|
楼主 |
发表于 2021-4-27 09:49:26
|
显示全部楼层
附加了,还是没效果,应该是调用NTUSER函数不对,或者声明不对吧
typedef
NTSTATUS
(NTAPI* NTUSERSENDINPUT)(
_In_ ULONG cInputs, // number of input in the array
_In_reads_(cInputs) LPINPUT pInputs, // array of inputs
_In_ int cbSize); // sizeof(INPUT)
//驱动入口
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
NTSTATUS Status;
NTUSERSENDINPUT NtUserSendInput = NULL;
INPUT input = { 0 };
MOUSEINPUT KeyBoardInput = { 0 };
input.type = 0;
input.mi.dx = 100;
input.mi.dy = 200;
input.mi.mouseData = 0;
input.mi.dwFlags = 1; //MOUSEEVENTF_ABSOLUTE 代表决对位置 MOUSEEVENTF_MOVE代表移动事件
input.mi.time = 0;
input.mi.dwExtraInfo = 0;
PEPROCESS pEProcess = NULL;
KAPC_STATE ApcState = { 0 };
Status = PsLookupProcessByProcessId(1448, &pEProcess);//gui进程
KeStackAttachProcess(pEProcess, &ApcState);
NtUserSendInput = (NTUSERSENDINPUT)0xFFFFF960000EFB74; //用ARK取到 地址
Status = NtUserSendInput(1, &input, sizeof(INPUT));
DbgPrint("STATUS:%X\n",Status);
//取到数据解除附加进程
KeUnstackDetachProcess(&ApcState);
ObDereferenceObject(pEProcess); |
|