In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some information for this, but now I am a bit stuck.

The call hierarchy is as follows: NtUserSendInput -> xxxSendInput -> xxxMouseEventDirect.

The function looks like this:

NTSTATUS __fastcall* xxxMouseEventDirect (ULONG dx, ULONG dy, ULONG mouseData, ULONG dwFlags, ULONGLONG time, ULONGLONG extraInfo, ULONGLONG, ULONG);

I am relatively sure that I call the function parameters correctly, but there is still a blue screen when I call the function.

The bluescreen occurs like this:

mov rax, qword ptr [win32kfull!_imp_gptiCurrent (fffffbe9`4c720ec0)]
mov r14, qword ptr [rax]
cmp qword ptr [r14+1B0h], rcx ; <--- Bluescreen because r14 == 0

When I call NtUserSendInput, rax points to a pointer which is then used via [r14+1B0h]. When I call xxxMouseEventDirect directly, rax points to 0, causing [r14+1B0h] to cause a blue screen. I now wonder what is stored in win32kfull!_imp_gptiCurrent and why it is not there when I call xxxMouseEventDirect directly.

I am relatively new in the field of reverse engineering and would like to know how to deal with such a problem in general. Concrete tips are of course also very welcome.

Thank you

  • mmLoadSystemImage may help.
    – Biswapriyo
    Oct 26, 2018 at 14:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.