Mouse-Synthesise synthesises HIDs at a higher layer than any driver-stack fingerprints.
To synthesize HIDs we call SynthesizeMouseInput injecting input at the final layer before the application receives it.
HID synthetization is better than HID injection because it enters the stack after every tracked layer so there's nothing to hook or monitor.
Mouse-Synthesis resolves SynthesizeMouseInput from win32kbase.sys and calls it from kernel after constructing a MOUSE_INPUT_DATA packet.
Windows compositor also calls SynthesizeMouseInput internally for touch, RDP, and accessibility input.
We craft the packet to match real physical HIDs by setting unit_id to 1 so it matches mouhid.sys default assignment.
Mouse-Synthesis only uses absolute movement ( packet_absolute ) normalizing all coordinates.
We haven't implemented delta movement ( packet_relative ) because games like Fortnite process raw input and will reject relative packets.
The interface supports mouse button clicks and mouse movement using absolute or relative movements.
Public HID injection methods that hook or call through MouClass.sys are detected because every packet they generate passes through the class driver stack.
Meaning anti-cheats like EAC can install a filter driver, monitor the device object or trace MOUSE_INPUT_DATA arrays through ETW providers.
Mouse-Synthesis bypasses all of these integrity checks because it injects directly into the win32k raw input queue where the driver stack ends.
Mouse-Synthesis runs entirely from user-mode using our syscall hook inside ntoskrnl.exe to call kernel functions.
Since we're usermode we need to allocate live-kernel memory instead of stack allocated buffers in a kernel mode driver.
And because of the syscall hook we need to allocate a shellcode call stub to read the arguments and then forward the call since SynthesizeMouseInput is inside win32kbase.sys.
If you are reimplementing this inside a kernel driver, neither allocation for call stub or buffers are necessary.
if ( !m_mouse_input_data ) {
m_mouse_input_data =
kernel::allocate_pages( sizeof( mouse_input_data_t ) )
.value_or( 0 );
}
m_stub_page = mapper::allocate_large_page(
obf( "ntoskrnl.exe" ),
0x1000 );If you are looking for the missing dependencies like PDB, kernel function call, e.g.. frameworks click here for them.