mouhid!MouHid_ReadComplete调用mouclass!MouseClassServiceCallback函数存储了7条数据
第一部分：
0: kd> g
MouHid: ReadComplete: Enter.Breakpoint 3 hit
eax=898db2f8 ebx=00000000 ecx=00000041 edx=00000002 esi=894dc7e0 edi=898db210
eip=f74fa596 esp=f789ed40 ebp=f789ed74 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
mouclass!MouseClassServiceCallback:
f74fa596 55 push ebp
0: kd> kc
#
00 mouclass!MouseClassServiceCallback
01 mouhid!MouHid_ReadComplete
02 nt!IopfCompleteRequest
03 HIDCLASS!HidpDistributeInterruptReport
04 HIDCLASS!HidpInterruptReadComplete
05 nt!IopfCompleteRequest
06 USBPORT!USBPORT_CompleteTransfer
07 USBPORT!USBPORT_DoneTransfer
08 USBPORT!USBPORT_FlushDoneTransferList
09 USBPORT!USBPORT_DpcWorker
0a USBPORT!USBPORT_IsrDpcWorker
0b USBPORT!USBPORT_IsrDpc
0c nt!KiRetireDpcList
0d nt!KiDispatchInterrupt
WARNING: Frame IP not in any known module. Following frames may be wrong.
0e 0x0
0: kd> g
MOUCLASS-MouseClassServiceCallback: enter
MOUCLASS-MouseClassServiceCallback: bytes remaining after move to SystemBuffer 0x18
MOUCLASS-MouseClassServiceCallback: unused bytes in class queue 0x960, remaining bytes in port queue 0x18
MOUCLASS-MouseClassServiceCallback: total number of bytes to move to class queue 0x18
MOUCLASS-MouseClassServiceCallback: number of bytes to end of class buffer 0x510
MOUCLASS-MouseClassServiceCallback: number of bytes in first move to class 0x18
MOUCLASS-MouseClassServiceCallback: move bytes from 0x898db2f8 to 0x89853600
MOUCLASS-MouseClassServiceCallback: changed InputCount to 1 entries in the class queue
MOUCLASS-MouseClassServiceCallback: DataIn 0x89853618, DataOut 0x89853600
MOUCLASS-MouseClassServiceCallback: Input data items consumed = 1
MOUCLASS-MouseClassServiceCallback: exit
MouHid: calling StartRead directly
MouHid: Start Read: Ente
MouHid: read is pending
Breakpoint 5 hit
eax=00000000 ebx=00000000 ecx=8940bc01 edx=f789ede1 esi=8940bcd8 edi=8940be47
eip=f7668b84 esp=f789ed78 ebp=f789eda4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouhid!MouHid_ReadComplete:
f7668b84 55 push ebp
0: kd> g
MouHid: ReadComplete: Enter.Breakpoint 3 hit
eax=898db2f8 ebx=00000000 ecx=00000041 edx=00000002 esi=894dc7e0 edi=898db210
eip=f74fa596 esp=f789ed40 ebp=f789ed74 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
mouclass!MouseClassServiceCallback:
f74fa596 55 push ebp
0: kd> g
MOUCLASS-MouseClassServiceCallback: enter
MOUCLASS-MouseClassServiceCallback: bytes remaining after move to SystemBuffer 0x18
MOUCLASS-MouseClassServiceCallback: unused bytes in class queue 0x948, remaining bytes in port queue 0x18
MOUCLASS-MouseClassServiceCallback: total number of bytes to move to class queue 0x18
MOUCLASS-MouseClassServiceCallback: number of bytes to end of class buffer 0x4f8
MOUCLASS-MouseClassServiceCallback: number of bytes in first move to class 0x18
MOUCLASS-MouseClassServiceCallback: move bytes from 0x898db2f8 to 0x89853618
MOUCLASS-MouseClassServiceCallback: changed InputCount to 2 entries in the class queue
MOUCLASS-MouseClassServiceCallback: DataIn 0x89853630, DataOut 0x89853600
MOUCLASS-MouseClassServiceCallback: Input data items consumed = 1
MOUCLASS-MouseClassServiceCallback: exit
MouHid: calling StartRead directly
MouHid: Start Read: Ente
MouHid: read is pending
Breakpoint 5 hit
eax=00000000 ebx=00000000 ecx=8940bc01 edx=f789ede1 esi=8940bcd8 edi=8940be47
eip=f7668b84 esp=f789ed78 ebp=f789eda4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouhid!MouHid_ReadComplete:
f7668b84 55 push ebp
0: kd> g
MouHid: ReadComplete: Enter.Breakpoint 3 hit
eax=898db2f8 ebx=00000000 ecx=00000041 edx=00000002 esi=894dc7e0 edi=898db210
eip=f74fa596 esp=f789ed40 ebp=f789ed74 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
mouclass!MouseClassServiceCallback:
f74fa596 55 push ebp
0: kd> g
MOUCLASS-MouseClassServiceCallback: enter
MOUCLASS-MouseClassServiceCallback: bytes remaining after move to SystemBuffer 0x18
MOUCLASS-MouseClassServiceCallback: unused bytes in class queue 0x930, remaining bytes in port queue 0x18
MOUCLASS-MouseClassServiceCallback: total number of bytes to move to class queue 0x18
MOUCLASS-MouseClassServiceCallback: number of bytes to end of class buffer 0x4e0
MOUCLASS-MouseClassServiceCallback: number of bytes in first move to class 0x18
MOUCLASS-MouseClassServiceCallback: move bytes from 0x898db2f8 to 0x89853630
MOUCLASS-MouseClassServiceCallback: changed InputCount to 3 entries in the class queue
MOUCLASS-MouseClassServiceCallback: DataIn 0x89853648, DataOut 0x89853600
MOUCLASS-MouseClassServiceCallback: Input data items consumed = 1
MOUCLASS-MouseClassServiceCallback: exit
MouHid: calling StartRead directly
MouHid: Start Read: Ente
MouHid: read is pending
Breakpoint 5 hit
eax=00000000 ebx=00000000 ecx=8940bc01 edx=f789ede1 esi=8940bcd8 edi=8940be47
eip=f7668b84 esp=f789ed78 ebp=f789eda4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouhid!MouHid_ReadComplete:
f7668b84 55 push ebp
0: kd> g
MouHid: ReadComplete: Enter.Breakpoint 3 hit
eax=898db2f8 ebx=00000000 ecx=00000041 edx=00000002 esi=894dc7e0 edi=898db210
eip=f74fa596 esp=f789ed40 ebp=f789ed74 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
mouclass!MouseClassServiceCallback:
f74fa596 55 push ebp
0: kd> g
MOUCLASS-MouseClassServiceCallback: enter
MOUCLASS-MouseClassServiceCallback: bytes remaining after move to SystemBuffer 0x18
MOUCLASS-MouseClassServiceCallback: unused bytes in class queue 0x918, remaining bytes in port queue 0x18
MOUCLASS-MouseClassServiceCallback: total number of bytes to move to class queue 0x18
MOUCLASS-MouseClassServiceCallback: number of bytes to end of class buffer 0x4c8
MOUCLASS-MouseClassServiceCallback: number of bytes in first move to class 0x18
MOUCLASS-MouseClassServiceCallback: move bytes from 0x898db2f8 to 0x89853648
MOUCLASS-MouseClassServiceCallback: changed InputCount to 4 entries in the class queue
MOUCLASS-MouseClassServiceCallback: DataIn 0x89853660, DataOut 0x89853600
MOUCLASS-MouseClassServiceCallback: Input data items consumed = 1
MOUCLASS-MouseClassServiceCallback: exit
MouHid: calling StartRead directly
MouHid: Start Read: Ente
MouHid: read is pending
Breakpoint 5 hit
eax=00000000 ebx=00000000 ecx=8940bc01 edx=f789ede1 esi=8940bcd8 edi=8940be47
eip=f7668b84 esp=f789ed78 ebp=f789eda4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouhid!MouHid_ReadComplete:
f7668b84 55 push ebp
0: kd> g
MouHid: ReadComplete: Enter.Breakpoint 3 hit
eax=898db2f8 ebx=00000000 ecx=00000041 edx=00000002 esi=894dc7e0 edi=898db210
eip=f74fa596 esp=f789ed40 ebp=f789ed74 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
mouclass!MouseClassServiceCallback:
f74fa596 55 push ebp
0: kd> g
MOUCLASS-MouseClassServiceCallback: enter
MOUCLASS-MouseClassServiceCallback: bytes remaining after move to SystemBuffer 0x18
MOUCLASS-MouseClassServiceCallback: unused bytes in class queue 0x900, remaining bytes in port queue 0x18
MOUCLASS-MouseClassServiceCallback: total number of bytes to move to class queue 0x18
MOUCLASS-MouseClassServiceCallback: number of bytes to end of class buffer 0x4b0
MOUCLASS-MouseClassServiceCallback: number of bytes in first move to class 0x18
MOUCLASS-MouseClassServiceCallback: move bytes from 0x898db2f8 to 0x89853660
MOUCLASS-MouseClassServiceCallback: changed InputCount to 5 entries in the class queue
MOUCLASS-MouseClassServiceCallback: DataIn 0x89853678, DataOut 0x89853600
MOUCLASS-MouseClassServiceCallback: Input data items consumed = 1
MOUCLASS-MouseClassServiceCallback: exit
MouHid: calling StartRead directly
MouHid: Start Read: Ente
MouHid: read is pending
Breakpoint 5 hit
eax=00000000 ebx=00000000 ecx=8940bc01 edx=f789ede1 esi=8940bcd8 edi=8940be47
eip=f7668b84 esp=f789ed78 ebp=f789eda4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouhid!MouHid_ReadComplete:
f7668b84 55 push ebp
0: kd> g
MouHid: ReadComplete: Enter.Breakpoint 3 hit
eax=898db2f8 ebx=00000000 ecx=00000041 edx=00000002 esi=894dc7e0 edi=898db210
eip=f74fa596 esp=f789ed40 ebp=f789ed74 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
mouclass!MouseClassServiceCallback:
f74fa596 55 push ebp
0: kd> g
MOUCLASS-MouseClassServiceCallback: enter
MOUCLASS-MouseClassServiceCallback: bytes remaining after move to SystemBuffer 0x18
MOUCLASS-MouseClassServiceCallback: unused bytes in class queue 0x8e8, remaining bytes in port queue 0x18
MOUCLASS-MouseClassServiceCallback: total number of bytes to move to class queue 0x18
MOUCLASS-MouseClassServiceCallback: number of bytes to end of class buffer 0x498
MOUCLASS-MouseClassServiceCallback: number of bytes in first move to class 0x18
MOUCLASS-MouseClassServiceCallback: move bytes from 0x898db2f8 to 0x89853678
MOUCLASS-MouseClassServiceCallback: changed InputCount to 6 entries in the class queue
MOUCLASS-MouseClassServiceCallback: DataIn 0x89853690, DataOut 0x89853600
MOUCLASS-MouseClassServiceCallback: Input data items consumed = 1
MOUCLASS-MouseClassServiceCallback: exit
MouHid: calling StartRead directly
MouHid: Start Read: Ente
MouHid: read is pending
Breakpoint 5 hit
eax=00000000 ebx=00000000 ecx=8940bc01 edx=f789ede1 esi=8940bcd8 edi=8940be47
eip=f7668b84 esp=f789ed78 ebp=f789eda4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouhid!MouHid_ReadComplete:
f7668b84 55 push ebp
0: kd> g
MouHid: ReadComplete: Enter.Breakpoint 3 hit
eax=898db2f8 ebx=00000000 ecx=00000041 edx=00000002 esi=894dc7e0 edi=898db210
eip=f74fa596 esp=f789ed40 ebp=f789ed74 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
mouclass!MouseClassServiceCallback:
f74fa596 55 push ebp
0: kd> g
MOUCLASS-MouseClassServiceCallback: enter
MOUCLASS-MouseClassServiceCallback: bytes remaining after move to SystemBuffer 0x18
MOUCLASS-MouseClassServiceCallback: unused bytes in class queue 0x8d0, remaining bytes in port queue 0x18
MOUCLASS-MouseClassServiceCallback: total number of bytes to move to class queue 0x18
MOUCLASS-MouseClassServiceCallback: number of bytes to end of class buffer 0x480
MOUCLASS-MouseClassServiceCallback: number of bytes in first move to class 0x18
MOUCLASS-MouseClassServiceCallback: move bytes from 0x898db2f8 to 0x89853690
MOUCLASS-MouseClassServiceCallback: changed InputCount to 7 entries in the class queue
MOUCLASS-MouseClassServiceCallback: DataIn 0x898536a8, DataOut 0x89853600
MOUCLASS-MouseClassServiceCallback: Input data items consumed = 1
MOUCLASS-MouseClassServiceCallback: exit
MouHid: calling StartRead directly
MouHid: Start Read: Ente
MouHid: read is pending
第二部分：
0: kd> dx -r1 ((mouclass!_DEVICE_EXTENSION *)0x894060f0)
((mouclass!_DEVICE_EXTENSION *)0x894060f0) : 0x894060f0 [Type: _DEVICE_EXTENSION *]
[+0x000] Self : 0x89406038 : Device for "\Driver\Mouclass" [Type: _DEVICE_OBJECT *]
[+0x004] TrueClassDevice : 0x89406038 : Device for "\Driver\Mouclass" [Type: _DEVICE_OBJECT *]
[+0x008] TopPort : 0x898db158 : Device for "\Driver\mouhid" [Type: _DEVICE_OBJECT *]
[+0x00c] PDO : 0x89536cc0 : Device for "\Driver\hidusb" [Type: _DEVICE_OBJECT *]
[+0x010] RemoveLock [Type: _IO_REMOVE_LOCK]
[+0x068] PnP : 0x1 [Type: unsigned char]
[+0x069] Started : 0x1 [Type: unsigned char]
[+0x06a] OkayToLogOverflow : 0x1 [Type: unsigned char]
[+0x06c] WaitWakeSpinLock : 0x0 [Type: unsigned long]
[+0x070] TrustedSubsystemCount : 0x1 [Type: unsigned long]
[+0x074] InputCount : 0x7 [Type: unsigned long]
[+0x078] SymbolicLinkName : "\??\HID#Vid_0e0f&Pid_0003&MI_00#8&28f6544d&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" [Type: _UNICODE_STRING]
[+0x080] InputData : 0x898531b0 [Type: _MOUSE_INPUT_DATA *]
[+0x084] DataIn : 0x898536a8 [Type: _MOUSE_INPUT_DATA *]
[+0x088] DataOut : 0x89853600 [Type: _MOUSE_INPUT_DATA *]
[+0x08c] MouseAttributes [Type: _MOUSE_ATTRIBUTES]
[+0x098] SpinLock : 0x0 [Type: unsigned long]
[+0x09c] ReadQueue [Type: _LIST_ENTRY]
[+0x0a4] SequenceNumber : 0x1c [Type: unsigned long]
[+0x0a8] DeviceState : PowerDeviceD0 (1) [Type: _DEVICE_POWER_STATE]
[+0x0ac] SystemState : PowerSystemWorking (1) [Type: _SYSTEM_POWER_STATE]
[+0x0b0] UnitId : 0x0 [Type: unsigned long]
[+0x0b4] WmiLibInfo [Type: _WMILIB_CONTEXT]
[+0x0d4] SystemToDeviceState [Type: _DEVICE_POWER_STATE [5]]
[+0x0e8] MinDeviceWakeState : PowerDeviceD0 (1) [Type: _DEVICE_POWER_STATE]
[+0x0ec] MinSystemWakeState : PowerSystemSleeping1 (2) [Type: _SYSTEM_POWER_STATE]
[+0x0f0] WaitWakeIrp : 0x0 [Type: _IRP *]
[+0x0f4] ExtraWaitWakeIrp : 0x0 [Type: _IRP *]
[+0x0f8] TargetNotifyHandle : 0x0 [Type: void *]
[+0x0fc] Link [Type: _LIST_ENTRY]
[+0x104] File : 0x0 [Type: _FILE_OBJECT *]
[+0x108] Enabled : 0x0 [Type: unsigned char]
[+0x109] WaitWakeEnabled : 0x0 [Type: unsigned char]
[+0x10a] SurpriseRemoved : 0x0 [Type: unsigned char]
0: kd> dx -r1 ((mouclass!_MOUSE_INPUT_DATA *)0x89853600)
((mouclass!_MOUSE_INPUT_DATA *)0x89853600) : 0x89853600 [Type: _MOUSE_INPUT_DATA *]
[+0x000] UnitId : 0x1 [Type: unsigned short]
[+0x002] Flags : 0x1 [Type: unsigned short]
[+0x004] Buttons : 0x0 [Type: unsigned long]
[+0x004] ButtonFlags : 0x0 [Type: unsigned short]
[+0x006] ButtonData : 0x0 [Type: unsigned short]
[+0x008] RawButtons : 0x0 [Type: unsigned long]
[+0x00c] LastX : 6942 [Type: long]
[+0x010] LastY : 43900 [Type: long]
[+0x014] ExtraInformation : 0x0 [Type: unsigned long]
0: kd> dt mouclass!_MOUSE_INPUT_DATA 0x89853600
+0x000 UnitId : 1
+0x002 Flags : 1
+0x004 Buttons : 0
+0x004 ButtonFlags : 0
+0x006 ButtonData : 0
+0x008 RawButtons : 0
+0x00c LastX : 0n6942
+0x010 LastY : 0n43900
+0x014 ExtraInformation : 0
0: kd> dt mouclass!_MOUSE_INPUT_DATA 0x89853600+18
+0x000 UnitId : 1
+0x002 Flags : 1
+0x004 Buttons : 0
+0x004 ButtonFlags : 0
+0x006 ButtonData : 0
+0x008 RawButtons : 0
+0x00c LastX : 0n6942
+0x010 LastY : 0n43900
+0x014 ExtraInformation : 0
0: kd> dt mouclass!_MOUSE_INPUT_DATA 0x89853600+18*2
+0x000 UnitId : 1
+0x002 Flags : 1
+0x004 Buttons : 0
+0x004 ButtonFlags : 0
+0x006 ButtonData : 0
+0x008 RawButtons : 0
+0x00c LastX : 0n6750
+0x010 LastY : 0n44070
+0x014 ExtraInformation : 0
0: kd> dt mouclass!_MOUSE_INPUT_DATA 0x89853600+18*3
+0x000 UnitId : 1
+0x002 Flags : 1
+0x004 Buttons : 0
+0x004 ButtonFlags : 0
+0x006 ButtonData : 0
+0x008 RawButtons : 0
+0x00c LastX : 0n6686
+0x010 LastY : 0n44242
+0x014 ExtraInformation : 0
0: kd> dt mouclass!_MOUSE_INPUT_DATA 0x89853600+18*4
+0x000 UnitId : 1
+0x002 Flags : 1
+0x004 Buttons : 0
+0x004 ButtonFlags : 0
+0x006 ButtonData : 0
+0x008 RawButtons : 0
+0x00c LastX : 0n6366
+0x010 LastY : 0n44498
+0x014 ExtraInformation : 0
0: kd> dt mouclass!_MOUSE_INPUT_DATA 0x89853600+18*5
+0x000 UnitId : 1
+0x002 Flags : 1
+0x004 Buttons : 0
+0x004 ButtonFlags : 0
+0x006 ButtonData : 0
+0x008 RawButtons : 0
+0x00c LastX : 0n6110
+0x010 LastY : 0n44668
+0x014 ExtraInformation : 0
0: kd> dt mouclass!_MOUSE_INPUT_DATA 0x89853600+18*6
+0x000 UnitId : 1
+0x002 Flags : 1
+0x004 Buttons : 0
+0x004 ButtonFlags : 0
+0x006 ButtonData : 0
+0x008 RawButtons : 0
+0x00c LastX : 0n30
+0x010 LastY : 0n48166
+0x014 ExtraInformation : 0
第三部分：
0: kd> g
Breakpoint 4 hit
eax=00000000 ebx=bfa02600 ecx=00000000 edx=00000000 esi=e162bd40 edi=bfa01624
eip=bf8fc06b esp=bab9a8dc ebp=bab9a8f0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
win32k!StartDeviceRead:
bf8fc06b 55 push ebp
0: kd> g
MOUCLASS-MouseClassRead: enter
Breakpoint 0 hit
eax=8940618c ebx=894060f0 ecx=89406188 edx=00000000 esi=896dbe20 edi=896dbe20
eip=f74f9d26 esp=bab9a6f0 ebp=bab9a70c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
mouclass!MouseClassReadCopyData:
f74f9d26 55 push ebp
0: kd> g
MOUCLASS-MouseClassCopyReadData: queue size 0xa8, read length 0xf0
MOUCLASS-MouseClassCopyReadData: bytes to end of queue 0x510
MOUCLASS-MouseClassCopyReadData: number of bytes in first move 0xa8
MOUCLASS-MouseClassCopyReadData: move bytes from 0x89853600 to 0x894dee70
MOUCLASS-MouseClassCopyReadData: Okay to log overflow
MOUCLASS-MouseClassCopyReadData: new DataIn 0x898536a8, DataOut 0x898536a8
MOUCLASS-MouseClassCopyReadData: new InputCount 0
Breakpoint 1 hit
eax=00000000 ebx=bfa02600 ecx=00000000 edx=80bf6160 esi=e162bd40 edi=bfa01624
eip=bf8e9149 esp=bab9a8dc ebp=bab9a8f0 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206
win32k!ProcessMouseInput:
bf8e9149 55 push ebp
0: kd> ?a8/18
Evaluate expression: 7 = 00000007
0: kd> dv
pMouseInfo = 0xe162bd40
ptLastMove = {x=-1081175735 y=8}
0: kd> dx -r1 ((win32k!tagDEVICEINFO *)0xe162bd40)
((win32k!tagDEVICEINFO *)0xe162bd40) : 0xe162bd40 [Type: tagDEVICEINFO *]
[+0x000] head [Type: _HEAD]
[+0x008] pNext : 0xe1414eb8 [Type: tagDEVICEINFO *]
[+0x00c] type : 0x0 [Type: unsigned char]
[+0x00d] bFlags : 0x2 [Type: unsigned char]
[+0x00e] usActions : 0x0 [Type: unsigned short]
[+0x010] nRetryRead : 0x0 [Type: unsigned char]
[+0x014] ustrName : "\??\HID#Vid_0e0f&Pid_0003&MI_00#8&28f6544d&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" [Type: _UNICODE_STRING]
[+0x01c] handle : 0x21c [Type: void *]
[+0x020] NotificationEntry : 0xe13e70c0 [Type: void *]
[+0x024] pkeHidChangeCompleted : 0x897fb9c0 [Type: _KEVENT *]
[+0x028] iosb [Type: _IO_STATUS_BLOCK]
[+0x030] ReadStatus : 0 [Type: long]
[+0x034] OpenerProcess : 0x1b0 [Type: void *]
[+0x038] OpenStatus : 0 [Type: long]
[+0x03c] AttrStatus : 0 [Type: long]
[+0x040] timeStartRead : 0xffcb22f0 [Type: unsigned long]
[+0x044] timeEndRead : 0xffcb22fc [Type: unsigned long]
[+0x048] nReadsOutstanding : 0 [Type: int]
[+0x04c] mouse [Type: tagMOUSE_DEVICE_INFO]
[+0x04c] keyboard [Type: tagKEYBOARD_DEVICE_INFO]
[+0x04c] hid [Type: tagHID_DEVICE_INFO]
0: kd> dx -r1 (*((win32k!tagMOUSE_DEVICE_INFO *)0xe162bd8c))
(*((win32k!tagMOUSE_DEVICE_INFO *)0xe162bd8c)) [Type: tagMOUSE_DEVICE_INFO]
[+0x000] Attr [Type: _MOUSE_ATTRIBUTES]
[+0x00c] Data [Type: _MOUSE_INPUT_DATA [10]]
0: kd> dx -r1 (*((win32k!_MOUSE_INPUT_DATA (*)[10])0xe162bd98))
(*((win32k!_MOUSE_INPUT_DATA (*)[10])0xe162bd98)) [Type: _MOUSE_INPUT_DATA [10]]
[0] [Type: _MOUSE_INPUT_DATA]
[1] [Type: _MOUSE_INPUT_DATA]
[2] [Type: _MOUSE_INPUT_DATA]
[3] [Type: _MOUSE_INPUT_DATA]
[4] [Type: _MOUSE_INPUT_DATA]
[5] [Type: _MOUSE_INPUT_DATA]
[6] [Type: _MOUSE_INPUT_DATA]
[7] [Type: _MOUSE_INPUT_DATA]
[8] [Type: _MOUSE_INPUT_DATA]
[9] [Type: _MOUSE_INPUT_DATA]
0: kd> dx -r1 (*((win32k!_MOUSE_INPUT_DATA *)0xe162bd98))
(*((win32k!_MOUSE_INPUT_DATA *)0xe162bd98)) [Type: _MOUSE_INPUT_DATA]
[+0x000] UnitId : 0x1 [Type: unsigned short]
[+0x002] Flags : 0x1 [Type: unsigned short]
[+0x004] Buttons : 0x0 [Type: unsigned long]
[+0x004] ButtonFlags : 0x0 [Type: unsigned short]
[+0x006] ButtonData : 0x0 [Type: unsigned short]
[+0x008] RawButtons : 0x0 [Type: unsigned long]
[+0x00c] LastX : 6942 [Type: long]
[+0x010] LastY : 43900 [Type: long]
[+0x014] ExtraInformation : 0x0 [Type: unsigned long]
0: kd> dx -r1 (*((win32k!_MOUSE_INPUT_DATA *)0xe162bdb0))
(*((win32k!_MOUSE_INPUT_DATA *)0xe162bdb0)) [Type: _MOUSE_INPUT_DATA]
[+0x000] UnitId : 0x1 [Type: unsigned short]
[+0x002] Flags : 0x1 [Type: unsigned short]
[+0x004] Buttons : 0x0 [Type: unsigned long]
[+0x004] ButtonFlags : 0x0 [Type: unsigned short]
[+0x006] ButtonData : 0x0 [Type: unsigned short]
[+0x008] RawButtons : 0x0 [Type: unsigned long]
[+0x00c] LastX : 6942 [Type: long]
[+0x010] LastY : 43900 [Type: long]
[+0x014] ExtraInformation : 0x0 [Type: unsigned long]
0: kd> dx -r1 (*((win32k!_MOUSE_INPUT_DATA *)0xe162bdc8))
(*((win32k!_MOUSE_INPUT_DATA *)0xe162bdc8)) [Type: _MOUSE_INPUT_DATA]
[+0x000] UnitId : 0x1 [Type: unsigned short]
[+0x002] Flags : 0x1 [Type: unsigned short]
[+0x004] Buttons : 0x0 [Type: unsigned long]
[+0x004] ButtonFlags : 0x0 [Type: unsigned short]
[+0x006] ButtonData : 0x0 [Type: unsigned short]
[+0x008] RawButtons : 0x0 [Type: unsigned long]
[+0x00c] LastX : 6750 [Type: long]
[+0x010] LastY : 44070 [Type: long]
[+0x014] ExtraInformation : 0x0 [Type: unsigned long]
0: kd> g
Breakpoint 2 hit
eax=00000000 ebx=ffcb22fb ecx=bc510013 edx=00000100 esi=e162be28 edi=00000000
eip=bf8e7542 esp=bab9a898 ebp=bab9a8d8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
win32k!QueueMouseEvent:
bf8e7542 55 push ebp
0: kd> dv
ButtonFlags = 0
ButtonData = 0
ExtraInfo = 0
ptMouse = {x=0 y=564}
time = 0n-3464453
hDevice = 0x00010049
pmei = 0xe162be28
bInjected = 0n0
bWakeRIT = 0n1
