对 WinXP PS/2 触摸板驱动程序进行逆向工程的最佳工具？
我有一个 PS/2 触摸板，我想为其编写一个驱动程序（我只是一个网络人员，所以这对我来说是陌生的领域）。 触摸板附带一个 Windows XP 驱动程序，该驱动程序显然会发送消息以启用/禁用点击操作。 我试图找出它正在发送什么消息，但我不知道如何开始。 像“Syser Debugger”这样的软件可以工作吗？ 我想拦截发送到 PS/2 总线的传出消息。
I have a PS/2 touchpad which I would like to write a driver for (I'm just a web guy so this is unfamiliar territory to me). The touchpad comes with a Windows XP driver, which apparently sends messages to enable/disable tap-to-click. I'm trying to find out what message it is sending but I'm not sure how to start. Would software like "Syser Debugger" work? I want to intercept outgoing messages being sent to the PS/2 bus.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您想找出正在发送的“消息”，那么 IDA Pro 对您来说没有多大用处。 您应该意识到这对于大多数 Web 开发人员来说是一个非常大的进步，但您已经知道了吗？
我首先决定您是否真的需要在驱动程序级别工作，通常这是内核级别。 用户模式级别可能是您首先要查看的地方。 使用 WinSpy 等工具或其他 Windows 调试工具找出消息 由您的驱动程序软件和控制面板中的鼠标配置小程序传递。 您可以使用名为 SendMessage() 从用户模式将消息发送到应用程序。
设备驱动程序开发的第一站应该是 Windows DDK 文档 和OSR 在线。
IDA Pro won't be much use to you if you want to find out what 'messages' are being sent. You should realise that this is a very big step up for most web developers, but you already knew that?
I would start by deciding if you really need to work at the driver-level, often this is the Kernel level. The user mode level may be where you want to look first. Use a tool like WinSpy or other Windows debug tool to find out what messages are getting passed around by your driver software, and the mouse configuration applet in control panel. You can use the Windows API function called SendMessage() to send your messages to the application from user mode.
Your first stop for device driver development should be the Windows DDK docs and OSR Online.
我建议阅读此处提供的 synaptics 触摸板规格（笔记本电脑上安装的大多数触摸板都是 synaptics 的）http://www.synaptics.com/decaf/utilities/ACF126.pdf
我相信您会在第 18 页找到您正在寻找的功能。 至少你会知道会发生什么。
因此，触摸板驱动程序很可能会将来自用户模式的命令“转换”为此 PS/2 命令。
我不知道触摸板 PS/2 驱动程序的具体情况，但我看到用户模式面板与驱动程序通信的两种主要方式：
- 更新注册表中的某些键（这实际上很常见）
- 驱动程序提供了一个备用“通道”，用户模式应用程序打开该通道并向其写入特定命令
。在设置/重置该功能时，您可能需要尝试使用 sysinternals 中的进程监视器来记录注册表活动。
至于选项 2，您可能想尝试 OSR 中的 IRP 跟踪器，看看面板和驱动程序之间是否有任何特定的通信（以来回 IRP 的形式）。 在这种情况下，需要一定的内核编程知识。
Windows 内核调试器也可能有助于查看 PS/2 驱动程序是否有某些备用通道。
I suggest reading the synaptics touchpad specs (most of the touchpads installed on notebooks are synaptics') available here http://www.synaptics.com/decaf/utilities/ACF126.pdf
I believe on page 18 you'll find the feature you are looking for. At least you'll know what to expect.
So, very likely, the touchpad driver "converts" the command coming from user mode to this PS/2 command.
I don't know the specifics of the touchpad PS/2 driver but I see two major ways for the user mode panel to communicate with the driver:
- update some key in the registry (this is actually very common)
- the driver provides an alternate "channel" that the user mode app opens and writes specific commands to
You may want to try using the process monitor from sysinternals to log registry activity when setting/resetting the feature.
As for the options 2 you may want to try IRP tracker from OSR and see if there's any specific communication between the panel and the driver (in the form or IRPs going back and forth). In this case, kernel programming knowledge is somewhat required.
The windows kernel debugger may also be useful to see if the PS/2 driver has some alternate channel.
看看 IDA Pro - 交互式反汇编程序。 这是一个令人惊奇的反汇编程序。
如果您想要调试，而不仅仅是逆向工程，请尝试 中的 PEBrowse Professional Interactive SmidgeonSoft
Have a look at IDA Pro - The Interactive Disassembler. It is an amazing disassembler.
If you want to debug, not just reverse engineer, try PEBrowse Professional Interactive from SmidgeonSoft