1. #include <ntddk.h>
  5. PDEVICE_OBJECT myKeyBoard;
  7. typedef struct {
  8.     PDEVICE_OBJECT LowKbdDevice;
  9. }DEVICE_EXTION,*PDEVICE_EXTENTION;
  11. typedef struct _MOUSE_INPUT_DATA {
  12.     USHORT UnitId;
  13.     USHORT Flags;
  14.     union {
  15.         ULONG Buttons;
  16.         struct {
  17.             USHORT ButtonFlags;
  18.             USHORT ButtonData;
  19.         };
  20.     };
  21.     ULONG  RawButtons;
  22.     LONG   LastX;
  23.     LONG   LastY;
  24.     ULONG  ExtraInformation;
  25. } MOUSE_INPUT_DATA, * PMOUSE_INPUT_DATA;
  27. int pendingkey = 0;
  29. VOID Unload(PDRIVER_OBJECT DriverObject) {
  31.     LARGE_INTEGER interval = { 0 };
  32.     PDEVICE_OBJECT DeviceObject = DriverObject->DeviceObject;
  33.     interval.QuadPart = -10 * 1000 * 1000;
  34.     IoDetachDevice(((PDEVICE_EXTENTION)DeviceObject->DeviceExtension)->LowKbdDevice);
  35.     if (pendingkey)
  36.     {
  37.         KeDelayExecutionThread(KernelMode,FALSE,&interval);
  38.     }
  39.     IoDeleteDevice(myKeyBoard);
  40.     KdPrint(("driver unloaded\r\n"));
  42. }
  43. NTSTATUS MyattachDevice(PDRIVER_OBJECT DriverObject) {
  45.     NTSTATUS status;
  46.     UNICODE_STRING TargatDevice = RTL_CONSTANT_STRING(L"\\Device\\PointerClass0");
  47.     status = IoCreateDevice(DriverObject,sizeof(DEVICE_EXTION),NULL,FILE_DEVICE_MOUSE,0,FALSE,&myKeyBoard);
  48.     if (!NT_SUCCESS(status))
  49.     {
  50.         return status;
  52.     }
  53.     myKeyBoard->Flags |= DO_BUFFERED_IO;
  54.     myKeyBoard->Flags &= ~DO_DEVICE_INITIALIZING;
  56.     RtlZeroMemory(myKeyBoard->DeviceExtension,sizeof(DEVICE_EXTION));
  57.     status = IoAttachDevice(myKeyBoard,&TargatDevice,&((PDEVICE_EXTENTION)myKeyBoard->DeviceExtension)->LowKbdDevice);
  58.     if (!NT_SUCCESS(status))
  59.     {
  60.         IoDeleteDevice(myKeyBoard);
  61.         return status;
  62.     }
  63.     return status;
  65. }
  66. NTSTATUS ReadComplete(PDEVICE_OBJECT DeviceObject,PIRP Irp,PVOID Context){
  68.     CHAR* KeyFlag[4] = {"keydown","keyup","e0","e1"};
  71.     PMOUSE_INPUT_DATA Keys = (PMOUSE_INPUT_DATA)Irp->AssociatedIrp.SystemBuffer;
  72.     int structnum = Irp->IoStatus.Information / sizeof(MOUSE_INPUT_DATA);
  74.     if (Irp->IoStatus.Status == STATUS_SUCCESS)
  75.     {
  76.         for (int i = 0; i < structnum; i++)
  77.         {
  78.             KdPrint(("the button scan code is %x \n", Keys->ButtonFlags));
  81.         }
  83.     }
  84.     if (Irp->PendingReturned)
  85.     {
  86.         IoMarkIrpPending(Irp);
  87.     }
  88.     pendingkey--;
  89.     return Irp->IoStatus.Status;
  92. }
  95. NTSTATUS DispatchRead(IN PDEVICE_OBJECT DeviceObject,PIRP Irp) {
  98.     IoCopyCurrentIrpStackLocationToNext(Irp);
  99.     IoSetCompletionRoutine(Irp, ReadComplete, NULL, TRUE, TRUE, TRUE);
  101.     return IoCallDriver(((PDEVICE_EXTENTION)DeviceObject->DeviceExtension)->LowKbdDevice, Irp);
  103. }
  105. NTSTATUS DispatchPass(IN PDEVICE_OBJECT DeviceObject, PIRP Irp) {
  107.     IoCopyCurrentIrpStackLocationToNext(Irp);
  108.     pendingkey++;
  109.     return IoCallDriver(((PDEVICE_EXTENTION)DeviceObject->DeviceExtension)->LowKbdDevice,Irp);
  112. }
  116. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegisteryPath) {
  118.     NTSTATUS status;
  119.     DriverObject->DriverUnload = Unload;
  120.     int i;
  121.     for (int i = 0; i <=IRP_MJ_MAXIMUM_FUNCTION; i++)
  122.     {
  123.         DriverObject->MajorFunction[i] = DispatchPass;
  126.     }
  127.     DriverObject->MajorFunction[IRP_MJ_READ] = DispatchRead;
  128.     KdPrint(("driver loaded\r\n"));
  129.     status =  MyattachDevice(DriverObject);
  130.     if (!NT_SUCCESS(status))
  131.     {
  132.         KdPrint(("attach device fault\r\n"));
  133.     }else {
  135.         KdPrint(("attach device success\r\n"));
  137.     }
  141.     return STATUS_SUCCESS;
  142. }

use pointer attach to usb drive