mouclass!MouseClassReadCopyData函数分析之通过全局变量mouclass!Globals打开调试mouclass!MouDebugPrint后--重要

mouclass!MouseClassReadCopyData函数分析之通过全局变量mouclass!Globals打开调试mouclass!MouDebugPrint后

#if DBG
VOID
MouDebugPrint(
    ULONG DebugPrintLevel,
    PCCHAR DebugMessage,
    ...
    )
{
    va_list ap;

    va_start(ap, DebugMessage);

    if (DebugPrintLevel <= Globals.Debug) {

        char buffer[256];

        (VOID) vsprintf(buffer, DebugMessage, ap);

        DbgPrint(buffer);
    }

    va_end(ap);

}
#endif

第一部分：
0: kd> p
mouclass!MouseClassReadCopyData+0x20:
f74f9d46 c1e703          shl     edi,3
0: kd> p
mouclass!MouseClassReadCopyData+0x23:
f74f9d49 57              push    edi
0: kd> p
mouclass!MouseClassReadCopyData+0x24:
f74f9d4a 68cc9a4ff7      push    offset mouclass!MouseClassClose+0x26c (f74f9acc)
0: kd> p
mouclass!MouseClassReadCopyData+0x29:
f74f9d4f 6a03            push    3
0: kd> p
mouclass!MouseClassReadCopyData+0x2b:
f74f9d51 8945fc          mov     dword ptr [ebp-4],eax
0: kd> p
mouclass!MouseClassReadCopyData+0x2e:
f74f9d54 e8f3e4ffff      call    mouclass!MouDebugPrint (f74f824c)
0: kd> t
mouclass!MouDebugPrint:
f74f824c 55              push    ebp
0: kd> x mouclass!Globals
f74fd040          mouclass!Globals = struct _GLOBALS
0: kd> dx -r1 (*((mouclass!_GLOBALS *)0xf74fd040))
(*((mouclass!_GLOBALS *)0xf74fd040))                 [Type: _GLOBALS]
    [+0x000]Debug            : 0x0[Type: unsigned long]
    [+0x004] GrandMaster      : 0x0 [Type: _DEVICE_EXTENSION *]
    [+0x008] AssocClassList   : 0x0 [Type: _PORT *]
    [+0x00c] NumAssocClass    : 0x0 [Type: unsigned long]
    [+0x010] Opens            : 0 [Type: long]
    [+0x014] NumberLegacyPorts : 0x0 [Type: unsigned long]
    [+0x018] Mutex            [Type: _FAST_MUTEX]
    [+0x038] ConnectOneClassToOnePort : 0x1 [Type: unsigned long]
    [+0x03c] PortsServiced    : 0x3 [Type: unsigned long]
    [+0x040] InitExtension    [Type: _DEVICE_EXTENSION]
    [+0x150] RegistryPath     : "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mouclass" [Type: _UNICODE_STRING]
    [+0x158] BaseClassName    : "PointerClass" [Type: _UNICODE_STRING]
    [+0x160] BaseClassBuffer  [Type: unsigned short [256]]
    [+0x360] LegacyDeviceList [Typ