORD
.if al == DISPATCH_LEVEL
invoke KeReleaseSpinLockFromDpcLevel, pcalllock
.else
invoke KeReleaseSpinLock, pcalllock, al
.endif
ret
relsbbloc endp
kbproc proc pDeviceObject:PDEVICE_OBJECT, InputDataStart:PKEYBOARD_INPUT_DATA, InputDataEnd:PKEYBOARD_INPUT_DATA, InputDataConsumed:PULONG
push ecx
mov eax, pDeviceObject
assume eax:ptr DEVICE_OBJECT
mov ecx, [eax].DeviceExtension
assume eax:nothing
assume ecx:ptr MOUSE_DEVICE_EXTENSION
push InputDataConsumed
push InputDataEnd
push InputDataStart
push [ecx].UPPER_CONNECT_DATA.ClassDeviceObject
call [ecx].UPPER_CONNECT_DATA.ClassService
assume ecx:nothing
pop ecx
ret
kbproc endp
killirp proc pIrp:PIRP
mov eax, pIrp
assume eax:ptr _IRP
mov [eax].IoStatus.Status, STATUS_SUCCESS
and [eax].IoStatus.Information, 0
assume eax:nothing
fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT
mov eax, STATUS_SUCCESS
ret
killirp endp
KbFilter_Complete proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP, pContext:PVOID
mov eax, pIrp
assume eax:ptr _IRP
.if [eax].PendingReturned == TRUE
invoke KeSetEvent, pContext, IO_NO_INCREMENT, FALSE
.endif
assume eax:nothing
mov eax, STATUS_MORE_PROCESSING_REQUIRED
ret
KbFilter_Complete endp
FiDO_DispatchPassThrough proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
mov edx, (DEVICE_OBJECT ptr [eax]).DeviceExtension
mov ecx, (MOUSE_DEVICE_EXTENSION ptr [edx]).TopOfStack
mov edx, pIrp
assume edx:ptr _IRP
inc [edx].CurrentLocation
add [edx].Tail.Overlay.CurrentStackLocation, sizeof IO_STACK_LOCATION
;;;;IoSkipCurrentIrpStackLocation [esp+upIrp]
call IofCallDriver
ret
FiDO_DispatchPassThrough endp
FiDO_DispatchPower proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
invoke PoStartNextPowerIrp, pIrp
invoke FiDO_DispatchPassThrough, pDeviceObject, pIrp
ret
FiDO_DispatchPower endp
KbFilter_PnP proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
local event:KEVENT
local status:NTSTATUS
push edi
push esi
push ebx
mov eax, pDeviceObject
assume eax:ptr DEVICE_OBJECT
mov ebx, [eax].DeviceExtension
assume ebx:ptr MOUSE_DEVICE_EXTENSION
mov esi, pIrp
assume esi:ptr _IRP
mov edi,DWORD PTR [esi+96]
assume edi:ptr IO_STACK_LOCATION
.if [edi].MinorFunction == IRP_MN_REMOVE_DEVICE
invoke FiDO_DispatchPassThrough, pDeviceObject, pIrp
mov status, eax
invoke IoDetachDevice, (MOUSE_DEVICE_EXTENSION ptr [ebx]).TopOfStack
invoke IoDeleteDevice, pDeviceObject
.elseif [edi].MinorFunction == IRP_MN_QUERY_ID
.if [edi].Parameters.QueryId.IdType == BusQueryDeviceID
mov status, STATUS_SUCCESS
mov [esi].IoStatus.Status, STATUS_SUCCESS
mov [esi].IoStatus.Information, offset hidDeviceName
.elseif [edi].Parameters.QueryId.IdType == BusQueryHardwareIDs
invoke ExAllocatePool, NonPagedPool, sizeof hidDeviceName
.if eax != NULL
mov [esi].IoStatus.Status, STATUS_SUCCESS
mov [esi].IoStatus.Information, eax
push edi
push esi
mov ecx, sizeof hidDeviceName
mov esi, offset hidDeviceName
mov edi, eax
rep movsb
pop esi
pop edi
inc ikk
mov status, STATUS_SUCCESS
.else
mov [esi].IoStatus.Status, STATUS_INSUFFICIENT_RESOURCES
mov status, STATUS_INSUFFICIENT_RESOURCES
.endif
.elseif [edi].Parameters.QueryId.IdType == BusQueryInstanceID
mov status, STATUS_SUCCESS
; mov [esi].IoStatus.Status, STATUS_SUCCESS
mov [esi].IoStatus.Information, 0
.elseif [edi].Parameters.QueryId.IdType == BusQueryCompatibleIDs
mov [esi].IoStatus.Information, 0
mov status, STATUS_NOT_SUPPORTED
.else
mov status, STATUS_NOT_SUPPORTED
.endif
fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT
.elseif [edi].MinorFunction == IRP_MN_START_DEVICE
IoCopyCurrentIrpStackLocationToNext esi
invoke KeInitializeEvent, addr event, NotificationEvent, FALSE
IoSetCompletionRoutine esi, KbFilter_Complete, addr event, TRUE, TRUE, TRUE
mov edx, pIrp
mov ecx, (MOUSE_DEVICE_EXTENSION ptr [ebx]).TopOfStack
call IofCallDriver
mov status, eax
cmp eax, STATUS_PENDING
jne EXIT_START_DEVICE_SUB
WAIT_DRIVER:
invoke KeWaitForSingleObject, addr event, Executive, KernelMode, FALSE, 0
EXIT_START_DEVICE_SUB:
push status
pop [esi].IoStatus.Status
mov [esi].IoStatus.Information, 0
fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT
.else
invoke FiDO_DispatchPassThrough, pDeviceObject, pIrp
mov status, eax
.endif
pop ebx
pop esi
pop edi
mov eax, status
assume esi:nothing
ret
KbFilter_PnP endp
conektproc proc
assume edi:ptr _IRP
assume esi:ptr IO_STACK_LOCATION
assume edx:ptr MOUSE_DEVICE_EXTENSION
.if [edx].UPPER_CONNECT_DATA.ClassService != NULL
mov [edi].IoStatus.Status, STATUS_SHARING_VIOLATION
mov eax, STATUS_SHARING_VIOLATION
.elseif [esi].Parameters.DeviceIoControl.InputBufferLength < 8
mov [edi].IoStatus.Status, STATUS_INVALID_PARAMETER;
mov eax, STATUS_INVALID_PARAMETER;
.else
mov eax, [esi].Parameters.DeviceIoControl.Type3InputBuffer
assume eax:ptr ICONNECT_DATA
mov ecx, [eax].ClassDeviceObject
mov [edx].UPPER_CONNECT_DATA.ClassDeviceObject, ecx
mov ecx, [eax].ClassService
mov [edx].UPPER_CONNECT_DATA.ClassService, ecx
mov [eax].ClassDeviceObject, ebx
assume eax:nothing
mov edx, STATUS_SUCCESS
.endif
ret
conektproc endp
CDO_DispatchDeviceControl proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
local status:NTSTATUS
push ebx
push edi
push esi
mov edi, pIrp
assume edi:ptr _IRP
mov esi,DWORD PTR [edi+96]
assume esi:ptr IO_STACK_LOCATION
movzx eax, [esi].MajorFunction
.if eax == IRP_MJ_INTERNAL_DEVICE_CONTROL
assume esi:ptr IO_STACK_LOCATION
assume eax:nothing
mov ebx, pDeviceObject
assume ebx:ptr DEVICE_OBJECT
mov edx, [ebx].DeviceExtension
assume edx:ptr MOUSE_DEVICE_EXTENSION
assume ebx:nothing
.if [esi].Parameters.DeviceIoControl.IoControlCode == IOCTL_INTERNAL_MOUSE_CONNECT
invoke conektproc
.if edx != STATUS_SUCCESS
push edx
fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT
pop eax
jmp eehyu
.endif
mov (ICONNECT_DATA ptr [eax]).ClassService, offset kbproc
.elseif [esi].Parameters.DeviceIoControl.IoControlCode == IOCTL_INTERNAL_MOUSE_DISCONNECT
mov [edx].UPPER_CONNECT_DATA.ClassDeviceObject, NULL
mov [edx].UPPER_CONNECT_DATA.ClassService, NULL
mov status, STATUS_NOT_IMPLEMENTED
.endif
.endif
invoke FiDO_DispatchPassThrough, pDeviceObject, pIrp
assume edi:nothing
assume esi:nothing
assume edx:nothing
eehyu:
pop esi
pop edi
pop ebx
ret
CDO_DispatchDeviceControl endp
DriverUnload proc pDriverObject:PDRIVER_OBJECT
mov eax, pDriverObject
invoke IoDeleteDevice, (DRIVER_OBJECT PTR [eax]).DeviceObject
mov eax, STATUS_SUCCESS
ret
DriverUnload endp
xKbFilter_AddDevice proc pDriverObject:PDRIVER_OBJECT, pDeviceObject:PDEVICE_OBJECT
local pMouseDeviceObject:PDEVICE_OBJECT
Invoke IoCreateDevice, pDriverObject, sizeof MOUSE_DEVICE_EXTENSION, 0, FILE_DEVICE_MOUSE, \
0, FALSE, addr pMouseDeviceObject
.if eax == STATUS_SUCCESS
invoke IoAttachDeviceToDeviceStack, pMouseDeviceObject, pDeviceObject
.if eax != NULL
mov ecx, pMouseDeviceObject
assume eax:ptr DEVICE_OBJECT
assume ecx:ptr DEVICE_OBJECT
mov ebx, [eax].Flags
mov [ecx].Flags,ebx
or [ecx].Flags, DO_BUFFERED_IO or DO_POWER_PAGABLE
and [ecx].Flags, not DO_DEVICE_INITIALIZING
mov edx, [ecx].DeviceExtension
assume edx:ptr MOUSE_DEVICE_EXTENSION
mov [edx].TopOfStack, eax
assume eax:nothing
assume edx:nothing
mov eax, STATUS_SUCCESS
.else
invoke IoDeleteDevice, pMouseDeviceObject
mov eax, STATUS_DEVICE_NOT_CONNECTED
.endif
.else
mov eax, STATUS_DEVICE_NOT_CONNECTED
.endif
ret
xKbFilter_AddDevice endp
.code INIT
DriverEntry1 proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
local BusDeviceObject:PDEVICE_OBJECT
local status:NTSTATUS
mov status, STATUS_DEVICE_CONFIGURATION_ERROR
invoke IoCreateDevice, pDriverObject, sizeof BUS_DEVICE_EXTENSION, 0, FILE_DEVICE_BUS_EXTENDER, \
FILE_DEVICE_SECURE_OPEN + FILE_AUTOGENERATED_DEVICE_NAME, FALSE, addr MouseDeviceObject
.if eax == STATUS_SUCCESS
mov eax, pDriverObject
assume eax:PTR DRIVER_OBJECT
mov ecx, IRP_MJ_MAXIMUM_FUNCTION + 1
.while ecx
dec ecx
mov [eax].MajorFunction[ecx*(sizeof PVOID)], offset FiDO_DispatchPassThrough
.endw
mov [eax].MajorFunction[IRP_MJ_DEVICE_CONTROL*(sizeof PVOID)], offset CDO_DispatchDeviceControl
mov [eax].MajorFunction[IRP_MJ_INTERNAL_DEVICE_CONTROL*(sizeof PVOID)], offset CDO_DispatchDeviceControl
mov [eax].MajorFunction[IRP_MJ_PNP*(sizeof PVOID)], offset KbFilter_PnP
mov [eax].MajorFunction[IRP_MJ_POWER*(sizeof PVOID)], offset FiDO_DispatchPower
mov ecx, [eax].DriverExtension
assume ecx:PTR DRIVER_EXTENSION
mov [ecx].AddDevice, offset xKbFilter_AddDevice;
mov [eax].DriverUnload, offset DriverUnload
assume eax:nothing
assume ecx:nothing
mov BusDeviceObject, 0
invoke IoReportDetectedDevice, pDriverObject, InterfaceTypeUndefined, -1, -1, NULL, NULL, FALSE, addr BusDeviceObject
.if eax != STATUS_SUCCESS
mov status, STATUS_DEVICE_NOT_CONNECTED
invoke IoDeleteDevice, MouseDeviceObject
.else
invoke IoAttachDeviceToDeviceStack, MouseDeviceObject, BusDeviceObject
.if eax != NULL
inc okk
mov ecx, MouseDeviceObject
assume eax:ptr DEVICE_OBJECT
assume ecx:ptr DEVICE_OBJECT
mov ebx, [eax].Flags
mov [ecx].Flags,ebx
or [ecx].Flags, DO_BUS_ENUMERATED_DEVICE or DO_POWER_PAGABLE
and [ecx].Flags, not DO_DEVICE_INITIALIZING
assume eax:nothing
mov edx, [ecx].DeviceExtension
assume edx:ptr MOUSE_DEVICE_EXTENSION
mov [edx].TopOfStack, eax
assume eax:nothing
assume edx:nothing
mov status, STATUS_SUCCESS
.else
mov status, STATUS_DEVICE_NOT_CONNECTED
invoke IoDeleteDevice, MouseDeviceObject
.endif
.endif
.endif
mov eax, status
ret
DriverEntry1 endp
end DriverEntry1
и надо в выше приведённом inf`е поменять значение StartType на 1.
А в драйвере, о котором шла до этого речь выяснилось, что к устройству №3 (в этом коде оно в xKbFilter_AddDevice в переменной pMouseDeviceObject) почему-то не приходят IRP`ы удаления типа: IRP_MN_QUERY_REMOVE_DEVICE, IRP_MN_REMOVE_DEVICE.... Поэтому и не выключается, а соответстенно, наверно, при следующем старте винды оно и не включается.
