WindowsAPI编程核心技术-键盘按键记录过滤驱动

实现原理

驱动中有设备栈的概念，栈内成员是设备，一个连着一个。同一个设备栈中的设备，IRP传递方向是从栈顶到栈底。新添加的设备附加在设备栈顶，新设备总最先获取IRP数据。

键盘过滤驱动工作在异步模式下，发送请求IRP_MJ_READ到驱动设备栈，驱动收到后挂起，直到按下一个键，驱动完成IRP并作为返回值返回。IRP带着数据返回后被传递给对应事件系统处理，系统再紧接着发送下一个IRP_MJ_READ请求。

驱动程序创建一个键盘设备，附加在键盘类KbdClass设备栈上顶。

创建过滤驱动设备

NTSTATUS AttachKdbClass(PDEVICE_OBJECT pDevObj) {
	DbgPrint("Enter HookKdbClass\n");
	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING ustrObjectName;
	PFILE_OBJECT pFileObj = NULL;
	PDEVICE_OBJECT pKeyboardClassDeviceObject = NULL, pAttachDevObj = NULL;
	RtlInitUnicodeString(&ustrObjectName, TEXT("\\Device\\KeyboardClass0"));
	// 获取键盘设备对象的指针
	status = IoGetDeviceObjectPointer(&ustrObjectName, GENERIC_READ | GENERIC_WRITE, &pFileObj, &pKeyboardClassDeviceObject);
	if (!NT_SUCCESS(status)) {
		DbgPrint("IoGetDeviceObjectPointer Error[0x%X]\n", status);
		return status;
	};
	// 减少引用
	ObReferenceObject(pFileObj);
	// 将当前设备附加到键盘设备的设备栈顶上, 返回的是原来设备栈上的栈顶设备, 即当前设栈上附加设备的下一个设备
	pAttachDevObj = IoAttachDeviceToDeviceStack(pDevObj, pKeyboardClassDeviceObject);
	if (NULL == pAttachDevObj) {
		DbgPrint("IoAttachDeviceToDeviceStack Error\n");
		return STATUS_UNSUCCESSFUL;
	};
	// 设置此设备的标志，要与附加到的设备栈上的设备标志保持一致
	pDevObj->Flags = pDevObj->Flags | DO_BUFFERED_IO | DO_POWER_PAGABLE;
	pDevObj->ActiveThreadCount = pDevObj->ActiveThreadCount & (~DO_DEVICE_INITIALIZING);
	// 保存下一设备到DeviceExtension
	((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pAttachDevObj = pAttachDevObj;
	((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene = 0;
	DbgPrint("Leave HookKdbClass\n");
	return status;
};

读请求处理

IRP发来后设置完成回调函数，从中获取按键信息：

NTSTATUS DriverRead(PDEVICE_OBJECT pDevObj, PIRP pIrp) {
	DbgPrint("\nEnter DriverRead\n");
	NTSTATUS status = STATUS_SUCCESS;
	// 复制 pIrp 的 IO_STACK_LOCATION 到下一设备
	IoCopyCurrentIrpStackLocationToNext(pIrp);
	// 设置完成实例
	IoSetCompletionRoutine(pIrp, ReadCompleteRoutine, pDevObj, TRUE, TRUE, TRUE);
	// 记录IRP数量
	((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene++;
	// 发送IRP到下一设备上
	status = IoCallDriver(((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pAttachDevObj, pIrp);
	DbgPrint("Leave DriverRead\n");
	return status;
};

按键信息

从完成函数IRP中的AssociatedIrp.SystemBuffer获取按键数据信息PKEYBOARD_INPUT_DATA，结构定义如下：

typedef struct _KEYBOARD_INPUT_DATA {
    USHORT UnitId;
    USHORT MakeCode; //扫描码
    USHORT Flags; //0按下 1谈起
    USHORT Reserved;
    ULONG ExtraInformation;
} KEYBOARD_INPUT_DATA, *PKEYBOARD_INPUT_DATA;

这个结构可以连着多个，所以得先算出到底一块按了几个键。完成回调函数：

NTSTATUS ReadCompleteRoutine(PDEVICE_OBJECT pDevObj, PIRP pIrp, PVOID pContext) {
	NTSTATUS status = pIrp->IoStatus.Status;
	PKEYBOARD_INPUT_DATA pKeyboardInputData = NULL;
	ULONG ulKeyCount = 0, i = 0;
	if (NT_SUCCESS(status)) {
		pKeyboardInputData = (PKEYBOARD_INPUT_DATA)pIrp->AssociatedIrp.SystemBuffer;
		ulKeyCount = (ULONG)pIrp->IoStatus.Information / sizeof(KEYBOARD_INPUT_DATA);
		// 获取按键数据
		for (i = 0; i < ulKeyCount; i++)
			// Key Press
			if (KEY_MAKE == pKeyboardInputData[i].Flags)
				// 按键扫描码
				DbgPrint("[Down][0x%X]\n", pKeyboardInputData[i].MakeCode);
			// Key Release
			else if (KEY_BREAK == pKeyboardInputData[i].Flags)
				// 按键扫描码
				DbgPrint("[Up][0x%X]\n", pKeyboardInputData[i].MakeCode);
		//可以添加上这这一句，然后按键全部被改为了 按下 A
		//pKeyboardInputData[i].MakeCode = 0x1e;
	};
	if (pIrp->PendingReturned)
		IoMarkIrpPending(pIrp);
	// 减少IRP在队列的数量
	((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene--;
	status = pIrp->IoStatus.Status;
	return status;
};

驱动卸载

因为基本一直会有IRP_MJ_READ请求在等待按键，只有极短事件处于非挂起状态。如果这时卸载驱动，按键后IRP上传找不到驱动直接蓝屏。

想要动态卸载，就在设备扩展中添加一个ulIrpInQueue域。卸载时先取消附加键盘设备，再一直循环判断ulIrpInQueue是否为0，不为0等待。直到用户手动按键，它就会在IRP中完成返回。由于不附加键盘设备栈，就不会有新的IRP_MJ_READ产生，此时ulIrpInQueue为0，可正常卸载。

但这样需要手动按一个键后才能真正卸载。

VOID DriverUnload(PDRIVER_OBJECT pDriverObject) {
	DbgPrint("Enter DriverUnload\n");
	PDEVICE_OBJECT pDevObj = pDriverObject->DeviceObject;
	LARGE_INTEGER liDelay = { 0 };
	if (NULL == pDevObj)
		return;
	if (NULL == pDevObj->DeviceExtension)
		return;
	// 先把过滤驱动设备和键盘设备分离, 以免产生新的IRP_MJ_READ
	IoDetachDevice(((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pAttachDevObj);
	// 对于为完成的IRP，因为只前通过IoSetCompletionRoutine已经设置IO完成例程 那么对于未完成的IRP ，在完成之后会调用 该层设备的函数 需要手动按键, 是pending状态的IRP完成返回
	liDelay.QuadPart = -1000000;
	while (0 < ((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene) {
		KdPrint(("剩余挂起IRP:%d\n", ((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene));
		KeDelayExecutionThread(KernelMode, FALSE, &liDelay);
		/*
		// 该方法在Win10上不适用
		if (1 == ((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene)
			//取消掉最后一个IRP
			IoCancelIrp(((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pLastIrp);
		*/
	};
	UNICODE_STRING ustrSymName;
	RtlInitUnicodeString(&ustrSymName, SYM_NAME);
	IoDeleteSymbolicLink(&ustrSymName);
	if (pDriverObject->DeviceObject)
		IoDeleteDevice(pDriverObject->DeviceObject);
	DbgPrint("Leave DriverUnload\n");
	return;
};

源代码

Driver.h：

#ifndef _DRIVER_H_
#define _DRIVER_H_


#include <ntddk.h>
#include <Ntddkbd.h>


#define DEV_NAME L"\\Device\\KEYBOARD_LOG_DEV_NAME"
#define SYM_NAME L"\\DosDevices\\KEYBOARD_LOG_SYM_NAME"
#define IOCTL_TEST CTL_CODE(FILE_DEVICE_KEYBOARD, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)


typedef struct _DEVICE_EXTENSION
{
	PDEVICE_OBJECT pAttachDevObj;
	ULONG ulIrpInQuene;

}DEVICE_EXTENSION, *PDEVICE_EXTENSION;



VOID DriverUnload(PDRIVER_OBJECT pDriverObject);
NTSTATUS DriverDefaultHandle(PDEVICE_OBJECT pDevObj, PIRP pIrp);
NTSTATUS DriverControlHandle(PDEVICE_OBJECT pDevObj, PIRP pIrp);
NTSTATUS DriverRead(PDEVICE_OBJECT pDevObj, PIRP pIrp);
NTSTATUS DriverPower(PDEVICE_OBJECT pDevObj, PIRP pIrp);
NTSTATUS ReadCompleteRoutine(PDEVICE_OBJECT pDevObj, PIRP pIrp, PVOID pContext);
NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject);
NTSTATUS AttachKdbClass(PDEVICE_OBJECT pDevObj);


#endif

Driver.c：

#include "Driver.h"


NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
	DbgPrint("Enter DriverEntry\n");
	NTSTATUS status = STATUS_SUCCESS;
	ULONG i = 0;

	for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
	{
		pDriverObject->MajorFunction[i] = DriverDefaultHandle;
	}

	pDriverObject->DriverUnload = DriverUnload;
	pDriverObject->MajorFunction[IRP_MJ_CREATE] = DriverDefaultHandle;
	pDriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverDefaultHandle;
	pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DriverControlHandle;

	pDriverObject->MajorFunction[IRP_MJ_READ] = DriverRead;
	pDriverObject->MajorFunction[IRP_MJ_POWER] = DriverPower;

	// 创建键盘设备
	status = CreateDevice(pDriverObject);
	if (!NT_SUCCESS(status))
	{
		DbgPrint("CreateDevice Error[0x%X]\n", status);
		return status;
	}

	// 附件设备到键盘设备栈上
	status = AttachKdbClass(pDriverObject->DeviceObject);
	if (!NT_SUCCESS(status))
	{
		DbgPrint("AttachKdbClass Error[0x%X]\n", status);
		return status;
	}

	DbgPrint("Leave DriverEntry\n");
	return status;
}


VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	DbgPrint("Enter DriverUnload\n");
	PDEVICE_OBJECT pDevObj = pDriverObject->DeviceObject;
	LARGE_INTEGER liDelay = { 0 };

	if (NULL == pDevObj)
	{
		return;
	}
	if (NULL == pDevObj->DeviceExtension)
	{
		return;
	}

	// 先把过滤驱动设备和键盘设备分离, 以免产生新的IRP_MJ_READ
	IoDetachDevice(((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pAttachDevObj);

	// 对于为完成的IRP，因为只前通过IoSetCompletionRoutine已经设置IO完成例程
	// 那么对于未完成的IRP ，在完成之后会调用 该层设备的函数
	// 需要手动按键, 是pending状态的IRP完成返回
	liDelay.QuadPart = -1000000;
	while (0 < ((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene)
	{
		KdPrint(("剩余挂起IRP:%d\n", ((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene));
		KeDelayExecutionThread(KernelMode, FALSE, &liDelay);
		/*
		// 该方法在Win10上不适用
		if (1 == ((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene)
		{
			//取消掉最后一个IRP
			IoCancelIrp(((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pLastIrp);
		}
		*/
	}

	UNICODE_STRING ustrSymName;
	RtlInitUnicodeString(&ustrSymName, SYM_NAME);
	IoDeleteSymbolicLink(&ustrSymName);

	if (pDriverObject->DeviceObject)
	{
		IoDeleteDevice(pDriverObject->DeviceObject);
	}

	DbgPrint("Leave DriverUnload\n");
}


NTSTATUS DriverDefaultHandle(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	DbgPrint("Enter DriverDefaultHandle\n");
	
	NTSTATUS status = STATUS_SUCCESS;
	
	pIrp->IoStatus.Status = status;
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	DbgPrint("Leave DriverDefaultHandle\n");
	return status;
}


NTSTATUS DriverControlHandle(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	DbgPrint("Enter DriverControlHandle\n");
	NTSTATUS status = STATUS_SUCCESS;
	PIO_STACK_LOCATION pIoStackLocation = IoGetCurrentIrpStackLocation(pIrp);
	ULONG ulInputLength = pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
	ULONG ulOutputLength = pIoStackLocation->Parameters.DeviceIoControl.OutputBufferLength;
	ULONG ulControlCode = pIoStackLocation->Parameters.DeviceIoControl.IoControlCode;
	ULONG ulInfo = 0;
	PVOID pBuf = pIrp->AssociatedIrp.SystemBuffer;

	switch (ulControlCode)
	{
	case IOCTL_TEST:
	{
		break;
	}
	default:
		break;
	}

	pIrp->IoStatus.Status = status;
	pIrp->IoStatus.Information = ulInfo;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	DbgPrint("Enter DriverControlHandle\n");
	return status;
}


NTSTATUS DriverPower(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	DbgPrint("Enter DriverPower\n");
	NTSTATUS status = STATUS_SUCCESS;

	PoStartNextPowerIrp(pIrp);
	IoSkipCurrentIrpStackLocation(pIrp);
	status = PoCallDriver(((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pAttachDevObj, pIrp);

	DbgPrint("Leave DriverPower\n");
	return status;
}


NTSTATUS DriverRead(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	DbgPrint("\nEnter DriverRead\n");
	NTSTATUS status = STATUS_SUCCESS;

	// 复制 pIrp 的 IO_STACK_LOCATION 到下一设备
	IoCopyCurrentIrpStackLocationToNext(pIrp);

	// 设置完成实例
	IoSetCompletionRoutine(pIrp, ReadCompleteRoutine, pDevObj, TRUE, TRUE, TRUE);

	// 记录IRP数量
	((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene++;

	// 发送IRP到下一设备上
	status = IoCallDriver(((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pAttachDevObj, pIrp);

	DbgPrint("Leave DriverRead\n");
	return status;
}


NTSTATUS ReadCompleteRoutine(PDEVICE_OBJECT pDevObj, PIRP pIrp, PVOID pContext)
{
	NTSTATUS status = pIrp->IoStatus.Status;
	PKEYBOARD_INPUT_DATA pKeyboardInputData = NULL;
	ULONG ulKeyCount = 0, i = 0;

	if (NT_SUCCESS(status))
	{
		pKeyboardInputData = (PKEYBOARD_INPUT_DATA)pIrp->AssociatedIrp.SystemBuffer;
		ulKeyCount = (ULONG)pIrp->IoStatus.Information / sizeof(KEYBOARD_INPUT_DATA);

		// 获取按键数据
		for (i = 0; i < ulKeyCount; i++)
		{
			// Key Press
			if (KEY_MAKE == pKeyboardInputData[i].Flags)
			{
				// 按键扫描码
				DbgPrint("[Down][0x%X]\n", pKeyboardInputData[i].MakeCode);
			}
			// Key Release
			else if (KEY_BREAK == pKeyboardInputData[i].Flags)
			{
				// 按键扫描码
				DbgPrint("[Up][0x%X]\n", pKeyboardInputData[i].MakeCode);
			}
			//可以添加上这这一句，然后按键全部被改为了 按下 A
//			pKeyboardInputData[i].MakeCode = 0x1e;
		}
	}

	if (pIrp->PendingReturned)
	{
		IoMarkIrpPending(pIrp);
	}

	// 减少IRP在队列的数量
	((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene--;

	status = pIrp->IoStatus.Status;
	return status;
}


NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject)
{
	DbgPrint("Enter CreateDevice\n");
	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING ustrDevName, ustrSymName;
	PDEVICE_OBJECT pDevObj = NULL;

	RtlInitUnicodeString(&ustrDevName, DEV_NAME);
	RtlInitUnicodeString(&ustrSymName, SYM_NAME);

	// 创建键盘设备
	status = IoCreateDevice(pDriverObject, sizeof(DEVICE_EXTENSION), &ustrDevName, FILE_DEVICE_KEYBOARD, 0, FALSE, &pDevObj);
	if (!NT_SUCCESS(status))
	{
		DbgPrint("IoCreateDevice Error[0x%X]\n", status);
		return status;
	}

	// 创建符号连接
	status = IoCreateSymbolicLink(&ustrSymName, &ustrDevName);
	if (!NT_SUCCESS(status))
	{
		DbgPrint("IoCreateSymbolicLink Error[0x%X]\n", status);
		return status;
	}

	DbgPrint("Enter CreateDevice\n");
	return status;
}


NTSTATUS AttachKdbClass(PDEVICE_OBJECT pDevObj)
{
	DbgPrint("Enter HookKdbClass\n");
	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING ustrObjectName;
	PFILE_OBJECT pFileObj = NULL;
	PDEVICE_OBJECT pKeyboardClassDeviceObject = NULL, pAttachDevObj = NULL;

	RtlInitUnicodeString(&ustrObjectName, L"\\Device\\KeyboardClass0");

	// 获取键盘设备对象的指针
	status = IoGetDeviceObjectPointer(&ustrObjectName, GENERIC_READ | GENERIC_WRITE, &pFileObj, &pKeyboardClassDeviceObject);
	if (!NT_SUCCESS(status))
	{
		DbgPrint("IoGetDeviceObjectPointer Error[0x%X]\n", status);
		return status;
	}
	// 减少引用
	ObReferenceObject(pFileObj);

	// 将当前设备附加到键盘设备的设备栈顶上, 返回的是原来设备栈上的栈顶设备, 即当前设栈上附加设备的下一个设备
	pAttachDevObj = IoAttachDeviceToDeviceStack(pDevObj, pKeyboardClassDeviceObject);
	if (NULL == pAttachDevObj)
	{
		DbgPrint("IoAttachDeviceToDeviceStack Error\n");
		return STATUS_UNSUCCESSFUL;
	}

	// 设置此设备的标志，要与附加到的设备栈上的设备标志保持一致
	pDevObj->Flags = pDevObj->Flags | DO_BUFFERED_IO | DO_POWER_PAGABLE;
	pDevObj->ActiveThreadCount = pDevObj->ActiveThreadCount & (~DO_DEVICE_INITIALIZING);


	// 保存下一设备到DeviceExtension
	((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->pAttachDevObj = pAttachDevObj;
	((PDEVICE_EXTENSION)pDevObj->DeviceExtension)->ulIrpInQuene = 0;

	DbgPrint("Leave HookKdbClass\n");
	return status;
}