????????
?????????????????д????????????????????????????????????????????????????????????? ????μ???????????????????? ???????????USBKey?????尲????????????
??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????в??SSL?????? ???????????????????????;?????? WEB????????????????????в???????????????????????? ???????????????? ????????????????????? ???????????????
????????????д????????????У??й?????????(601398?????)???й??????С??й?????????(601939?????)???й?????(601988?????);??????У?????????(600036?????);????????????????????????????????????????????? ?????????????????????????????????????????WEB??????????????????????????й? ???????б??????????????? WEB???????????衣??????????????е?????????? ????????U??????????????????“???”???????????????????????????????????????????/?????Σ??????
????????????????????? ??????????????ü?????????????????????? ??
???????????ж????? ???????????????????????????????? ??
????1??????????????????????У??й????????С????????С??????????????
????????????????????? ????? ?????/????????????????IE??COM????????????? ?????????????????????????ò????????????????
??????????ü??????????????? ????????????????? ??????????????????????????? ????????IDT(?ж?????????)???????????????????????Dispatch???????Inlinehook???IRP???????????????????????????????i8042prt.sys??
?????????????д?????????????????????? ??????????????????δ??????????????? ?????Щ????????????????????????????????????????????????????????????????? ??????????
?????????????????????????? ????豸?????????????Kbdclass?μ??豸?????????е?IRP(????????????)?????????????????????????????????????е?????????????????????????IRP???????л?ü????scancode???????????????????????ü??????????????????????????????????￡?
????NTSTATUS HookKeyboard(IN PDRIVER_T pDrivert)
????PDEVICE_T pKeyboardDevicet;
????NTSTATUS status=IoCreateDevice(pDrivert??sizeof(DEVICE_EXTENSION)??
????NULL??FILE_DEVICE_KEYBOARD?? 0?? true?? &pKeyboardDevicet);
????pKeyboardDevicet->Flags =pKeyboardDevicet->Flags(DO_BUFFERED_IO DO_POWER_PAGABLE);
????pKeyboardDevicet->Flags=pKeyboardDevicet->Flags&~DO_DEVICE_INITIALIZING;
????RtlZeroMemory(pKeyboardDevicet->DeviceExtension??sizeof(DEVICE_EXTENSION));
????PDEVICE_EXTENSIONpKeyboardDeviceExtension=(PDEVICE_EXTENSION)pKeyboardDevicet->DeviceExtension;
????CCHAR ntNameBuffer[64] = "\Device\KeyboardClass0";
????STRING ntNameString;
????UNICODE_STRING uKeyboardDeviceName;
????RtlInitAnsiString( &ntNameString?? ntNameBuffer );
????RtlAnsiStringToUnicodeString(&uKeyboardDeviceName??&ntNameString?? TRUE );
????IoAttachDevice(pKeyboardDevicet??&uKeyboardDeviceName??&pKeyboardDeviceExtension->pKeyboardDevice);
????RtlFreeUnicodeString(&uKeyboardDeviceName);
????return STATUS_SUCCESS;
????????????????е??????????????????????????????????????????????????????????????????????????????????????????? ?????????????С??????????????Ч????????????????????????????????????????????1???????????????????????????2????????????????ASP/PHP???????????????????????
????2???????????????????????У??й????????С??й????С??й???????
?????????????????? ?????????????????? ????????????????????? ?????????????????????? ????????????IE??COM?????????
?????????й????????У????IE??COM???????????????????????????????????????????? ????? ????????????????й???????WEB??????????????????????????????????????????????????????????????????????????????????? ???й??????е???????????????????????????????????????????????????????????IE??COM????????????α??????????? ??? ???(???????????? ????????)??????????????????????????????е??????????????й?????????????????????????????????? ???????????????? Ч??????????3??(????????????? ????????????????????HookTextOutW/A???????????????? ???????)
????????
???????????????е?????????????????????????????????????????????????????????????????????? ???????У??????????????USBKey(????U??)???????? ????????????????