1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
| AsmCopMouseCall PROC
sub rsp, 1000h
mov rdi, rsp ; DriverExtension
lea rax, LABEL_CALLRET
push rax
;-----------------------------
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 58h
;-----------------------------
mov rax, [MouseClassServiceCallback]
mov [rdi+0E8h], rax ;
mov [rdi+0E0h], rcx ; DeviceObject
mov rbx, rdi ; Save rdi
lea rdi, [rdi+160h] ; InputDataStart
mov rsi, rdx ; pInputData
mov ecx, 18h
rep movs byte ptr [rdi], byte ptr [rsi] ; rep movsb
mov rdi, rbx ; Restore rdi
mov [rbp-014h], r9 ; &Consumed
mov rax, cr8
mov byte ptr [rbp+50h], al ; bypass IoAllocateErrorLogEntry
mov rax, 0
mov [rbp+58h], rax ; bypass jump up
jmp [MouHid_CopAddress]
;-----------------------------
;add rsp, 58h
;pop r15
;pop r14
;pop r13
;pop r12
;pop rdi
;pop rsi
;pop rbx
;pop rbp
;ret
LABEL_CALLRET:
add rsp, 1000h
ret
AsmCopMouseCall ENDP
|