解决了发包问题，供大家学习研究和大侠指点。

在网上看了资料和其他朋友代码，写了一个发送ARP包的代码。供大家学习和指点。(还是那句话，希望大家有什么研究成果就一起分享这样我们水平才能有很快的进步)由于是测试程序所以组织自定义包时就简单的用数组填数了。同时也要修改PTSendComplete。
NDIS_STATUS
MPSend(
IN NDIS_HANDLE MiniportAdapterContext,
IN PNDIS_PACKET Packet,
IN UINT Flags
)
{
PADAPT pAdapt = (PADAPT)MiniportAdapterContext;
NDIS_STATUS Status;
PNDIS_PACKET MyPacket;
PUCHAR pPacketContent;
PNDIS_BUFFER PacketBuffer;
UINT PacketLen;
UINT bufLength;
PRSVD Rsvd;
PVOID MediaSpecificInfo = NULL;
ULONG MediaSpecificInfoSize = 0;
UINT headersize;
NDIS_PHYSICAL_ADDRESS HighestAcceptableAddress;
HighestAcceptableAddress.LowPart = -1;
HighestAcceptableAddress.HighPart = -1;

DbgPrint(\"In MPsend!\\n\");


ASSERT (pAdapt->pSecondaryAdapt);
pAdapt = pAdapt->pSecondaryAdapt;
if (IsIMDeviceStateOn (pAdapt) == FALSE)
{
return NDIS_STATUS_FAILURE;
}

Status = NdisAllocateMemory(&pPacketContent,2000,0,HighestAcceptableAddress);//分配内存
if (Status != NDIS_STATUS_SUCCESS )
{
DbgPrint(\"mpsend: ndisallocatememory failed\\n\");
return NDIS_STATUS_FAILURE ;
}
if(pPacketContent == NULL)
{
DbgPrint(\"mpsend: pPacketContent == NULL\\n\");
return NDIS_STATUS_FAILURE ;
}
RtlZeroMemory(pPacketContent, 2000 );

CopyPacket2Buf(Packet,pPacketContent,&PacketLen);//拷贝包内容

pPacketContent[0] = 0xff;
pPacketContent[1] = 0xff;
pPacketContent[2] = 0xff;
pPacketContent[3] = 0xff;
pPacketContent[4] = 0xff;
pPacketContent[5] = 0xff;
pPacketContent[6] = 0x00;
pPacketContent[7] = 0x0c;
pPacketContent[8] = 0x76;
pPacketContent[9] = 0x80;
pPacketContent[10] = 0x1d;
pPacketContent[11] = 0xad;
pPacketContent[12] = 0x08;
pPacketContent[13] = 0x06;
pPacketContent[14] = 0x00;
pPacketContent[15] = 0x01;
pPacketContent[16] = 0x08;
pPacketContent[17] = 0x00;
pPacketContent[18] = 0x06;
pPacketContent[19] = 0x04;
pPacketContent[20] = 0x00;
pPacketContent[21] = 0x01;
pPacketContent[22] = 0x00;
pPacketContent[23] = 0x0c;
pPacketContent[24] = 0x76;
pPacketContent[25] = 0x80;
pPacketContent[26] = 0x1d;
pPacketContent[27] = 0xad;
pPacketContent[28] = 0xc0;
pPacketContent[29] = 0xa8;
pPacketContent[30] = 0x00;
pPacketContent[31] = 0x52;
pPacketContent[32] = 0x00;
pPacketContent[33] = 0x00;
pPacketContent[34] = 0x00;
pPacketContent[35] = 0x00;
pPacketContent[36] = 0x00;
pPacketContent[37] = 0x00;
pPacketContent[38] = 0xc0;
pPacketContent[39] = 0xa8;
pPacketContent[40] = 0x00;
pPacketContent[41] = 0x03;
pPacketContent[42] = 0x20;
pPacketContent[43] = 0x20;
pPacketContent[44] = 0x20;
pPacketContent[45] = 0x20;
pPacketContent[46] = 0x20;
pPacketContent[47] = 0x20;
pPacketContent[48] = 0x20;
pPacketContent[49] = 0x20;
pPacketContent[50] = 0x20;
pPacketContent[51] = 0x20;
pPacketContent[52] = 0x20;
pPacketContent[53] = 0x20;
pPacketContent[54] = 0x20;
pPacketContent[55] = 0x20;
pPacketContent[56] = 0x20;
pPacketContent[57] = 0x20;
pPacketContent[58] = 0x20;
pPacketContent[59] = 0x20;

NdisAllocatePacket(&Status,&MyPacket,pAdapt->SendPacketPoolHandle);//分配包，失败的话要把分配的内存释放掉
if (Status == NDIS_STATUS_SUCCESS)
{
NdisAllocateBuffer(&Status,&PacketBuffer,pAdapt->SendPacketPoolHandle,pPacketContent,PacketLen);//分配buffer
NdisChainBufferAtFront( MyPacket, PacketBuffer);

Rsvd = (PRSVD)(MyPacket->ProtocolReserved);
Rsvd->OriginalPkt = Packet;
MyPacket->Private.Head->Next=NULL;
MyPacket->Private.Tail=NULL;
NdisSetPacketFlags(MyPacket, NDIS_FLAGS_DONT_LOOPBACK);//自己定义的包


NdisSend(&Status, pAdapt->BindingHandle, MyPacket);//发送
DbgPrint(\"Ndissend send complete!\\n\");



if (Status != NDIS_STATUS_PENDING)//返回pending的话自己分配的东西要在PtSendComplete里面释放
{
NdisIMCopySendCompletePerPacketInfo (Packet, MyPacket);
NdisUnchainBufferAtFront(MyPacket ,&PacketBuffer);
NdisQueryBufferSafe(PacketBuffer,(PVOID *)&pPacketContent,&bufLength,32);
NdisFreeBuffer(PacketBuffer);
NdisFreeMemory(pPacketContent,2000,0);
NdisDprFreePacket(MyPacket);
}
}
else NdisFreeMemory(pPacketContent,2000,0); //没分配到包的时候释放内存

return(Status);
}



VOID
PtSendComplete(
IN NDIS_HANDLE ProtocolBindingContext,
IN  PNDIS_PACKET Packet,
IN  NDIS_STATUS  Status
)
{
PADAPT pAdapt =(PADAPT)ProtocolBindingContext;
PNDIS_PACKET Pkt;
P_IP_PACKET p_ip;
UINT i;
PUCHAR pPacketContent;
PNDIS_BUFFER PacketBuffer;
PRSVD Rsvd;
UINT PacketLen;
UINT bufLength;

NDIS_PHYSICAL_ADDRESS HighestAcceptableAddress;
HighestAcceptableAddress.LowPart = -1;
HighestAcceptableAddress.HighPart = -1;


pAdapt = pAdapt->pPrimaryAdapt;
Rsvd =(PRSVD)(Packet->ProtocolReserved);
Pkt = Rsvd->OriginalPkt;//自己分配包的时候已经把原来的包放在这里面了

if(Pkt) NdisIMCopySendCompletePerPacketInfo (Pkt, Packet);

NdisUnchainBufferAtFront(Packet,&PacketBuffer);
NdisQueryBufferSafe(PacketBuffer,(PVOID *)&pPacketContent,&bufLength,32);

NdisFreeBuffer(PacketBuffer);
NdisFreeMemory(pPacketContent,2000,0);
NdisDprFreePacket(Packet); //释放

if(pAdapt->MiniportHandle)
{
if(Pkt)
{
NdisMSendComplete(pAdapt->MiniportHandle, Pkt, Status);
}
}

}



再给出CopyPacket2Buf函数的原型

UINT
CopyPacket2Buf(
IN PNDIS_PACKET Packet,
OUT PUCHAR pPacketContent,
OUT UINT* pPacketSize)
{
UINT bufLength;
MDL* pNext;
UINT i;
PUCHAR pbuf;

NdisQueryPacket(Packet,NULL,NULL,NULL,pPacketSize);

NdisQueryBufferSafe(Packet->Private.Head,&pbuf,&bufLength, 32 );
NdisMoveMemory(pPacketContent,pbuf,bufLength);
i=bufLength;
pNext=Packet->Private.Head; // next 是一个mdl

for(;;)
{
// if(pNext==Packet->Private.Tail)
// break;
pNext=pNext->Next; // next 是一个mdl
if (pNext==NULL) break;
NdisQueryBufferSafe(pNext,&pbuf,&bufLength,32);
NdisMoveMemory(pPacketContent+i,pbuf,bufLength);
i+=bufLength;
}
ASSERT(*pPacketSize == i);
return *pPacketSize;
}


[编辑 -  4/5/05 by  znsoft]

顶

这样做的话，岂不是只要有来自上层的发包请求，你就把你自定义的arp包给发出去了，那应用程序还如何通信？

先顶起学习下