In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some information for this, but now I am a bit stuck.
The call hierarchy is as follows: NtUserSendInput -> xxxSendInput -> xxxMouseEventDirect.
The function looks like this:
NTSTATUS __fastcall* xxxMouseEventDirect (ULONG dx, ULONG dy, ULONG mouseData, ULONG dwFlags, ULONGLONG time, ULONGLONG extraInfo, ULONGLONG, ULONG);
I am relatively sure that I call the function parameters correctly, but there is still a blue screen when I call the function.
The bluescreen occurs like this:
mov rax, qword ptr [win32kfull!_imp_gptiCurrent (fffffbe9`4c720ec0)] mov r14, qword ptr [rax] cmp qword ptr [r14+1B0h], rcx ; <--- Bluescreen because r14 == 0
When I call NtUserSendInput, rax points to a pointer which is then used via [r14+1B0h]. When I call xxxMouseEventDirect directly, rax points to 0, causing [r14+1B0h] to cause a blue screen. I now wonder what is stored in win32kfull!_imp_gptiCurrent and why it is not there when I call xxxMouseEventDirect directly.
I am relatively new in the field of reverse engineering and would like to know how to deal with such a problem in general. Concrete tips are of course also very welcome.