鼠标过滤驱动
我想写一个鼠标的过滤驱动，我的\Driver\mouclass下有四个设置，我刚开始想测试一下，所以所有的dispatch只是简单的把irp下发，中间显示一条debug信息，我用monitor把驱动挂上去后，只检测到一条IRP_MJ_CLOSE的irp流，根本检测不到IRP_MJ_READ流，但我把他挂到keyboard上的时候可以检测到IRP_MJ_READ流，驱动程序应该没问题，难道是鼠标的数据流不是通过IRP_MJ_READ流走的？
求大神出招～～ 过滤驱动 IRP流 鼠标
[解决办法]

引用:

引用:PNP设备，AddDevice例程调过时会传递一个PhysicalDeviceObject，你只要绑定它就行了（因为你在鼠标类的UpperFilter键下添加了你的驱动，自然会传递Mouclass生成的设备）。
AddDevice例程可能不只被调用一次，你全绑定即可。你测试的时候不要对自己的设备定义设备名，（如果需……

NT式的方法，不用AddDevice，在DriverEntry中绑定设备，调用未公开的API ObReferencedObjectByName找到mouclass，直接绑定就可以了。至于你说的绑定设备2和3后系统崩溃，，，，，这要看你对IRP的处理了。
[解决办法]
extern POBJECT_TYPE *IoDriverObjectType;
NTSTATUS ObReferenceObjectByName(
IN PUNICODE_STRING ObjectName,
IN ULONG Attributes,
IN PACCESS_STATE AccessState,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_TYPE ObjectType,
IN KPROCESSOR_MODE AccessMode,
IN PVOID ParseContext,
OUT PVOID *Object
);
VOID Attach(
IN PDRIVER_OBJECT DriverObject
)
{
NTSTATUS status;
PDRIVER_OBJECT targetDriverObject;
PDEVICE_OBJECT curDeviceObject;
PDEVICE_OBJECT lowerDeviceObject;
PDEVICE_OBJECT filterDeviceObject;
UNICODE_STRING kbdClassName;
KdPrint(("Attach invoke\n"));
RtlInitUnicodeString(&kbdClassName, L"\\Driver\\mouclass");
status = ObReferenceObjectByName(&kbdClassName, OBJ_CASE_INSENSITIVE, NULL, 0,
*IoDriverObjectType, KernelMode, NULL, &targetDriverObject);
if (!NT_SUCCESS(status)) {
KdPrint(("ObReferenceObjectByName failed\n"));
KdPrint(("status %08x\n", status));
return ;
}
ObDereferenceObject(targetDriverObject);
curDeviceObject = targetDriverObject->DeviceObject;
while (curDeviceObject != NULL) {
status = IoCreateDevice(DriverObject, sizeof(FILTER_EXT), NULL, curDeviceObject->DeviceType,

curDeviceObject->Characteristics, FALSE, &filterDeviceObject);
if (!NT_SUCCESS(status)) {
KdPrint(("IoCreateDevice failed\n"));
} else {
lowerDeviceObject = IoAttachDeviceToDeviceStack(filterDeviceObject, curDeviceObject);
if (lowerDeviceObject == NULL) {
KdPrint(("IoAttachDeviceToDeviceStack failed\n"));
IoDeleteDevice(filterDeviceObject);
} else {
((PFILTER_EXT)filterDeviceObject->DeviceExtension)->LowerDeviceObject = lowerDeviceObject;
filterDeviceObject->Flags
[解决办法]
=
lowerDeviceObject->Flags & (DO_BUFFERED_IO
[解决办法]
DO_DIRECT_IO
[解决办法]
DO_POWER_PAGABLE);
filterDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
}
}
curDeviceObject = curDeviceObject->NextDevice;
}
}

不使用upperfilter,附加到mouseclass的
[解决办法]

鼠标过滤驱动http://download.csdn.net/detail/csdddn/4919992

mouclass代码http://download.csdn.net/detail/csdddn/5006432