阅读:1364回复:1
求助!!!分析的数据包ip地址错误
各位:我是一个新手,在作驱动时从底层得到的数据报地址和我要分析的值不一致。
我的PtReceive函数如下: PtReceive( IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_HANDLE MacReceiveContext, IN PVOID HeaderBuffer, // 包头 IN UINT HeaderBufferSize, // 包头大小,以太网环境下为14 IN PVOID LookAheadBuffer, // 前视缓冲 IN UINT LookAheadBufferSize, // IN UINT PacketSize // 数据包总大小(不包括包头) ) { PADAPT OutAdapt, pAdapt =(PADAPT)ProtocolBindingContext; PNDIS_PACKET MyPacket, Packet, MyPacket1; NDIS_STATUS Status = NDIS_STATUS_SUCCESS; PNDIS_BUFFER pPacketBuffer, pBakBuffer; PUCHAR pPacketContent, pBakContent; UINT PacketLen; UINT OffsetSize; UINT BytesTransferred; PRSVD Rsvd = NULL; PVOID MediaSpecificInfo = NULL; ULONG MediaSpecificSize= 0; DBGPRINT((\"In PtReceive\\n\")); if(!pAdapt->MiniportHandle) { Status = NDIS_STATUS_FAILURE; } else do { // We should not be getting Receives on a Secondary, this is just specific to our LBFO driver if(pAdapt->isSecondary) { DbgPrint(\"PASSTHRU GETTING RECIEVES ON SECONDARY\\n\"); ASSERT(0); } if(FALSE){} else if(PacketSize <= LookAheadBufferSize) // 如果 LookAheadBuffer 中包含了全部数据 { // 分配内存 Status = NdisAllocateMemory(&pPacketContent, BUFFER_SIZE, 0, HighestAcceptableMax); if(Status != NDIS_STATUS_SUCCESS) { DbgPrint(\"PTReceive:NdisAllocateMemory Failed\\n\"); return(NDIS_STATUS_NOT_ACCEPTED); } if(pPacketContent == NULL) { DbgPrint(\"PTReceive:pPacketContent==NULL\\n\"); return(NDIS_STATUS_NOT_ACCEPTED); } // 将包头和 LookAheadBuffer 复制到新分配的内存中 NdisZeroMemory(pPacketContent, BUFFER_SIZE); NdisMoveMemory(pPacketContent, HeaderBuffer, HeaderBufferSize); NdisMoveMemory(pPacketContent+ HeaderBufferSize, LookAheadBuffer, LookAheadBufferSize); PacketLen = PacketSize+HeaderBufferSize; if(Monitor_flag) { if(Check_Packet((char*)pPacketContent)) { return NDIS_STATUS_NOT_ACCEPTED; } } else {} // 在包池中分配包描述符 NdisDprAllocatePacket(&Status, &MyPacket, pAdapt->RecvPacketPoolHandle); if(Status == NDIS_STATUS_SUCCESS) { // 在缓冲池中分配缓冲描述符,将包描述符与缓冲描述符关联。 NdisAllocateBuffer(&Status, &pPacketBuffer, pAdapt->RecvBufferPoolHandle, pPacketContent, PacketLen); NdisChainBufferAtFront(MyPacket, pPacketBuffer); MyPacket->Private.Head->Next = NULL; MyPacket->Private.Tail = NULL; Rsvd=(PRSVD)(MyPacket->MiniportReserved); Rsvd->OriginalPkt = NULL; NDIS_SET_PACKET_HEADER_SIZE(MyPacket, HeaderBufferSize); // 向上层协议驱动指示数据包,防真网卡行为。 NdisMIndicateReceivePacket(pAdapt->MiniportHandle, &MyPacket, 1); if(NDIS_GET_PACKET_STATUS(MyPacket) != NDIS_STATUS_PENDING) { DBGPRINT((\"In PtReceive And Free Memory\\n\")); NdisFreeBuffer(pPacketBuffer); NdisFreeMemory(pPacketContent, BUFFER_SIZE, 0); NdisDprFreePacket(MyPacket); } } break; } else // 如果 LookAheadBuffer 中没有包含全部数据 { // 分配内存 pPacketContent,存放要传输的除 LookAheadBuffer 之外的数据。 Status = NdisAllocateMemory(&pPacketContent, BUFFER_SIZE, 0, HighestAcceptableMax); if(Status != NDIS_STATUS_SUCCESS) { DbgPrint(\"PtReceive:NdisAllocateMemory Failed.\\n\"); return(NDIS_STATUS_NOT_ACCEPTED); } if(pPacketContent==NULL) { DbgPrint(\"PTReceive:pPacketContent==NULL\\n\"); return(NDIS_STATUS_NOT_ACCEPTED); } NdisZeroMemory(pPacketContent,BUFFER_SIZE); // 分配包描述符 MyPacket。 NdisDprAllocatePacket(&Status, &MyPacket, pAdapt->RecvPacketPoolHandle); // 分配内存 pBakContent,存放HeaderBuffer + LookAheadBuffer。 Status = NdisAllocateMemory(&pBakContent, BUFFER_SIZE, 0, HighestAcceptableMax); if(Status != NDIS_STATUS_SUCCESS) { DbgPrint(\"PtReceive:NdisAllocateMemory Failed.\\n\"); return(NDIS_STATUS_NOT_ACCEPTED); } if(pBakContent == NULL) { DbgPrint(\"PTReceive:pPacketContent==NULL\\n\"); return(NDIS_STATUS_NOT_ACCEPTED); } // 将 HeaderBuffer + LookAheadBuffer 复制到 pBakContent 指向的内存中。 NdisZeroMemory(pBakContent, BUFFER_SIZE); NdisMoveMemory(pBakContent, HeaderBuffer, HeaderBufferSize); NdisMoveMemory(pBakContent+HeaderBufferSize, LookAheadBuffer, LookAheadBufferSize); PacketLen = HeaderBufferSize + PacketSize; // 为要传输的除 LookAheadBuffer 之外的数据分配缓冲描述符(该缓冲描述符与 pPacketContent 指向的内存关联)。 NdisAllocateBuffer(&Status, &pPacketBuffer, pAdapt->RecvBufferPoolHandle, pPacketContent, PacketSize-LookAheadBufferSize); // 关联包描述符 MyPacket 与缓冲描述符 pPacketBuffer。 NdisChainBufferAtFront(MyPacket, pPacketBuffer); MyPacket->Private.Head->Next=NULL; MyPacket->Private.Tail=NULL; OffsetSize = HeaderBufferSize + LookAheadBufferSize; // 分配包描述符 MyPacket1。 NdisDprAllocatePacket(&Status, &MyPacket1, pAdapt->RecvPacketPoolHandle); // 分配缓冲描述符 pBakBuffer,与 pBakContent 指向的内存关联。 NdisAllocateBuffer(&Status, &pBakBuffer, pAdapt->RecvBufferPoolHandle, pBakContent, OffsetSize); // 关联包描述符 MyPacket1 与缓冲描述符 pBakBuffer。 NdisChainBufferAtFront(MyPacket1, pBakBuffer); Rsvd = (PRSVD)(MyPacket->MiniportReserved); Rsvd->OriginalPkt = (PNDIS_PACKET)MyPacket1; NDIS_SET_PACKET_HEADER_SIZE(MyPacket, HeaderBufferSize); // 取得 LookAheadBuffer 之后的数据 NdisTransferData(&Status, pAdapt->BindingHandle, MacReceiveContext, LookAheadBufferSize, // 数据起始地址 PacketSize-LookAheadBufferSize, // 字节数 MyPacket, &BytesTransferred); if(Status != NDIS_STATUS_PENDING) { PtTransferDataComplete((NDIS_HANDLE)pAdapt, MyPacket, Status, BytesTransferred); } break; } pAdapt->IndicateRcvComplete = TRUE; } while(FALSE); return Status; } 我想把得到的pPacketContent上传到应用程序,可得到的数据包很怪异,分析的数据包不正确! 急求正确解决方法! |
|
|
沙发#
发布于:2004-06-03 10:15
怎么个奇怪法,贴出来看看。
|
|