win32k!StartDeviceRead函数读取usb鼠标中的数据
0: kd> g
MouHid: read is pending
Breakpoint 5 hit
eax=00000000 ebx=00000000 ecx=8940bc01 edx=80b144e1 esi=8940bcd8 edi=8940be47
eip=f7668b84 esp=80b14424 ebp=80b14450 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouhid!MouHid_ReadComplete:
f7668b84 55 push ebp
0: kd> g
MouHid: ReadComplete: Enter.Breakpoint 3 hit
eax=898db2f8 ebx=00000000 ecx=00000041 edx=00000002 esi=894dc7e0 edi=898db210
eip=f74fa596 esp=80b143ec ebp=80b14420 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
mouclass!MouseClassServiceCallback:
f74fa596 55 push ebp
0: kd> g
MOUCLASS-MouseClassServiceCallback: enter
MOUCLASS-MouseClassServiceCallback: bytes remaining after move to SystemBuffer 0x18
MOUCLASS-MouseClassServiceCallback: unused bytes in class queue 0x8e8, remaining bytes in port queue 0x18
MOUCLASS-MouseClassServiceCallback: total number of bytes to move to class queue 0x18
MOUCLASS-MouseClassServiceCallback: number of bytes to end of class buffer 0x528
MOUCLASS-MouseClassServiceCallback: number of bytes in first move to class 0x18
MOUCLASS-MouseClassServiceCallback: move bytes from 0x898db2f8 to 0x898535e8
MOUCLASS-MouseClassServiceCallback: changed InputCount to 6 entries in the class queue
MOUCLASS-MouseClassServiceCallback: DataIn 0x89853600, DataOut 0x89853570
MOUCLASS-MouseClassServiceCallback: Input data items consumed = 1
MOUCLASS-MouseClassServiceCallback: exit
MouHid: calling StartRead directly
Breakpoint 6 hit
eax=00000000 ebx=00000000 ecx=f7668b46 edx=0000001b esi=894dc7e0 edi=898db210
eip=f76691ce esp=80b143f8 ebp=80b14420 iopl=0 nv up ei pl nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000213
mouhid!MouHid_StartRead:
f76691ce 55 push ebp
0: kd> bd 6
0: kd> g
MouHid: Start Read: Ente
MouHid: read is pending
Breakpoint 1 hit
eax=00000000 ebx=bfa02600 ecx=00000000 edx=80bf6160 esi=e162bd40 edi=bfa01624
eip=bf8e9149 esp=bab9a8dc ebp=bab9a8f0 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206
win32k!ProcessMouseInput:
bf8e9149 55 push ebp
0: kd> dv
pMouseInfo = 0xe162bd40
ptLastMove = {x=-1081175735 y=8}
0: kd> dx -r1 ((win32k!tagDEVICEINFO *)0xe162bd40)
((win32k!tagDEVICEINFO *)0xe162bd40) : 0xe162bd40 [Type: tagDEVICEINFO *]
[+0x000] head [Type: _HEAD]
[+0x008] pNext : 0xe1414eb8 [Type: tagDEVICEINFO *]
[+0x00c] type : 0x0 [Type: unsigned char]
[+0x00d] bFlags : 0x2 [Type: unsigned char]
[+0x00e] usActions : 0x0 [Type: unsigned short]
[+0x010] nRetryRead : 0x0 [Type: unsigned char]
[+0x014] ustrName : "\??\HID#Vid_0e0f&Pid_0003&MI_00#8&28f6544d&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" [Type: _UNICODE_STRING]
[+0x01c] handle : 0x21c [Type: void *]
[+0x020] NotificationEntry : 0xe13e70c0 [Type: void *]
[+0x024] pkeHidChangeCompleted : 0x897fb9c0 [Type: _KEVENT *]
[+0x028] iosb [Type: _IO_STATUS_BLOCK]
[+0x030] ReadStatus : 259 [Type: long]
[+0x034] OpenerProcess : 0x1b0 [Type: void *]
[+0x038] OpenStatus : 0 [Type: long]
[+0x03c] AttrStatus : 0 [Type: long]
[+0x040] timeStartRead : 0xffcaec3d [Type: unsigned long]
[+0x044] timeEndRead : 0xffcaec4b [Type: unsigned long]
[+0x048] nReadsOutstanding : 0 [Type: int]
[+0x04c] mouse [Type: tagMOUSE_DEVICE_INFO]
[+0x04c] keyboard [Type: tagKEYBOARD_DEVICE_INFO]
[+0x04c] hid [Type: tagHID_DEVICE_INFO]
0: kd> dx -r1 (*((win32k!_IO_STATUS_BLOCK *)0xe162bd68))
(*((win32k!_IO_STATUS_BLOCK *)0xe162bd68)) [Type: _IO_STATUS_BLOCK]
[+0x000] Status : 0 [Type: long]
[+0x000] Pointer : 0x0 [Type: void *]
[+0x004] Information : 0x18 [Type: unsigned long]
0: kd> dx -r1 (*((win32k!tagMOUSE_DEVICE_INFO *)0xe162bd8c))
(*((win32k!tagMOUSE_DEVICE_INFO *)0xe162bd8c)) [Type: tagMOUSE_DEVICE_INFO]
[+0x000] Attr [Type: _MOUSE_ATTRIBUTES]
[+0x00c] Data [Type: _MOUSE_INPUT_DATA [10]]
0: kd> dx -r1 (*((win32k!_MOUSE_INPUT_DATA (*)[10])0xe162bd98))
(*((win32k!_MOUSE_INPUT_DATA (*)[10])0xe162bd98)) [Type: _MOUSE_INPUT_DATA [10]]
[0] [Type: _MOUSE_INPUT_DATA]
[1] [Type: _MOUSE_INPUT_DATA]
[2] [Type: _MOUSE_INPUT_DATA]
[3] [Type: _MOUSE_INPUT_DATA]
[4] [Type: _MOUSE_INPUT_DATA]
[5] [Type: _MOUSE_INPUT_DATA]
[6] [Type: _MOUSE_INPUT_DATA]
[7] [Type: _MOUSE_INPUT_DATA]
[8] [Type: _MOUSE_INPUT_DATA]
[9] [Type: _MOUSE_INPUT_DATA]
0: kd> dx -r1 (*((win32k!_MOUSE_INPUT_DATA *)0xe162bd98))
(*((win32k!_MOUSE_INPUT_DATA *)0xe162bd98)) [Type: _MOUSE_INPUT_DATA]
[+0x000] UnitId : 0x1 [Type: unsigned short]
[+0x002] Flags : 0x1 [Type: unsigned short]
[+0x004] Buttons : 0x0 [Type: unsigned long]
[+0x004] ButtonFlags : 0x0 [Type: unsigned short]
[+0x006] ButtonData : 0x0 [Type: unsigned short]
[+0x008] RawButtons : 0x0 [Type: unsigned long]
[+0x00c] LastX : 28830 [Type: long]
[+0x010] LastY : 44582 [Type: long]
[+0x014] ExtraInformation : 0x0 [Type: unsigned long]
0: kd> g
Breakpoint 2 hit
eax=00000000 ebx=ffcb2240 ecx=bc510013 edx=00000100 esi=e162bd98 edi=00000000
eip=bf8e7542 esp=bab9a898 ebp=bab9a8d8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
win32k!QueueMouseEvent:
bf8e7542 55 push ebp
0: kd> dv
ButtonFlags = 0
ButtonData = 0
ExtraInfo = 0
ptMouse = {x=450 y=522}
time = 0n-3464640
hDevice = 0x00010049
pmei = 0xe162bd98
bInjected = 0n0
bWakeRIT = 0n1
第二部分：
0: kd> g
Breakpoint 4 hit
eax=00000000 ebx=bfa02600 ecx=00000000 edx=000c08e1 esi=e162bd40 edi=bfa01624
eip=bf8fc06b esp=bab9a8dc ebp=bab9a8f0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
win32k!StartDeviceRead:
bf8fc06b 55 push ebp
0: kd> dv
pDeviceInfo = 0xe162bd40
ulLengthToRead = 0xe162bd40
pBuffer = 0x00000008
fAlreadyHadDeviceInfoCrit = 0n-513622720
0: kd> g
MOUCLASS-MouseClassRead: enter
Breakpoint 0 hit
eax=8940618c ebx=894060f0 ecx=89406188 edx=00000000 esi=897907c8 edi=897907c8
eip=f74f9d26 esp=bab9a6f0 ebp=bab9a70c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouclass!MouseClassReadCopyData:
f74f9d26 55 push ebp
0: kd> dv DeviceExtension
DeviceExtension = 0x894060f0
0: kd> dx -r1 ((mouclass!_DEVICE_EXTENSION *)0x894060f0)
((mouclass!_DEVICE_EXTENSION *)0x894060f0) : 0x894060f0 [Type: _DEVICE_EXTENSION *]
[+0x000] Self : 0x89406038 : Device for "\Driver\Mouclass" [Type: _DEVICE_OBJECT *]
[+0x004] TrueClassDevice : 0x89406038 : Device for "\Driver\Mouclass" [Type: _DEVICE_OBJECT *]
[+0x008] TopPort : 0x898db158 : Device for "\Driver\mouhid" [Type: _DEVICE_OBJECT *]
[+0x00c] PDO : 0x89536cc0 : Device for "\Driver\hidusb" [Type: _DEVICE_OBJECT *]
[+0x010] RemoveLock [Type: _IO_REMOVE_LOCK]
[+0x068] PnP : 0x1 [Type: unsigned char]
[+0x069] Started : 0x1 [Type: unsigned char]
[+0x06a] OkayToLogOverflow : 0x1 [Type: unsigned char]
[+0x06c] WaitWakeSpinLock : 0x0 [Type: unsigned long]
[+0x070] TrustedSubsystemCount : 0x1 [Type: unsigned long]
[+0x074] InputCount : 0x6 [Type: unsigned long]
[+0x078] SymbolicLinkName : "\??\HID#Vid_0e0f&Pid_0003&MI_00#8&28f6544d&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" [Type: _UNICODE_STRING]
[+0x080] InputData : 0x898531b0 [Type: _MOUSE_INPUT_DATA *]
[+0x084] DataIn : 0x89853600 [Type: _MOUSE_INPUT_DATA *]
[+0x088] DataOut : 0x89853570 [Type: _MOUSE_INPUT_DATA *]
[+0x08c] MouseAttributes [Type: _MOUSE_ATTRIBUTES]
[+0x098] SpinLock : 0x895aada1 [Type: unsigned long]
[+0x09c] ReadQueue [Type: _LIST_ENTRY]
[+0x0a4] SequenceNumber : 0x1b [Type: unsigned long]
[+0x0a8] DeviceState : PowerDeviceD0 (1) [Type: _DEVICE_POWER_STATE]
[+0x0ac] SystemState : PowerSystemWorking (1) [Type: _SYSTEM_POWER_STATE]
[+0x0b0] UnitId : 0x0 [Type: unsigned long]
[+0x0b4] WmiLibInfo [Type: _WMILIB_CONTEXT]
[+0x0d4] SystemToDeviceState [Type: _DEVICE_POWER_STATE [5]]
[+0x0e8] MinDeviceWakeState : PowerDeviceD0 (1) [Type: _DEVICE_POWER_STATE]
[+0x0ec] MinSystemWakeState : PowerSystemSleeping1 (2) [Type: _SYSTEM_POWER_STATE]
[+0x0f0] WaitWakeIrp : 0x0 [Type: _IRP *]
[+0x0f4] ExtraWaitWakeIrp : 0x0 [Type: _IRP *]
[+0x0f8] TargetNotifyHandle : 0x0 [Type: void *]
[+0x0fc] Link [Type: _LIST_ENTRY]
[+0x104] File : 0x0 [Type: _FILE_OBJECT *]
[+0x108] Enabled : 0x0 [Type: unsigned char]
[+0x109] WaitWakeEnabled : 0x0 [Type: unsigned char]
[+0x10a] SurpriseRemoved : 0x0 [Type: unsigned char]
0: kd> dx -r1 (*((mouclass!_LIST_ENTRY *)0x8940618c))
(*((mouclass!_LIST_ENTRY *)0x8940618c)) [Type: _LIST_ENTRY]
[+0x000] Flink : 0x8940618c [Type: _LIST_ENTRY *]
[+0x004] Blink : 0x8940618c [Type: _LIST_ENTRY *]
0: kd> kc
#
00 mouclass!MouseClassReadCopyData
01 mouclass!MouseClassHandleRead
02 mouclass!MouseClassRead
03 nt!IofCallDriver
04 nt!IopSynchronousServiceTail
05 nt!NtReadFile
06 nt!_KiSystemService
07 nt!ZwReadFile
08 win32k!StartDeviceRead
09 win32k!InputApc
0a nt!KiDeliverApc
0b nt!KiSwapThread
0c nt!KeWaitForMultipleObjects
0d win32k!xxxMsgWaitForMultipleObjects
0e win32k!xxxDesktopThread
0f win32k!xxxCreateSystemThreads
10 win32k!NtUserCallOneParam
11 nt!_KiSystemService
0: kd> dv
DeviceExtension = 0x894060f0
Irp = 0x897907c8
moveSize = 0x894060f0
irpSp = 0x00000008Process 898a7258 has invalid page directories
0: kd> dx -r1 ((mouclass!_IRP *)0x897907c8)
((mouclass!_IRP *)0x897907c8) : 0x897907c8 [Type: _IRP *]
[<Raw View>] [Type: _IRP]
IoStack : Size = 10, Current IRP_MJ_READ / 0x0 for Device for "\Driver\Mouclass"
CurrentThread : 0x895aada0 [Type: _ETHREAD *]
0: kd> dx -r1 -nv (*((mouclass!_IRP *)0x897907c8))
(*((mouclass!_IRP *)0x897907c8)) [Type: _IRP]
[+0x000] Type : 6 [Type: short]
[+0x002] Size : 0x1d8 [Type: unsigned short]
[+0x004] MdlAddress : 0x0 [Type: _MDL *]
[+0x008] Flags : 0x970 [Type: unsigned long]
[+0x00c] AssociatedIrp [Type: __unnamed]
[+0x010] ThreadListEntry [Type: _LIST_ENTRY]
[+0x018] IoStatus [Type: _IO_STATUS_BLOCK]
[+0x020] RequestorMode : 0 [Type: char]
[+0x021] PendingReturned : 0x0 [Type: unsigned char]
[+0x022] StackCount : 10 '\n' [Type: char]
[+0x023] CurrentLocation : 10 '\n' [Type: char]
[+0x024] Cancel : 0x0 [Type: unsigned char]
[+0x025] CancelIrql : 0x0 [Type: unsigned char]
[+0x026] ApcEnvironment : 0 [Type: char]
[+0x027] AllocationFlags : 0x1 [Type: unsigned char]
[+0x028] UserIosb : 0xe162bd68 [Type: _IO_STATUS_BLOCK *]
[+0x02c] UserEvent : 0x0 [Type: _KEVENT *]
[+0x030] Overlay [Type: __unnamed]
[+0x038] CancelRoutine : 0x0 [Type: void (*)(_DEVICE_OBJECT *,_IRP *)]
[+0x03c] UserBuffer : 0xe162bd98 [Type: void *]
[+0x040] Tail [Type: __unnamed]
0: kd> dd 0x897907c8
897907c8 01d80006 00000000 00000970 894dee70
897907d8 89577018 895aafb8 00000103 00000000
897907e8 0a0a0000 01000000 e162bd68 00000000
897907f8 bf8e7891 e162bd40 00000000 e162bd98
89790808 00000000 00000000 00000000 00000000
89790818 895aada0 00000000 00000000 00000000
89790828 8979097c 8983d458 00000000 00000000
89790838 00000000 00000000 00000000 00000000
0: kd> dd 8979097c
8979097c 00000003 000000f0 00000000 00000000
8979098c 00000000 89406038 8983d458 00000000
8979099c 00000000 00000000 898a7258 0a06003d
897909ac 20646156 89578b0b 895524b8 00000000
897909bc 000751c0 0007527b 07100002 894dd428
897909cc e14cabe0 fffffffc 40000000 0a060006
897909dc 20646156 895feca0 00000000 00000000
897909ec 00076940 00076959 07100002 89492768
0: kd> g
MOUCLASS-MouseClassCopyReadData: queue size 0x90, read length 0xf0
MOUCLASS-MouseClassCopyReadData: bytes to end of queue 0x5a0
MOUCLASS-MouseClassCopyReadData:number of bytes in first move 0x90
MOUCLASS-MouseClassCopyReadData: move bytes from 0x89853570 to 0x894dee70
MOUCLASS-MouseClassCopyReadData: Okay to log overflow
MOUCLASS-MouseClassCopyReadData: new DataIn 0x89853600, DataOut 0x89853600
MOUCLASS-MouseClassCopyReadData: new InputCount 0
0: kd> dt file_object 8983d458
winsrv!FILE_OBJECT
+0x000 Type : 0n5
+0x002 Size : 0n112
+0x004 DeviceObject : 0x89536cc0 _DEVICE_OBJECT
+0x008 Vpb : (null)
+0x00c FsContext : 0x895aad18 Void
+0x010 FsContext2 : 0xf750180e Void
+0x014 SectionObjectPointer : (null)
+0x018 PrivateCacheMap : (null)
+0x01c FinalStatus : 0n0
+0x020 RelatedFileObject : (null)
+0x024 LockOperation : 0 ''
+0x025 DeletePending : 0 ''
+0x026 ReadAccess : 0 ''
+0x027 WriteAccess : 0 ''
+0x028 DeleteAccess : 0 ''
+0x029 SharedRead : 0 ''
+0x02a SharedWrite : 0 ''
+0x02b SharedDelete : 0 ''
+0x02c Flags : 0x40000
+0x030 FileName : _UNICODE_STRING ""
+0x038 CurrentByteOffset : _LARGE_INTEGER 0x0
+0x040 Waiters : 0
+0x044 Busy : 0
+0x048 LastLock : (null)
+0x04c Lock : _KEVENT
+0x05c Event : _KEVENT
+0x06c CompletionContext : (null)
0: kd> dx -id 0,0,898a7258 -r1 ((winsrv!_DEVICE_OBJECT *)0x89536cc0)
((winsrv!_DEVICE_OBJECT *)0x89536cc0) : 0x89536cc0 : Device for "\Driver\hidusb" [Type: _DEVICE_OBJECT *]
[<Raw View>] [Type: _DEVICE_OBJECT]
Flags : 0x3040
UpperDevices : Immediately above is Device for "\Driver\mouhid" [at 0x898db158]
LowerDevices
Driver : 0x895c35f0 : Driver "\Driver\hidusb" [Type: _DRIVER_OBJECT *]
0: kd> dx -id 0,0,898a7258 -r1 -nv (*((winsrv!_DEVICE_OBJECT *)0x89536cc0))
(*((winsrv!_DEVICE_OBJECT *)0x89536cc0)) : Device for "\Driver\hidusb" [Type: _DEVICE_OBJECT]
[+0x000] Type : 3 [Type: short]
[+0x002] Size : 0x30c [Type: unsigned short]
[+0x004] ReferenceCount : 1 [Type: long]
[+0x008] DriverObject : 0x895c35f0 : Driver "\Driver\hidusb" [Type: _DRIVER_OBJECT *]
[+0x00c] NextDevice : 0x89626cc0 : Device for "\Driver\hidusb" [Type: _DEVICE_OBJECT *]
[+0x010] AttachedDevice : 0x898db158 : Device for "\Driver\mouhid" [Type: _DEVICE_OBJECT *]
[+0x014] CurrentIrp : 0x0 [Type: _IRP *]
[+0x018] Timer : 0x0 [Type: _IO_TIMER *]
[+0x01c] Flags : 0x3040 [Type: unsigned long]
[+0x020] Characteristics : 0x80 [Type: unsigned long]
[+0x024] Vpb : 0x0 [Type: _VPB *]
[+0x028] DeviceExtension : 0x89536d78 [Type: void *]
[+0x02c] DeviceType : 0x22 [Type: unsigned long]
[+0x030] StackSize : 8 [Type: char]
[+0x034] Queue [Type: __unnamed]
[+0x05c] AlignmentRequirement : 0x0 [Type: unsigned long]
[+0x060] DeviceQueue [Type: _KDEVICE_QUEUE]
[+0x074] Dpc [Type: _KDPC]
[+0x094] ActiveThreadCount : 0x0 [Type: unsigned long]
[+0x098] SecurityDescriptor : 0xe12977c0 [Type: void *]
[+0x09c] DeviceLock [Type: _KEVENT]
[+0x0ac] SectorSize : 0x0 [Type: unsigned short]
[+0x0ae] Spare1 : 0x1 [Type: unsigned short]
[+0x0b0] DeviceObjectExtension : 0x89536fd0 [Type: _DEVOBJ_EXTENSION *]
[+0x0b4] Reserved : 0x0 [Type: void *]
)