键鼠驱动在VM虚拟机下鼠标无动作-编程技术-看雪-安全社区|安全招聘|kanxue.com

键鼠驱动在VM虚拟机下鼠标无动作

发表于: 2020-6-4 15:44 3875

键鼠驱动在VM虚拟机下鼠标无动作

taizhong

2020-6-4 15:44

3875

win10真机测试功能正常，但是放到win7虚拟机环境下，鼠标无动作
于是DbgPrint一番如下：
+++++++++++
【win7 64环境】
00000001 0.00000000 SearchKdbServiceCallBack:Couldn't get the USB driver Object
00000002 0.00001300 SearchKdbServiceCallBack:get the PS/2 driver Object
00000003 0.00002030 SearchServiceFromKdbExt:Att: 0x1cccf040
00000004 0.00002670 SearchServiceFromKdbExt:Dri Name : \Driver\vmmouse
00000005 0.00002990 SearchServiceFromKdbExt:Att: 0x19b44060
00000006 0.00003380 SearchServiceFromKdbExt:Dri Name : \Driver\mouclass
00000007 0.00003690 SearchServiceFromKdbExt:Att: 0x186173c0
00000008 0.00004090 SearchServiceFromKdbExt:Dri Name : \Driver\kbdclass
00000009 0.00005850 SearchServiceFromKdbExt:记录键盘回调,Callback 5484990
00000010 0.00006150 SearchKdbServiceCallBack:Find keyboradClassServiceCallback
00000011 0.00006800 SearchMouServiceCallBack:get the USB Mouse Object
00000012 0.00007260 SearchMouServiceCallBack:get the PS/2 Mouse Object
00000013 0.00007810 SearchServiceFromMouExt:Att: 0x1960e980
00000014 0.00008150 SearchServiceFromMouExt:Dri Name : \Driver\mouclass
00000015 0.00008420 SearchServiceFromMouExt:Find Object Device:
00000016 0.00009300 SearchServiceFromMouExt:记录鼠标回调,Callback549c858
00000017 0.00009580 SearchMouServiceCallBack:Find MouseClassServiceCallback
00000018 0.00009780 DriverEntry:驱动进入了
00000019 3.94936085 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000020 4.05849075 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000021 4.16760635 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000022 4.27679348 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000023 4.38593245 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000024 4.50158501 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000025 4.60399103 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000026 4.71313143 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000027 4.82397985 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000028 4.93247414 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000029 5.04162979 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000030 5.15080929 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000031 5.25999594 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000032 5.36916018 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000033 5.48770094 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000034 5.58758163 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000035 5.69674873 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000036 5.80590916 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000037 5.91510201 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000038 6.02425480 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000039 18.01598740 kmclassDispatchDeviceControl:鼠标移动
00000040 18.01618195 MouseInputDataStart:61c6960,MouseInputDataEnd61c6978,InputDataConsumed1
00000041 25.68784904 kmclassDispatchDeviceControl:鼠标移动
00000042 25.68817329 MouseInputDataStart:61c6960,MouseInputDataEnd61c6978,InputDataConsumed1
00000043 56.24277115 kmclassDispatchDeviceControl:鼠标移动
00000044 56.24289322 MouseInputDataStart:61c6960,MouseInputDataEnd61c6978,InputDataConsumed1
00000045 60.72814560 kmclassUnload:驱动卸载

键盘和鼠标回调地址都成功获取到，
为什么键盘有动作，鼠标无动作呢？难道是获取到的obj问题？
于是开了一台win10 虚拟机，观察
【win10 64环境】
00000001 0.00000000 SearchKdbServiceCallBack:Couldn't get the USB driver Object
00000002 0.00001250 SearchKdbServiceCallBack:get the PS/2 driver Object
00000003 0.00002110 SearchServiceFromKdbExt:Att: 0xc97f3670
00000004 0.00002640 SearchServiceFromKdbExt:Dri Name : \Driver\vmmouse
00000005 0.00002930 SearchServiceFromKdbExt:Att: 0xc97f3310
00000006 0.00003270 SearchServiceFromKdbExt:Dri Name : \Driver\mouclass
00000007 0.00003550 SearchServiceFromKdbExt:Att: 0xc97f75f0
00000008 0.00003870 SearchServiceFromKdbExt:Dri Name : \Driver\kbdclass
00000009 0.00005820 SearchServiceFromKdbExt:记录键盘回调,Callback 9a7349e0
00000010 0.00006120 SearchKdbServiceCallBack:Find keyboradClassServiceCallback
00000011 0.00006790 SearchMouServiceCallBack:get the USB Mouse Object
00000012 0.00007270 SearchMouServiceCallBack:get the PS/2 Mouse Object
00000013 0.00007810 SearchServiceFromMouExt:Att: 0xc9b90ce0
00000014 0.00008180 SearchServiceFromMouExt:Dri Name : \Driver\mouclass
00000015 0.00008430 SearchServiceFromMouExt:Find Object Device:
00000016 0.00009590 SearchServiceFromMouExt:记录鼠标回调,Callback9a7637a0
00000017 0.00009870 SearchMouServiceCallBack:Find MouseClassServiceCallback
00000018 0.00010050 DriverEntry:驱动进入了
00000019 9.90150261 kmclassDispatchDeviceControl:鼠标移动
00000020 9.90155411 MouseInputDataStart:70ba3b10,MouseInputDataEnd70ba3b28,InputDataConsumed1
00000021 15.39779186 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000022 15.50778198 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000023 15.61692524 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000024 15.72671986 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000025 15.83546734 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000026 15.96054077 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000027 16.07003021 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000028 16.17919731 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000029 16.28934097 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000030 16.39842987 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000031 16.50828171 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000032 16.61758041 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000033 16.72699738 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000034 16.83589172 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000035 16.94540215 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000036 17.05436707 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000037 17.16398048 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000038 17.27337837 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000039 17.38297081 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000040 17.49187660 MouseInputDataStart:1,MouseInputDataEnd1,InputDataConsumed1
00000041 112.50289917 kmclassDispatchDeviceControl:鼠标移动
00000042 112.50303650 MouseInputDataStart:70dcdb10,MouseInputDataEnd70dcdb28,InputDataConsumed1
00000043 127.03044128 kmclassDispatchDeviceControl:鼠标移动
00000044 127.03047943 MouseInputDataStart:71102b10,MouseInputDataEnd71102b28,InputDataConsumed1
00000045 147.11994934 kmclassUnload:驱动卸载
还是键盘有动作，鼠标无动作，，求解
另外的windbg的符号表最近是不是不能下载的了？