HID键鼠协议相关
https://learn.microsoft.com/en-us/windows-hardware/drivers/hid/keyboard-and-mouse-hid-client-drivers https://learn.microsoft.com/en-us/windows-hardware/drivers/hid/hid-transports 1234567891011121314
诸葛的博客
PS_2键鼠协议相关
Windows鼠标键盘(PS2)驱动框架_ps2标准键盘驱动下载_叶之香的博客-CSDN博客.pdf [原创] 键盘过滤之i8042prt!I8042KeyboardInterruptService深层hoook-软件逆向-看雪-安全社区_安全招聘_kanxue.com.pdf XP中Inline HOOK 8042驱动实现键盘钩子的方法 键盘驱动系列—JIURL键盘驱动 5 The Advent
键鼠栈回溯过检测
正常HID键鼠调用堆栈 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253540: kd> k # Child-SP RetAddr Call Site00 fffff805`434a2f98 fffff
Android通用内核编译
https://source.android.google.cn/docs/setup/build/building-kernels AOSP源码查找对应版本： https://android.googlesource.com/kernel/common/+refs 下载源码： 123mkdir android-kernel && cd android-kernelrepo ini
安卓内核逆向
参考文章：https://bbs.kanxue.com/thread-272958.htmhttps://github.com/xiaokanghub/Android-Kenerl-boot.img 前置本次逆向的内核为运行在Xiaomi Redmi Note 11T Pro的Miui 14，内核版本为：5.10.101 提取boot.imgtip：关于A/B boot分区，咨询了网友，
Linux 内核结构体(进程内存)
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210
R0 Debug API
内核层调试API创建调试对象，初始化调试环境：NtCreateDebugObject==NtDebugActiveProcess====DbgkpSetProcessDebugObject==DbgkpMarkProcessPeb 发送模拟消息：DbgkpPostFakeProcessCreateMessagesDbg