我写的第一个驱动的源码，TCP过滤。在网上看了很多别人公布的信息，很感谢他们。同时希望对象我一样的初学者有所帮助。

//#include \"DeviceEx.h\"
#ifndef DEVICE_EX_H
#define DEVICE_EX_H 1


#define NET_HOOK_TCP 0x2611
#define NET_HOOK_UDP 0x3018
#define NET_UNHOOK_TCP 0x2612

typedef struct
{
PDEVICE_OBJECT pDeviceObj;
int bTcp;
int bHooked;
}TCPIP_HOOK_EX,*PTCPIP_HOOK_EX;

#endif//DEVICE_EX_H


//MyFilter.C
#include <ntddk.h>
#include \"tdi.h\"
#include \"tdikrnl.h\"
#include \"DeviceEx.h\"

UNICODE_STRING WIN32_name;

PDEVICE_OBJECT g_pMyDevice=NULL;
PDEVICE_OBJECT g_pMyHookDevice=NULL;
PDRIVER_OBJECT g_pMyDriver;

NTSTATUS  TcpFilterDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)//在这个函数里截获TDI_CONNECT
{
PTCPIP_HOOK_EX pDeviceEx;
PTDI_REQUEST_KERNEL param;
PTRANSPORT_ADDRESS pTransAddr;
PTDI_ADDRESS_IP pIPAddress;
PIO_STACK_LOCATION  pCurrentIrpStack = IoGetCurrentIrpStackLocation(Irp);
PIO_STACK_LOCATION  pNextIrpStack    = IoGetNextIrpStackLocation(Irp);
pDeviceEx=(PTCPIP_HOOK_EX)DeviceObject->DeviceExtension;

param = (PTDI_REQUEST_KERNEL)(&pCurrentIrpStack->Parameters);
if(!pDeviceEx->bTcp)
{

Irp->IoStatus.Information = 0;
Irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_SUCCESS;
}
if(pCurrentIrpStack->MajorFunction == IRP_MJ_INTERNAL_DEVICE_CONTROL)
{
switch(pCurrentIrpStack->MinorFunction)
{
case TDI_CONNECT:

pTransAddr = (param->RequestConnectionInformation)->RemoteAddress;
if(pTransAddr->Address[0].AddressType == TDI_ADDRESS_TYPE_IP)
{
pIPAddress = pTransAddr->Address[0].Address;

if(pIPAddress->sin_port==8080)//如果是8080就让连接不成功，达到过滤目的
{
Irp->IoStatus.Information = 0;
Irp->IoStatus.Status = STATUS_WRONG_VOLUME;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_WRONG_VOLUME;
}
}

break;
default:
break;
}
}
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(pDeviceEx->pDeviceObj,Irp);
}

NTSTATUS HookTcp(IN PDRIVER_OBJECT DriverObject,int bHook/*附着或取消附着*/)//附着设备\"\\\\Device\\\\Tcp\"
{
UNICODE_STRING Tcp_Name;
PFILE_OBJECT pFileObj;
PDEVICE_OBJECT pDeviceObj;
PTCPIP_HOOK_EX pDeviceEx;
PDEVICE_OBJECT pTargetDevice;
PDRIVER_OBJECT pNetDriver;
int i;
if(bHook)//附着
{
if(g_pMyHookDevice)
return STATUS_SUCCESS;

//找到TCP设备
RtlInitUnicodeString(&Tcp_Name,L\"\\\\Device\\\\Tcp\");
if(NT_SUCCESS(IoGetDeviceObjectPointer(&Tcp_Name,FILE_ALL_ACCESS,&pFileObj,&pDeviceObj)))
{
if(NT_SUCCESS(IoCreateDevice(DriverObject,
sizeof(TCPIP_HOOK_EX),
NULL, //设备名，由于应用不调用，可以没有名字
FILE_DEVICE_UNKNOWN,//pDeviceObj->DeviceType,//设备类型与被附着设备相同
0,
FALSE,
&g_pMyHookDevice)))
{
pDeviceEx=(PTCPIP_HOOK_EX)g_pMyHookDevice->DeviceExtension;
pDeviceEx->pDeviceObj=NULL;
pDeviceEx->bTcp=1;
pDeviceEx->bHooked=0;
//附加到原有设备之上
pTargetDevice=IoAttachDeviceToDeviceStack(g_pMyHookDevice,pDeviceObj);
if(!pTargetDevice)
{
IoDeleteDevice(g_pMyHookDevice);
return STATUS_SUCCESS;//!!!!!!!!!!!!!
}
pDeviceEx->pDeviceObj=pTargetDevice;
g_pMyHookDevice->DeviceType=pTargetDevice->DeviceType;
g_pMyHookDevice->Characteristics=pTargetDevice->Characteristics;
g_pMyHookDevice->Flags|=(pTargetDevice->Flags&(DO_DIRECT_IO|DO_BUFFERED_IO));
pNetDriver=pTargetDevice->DriverObject;
for(  i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++ )
{
if(pNetDriver->MajorFunction != NULL&& DriverObject->MajorFunction==NULL)
{
DriverObject->MajorFunction=TcpFilterDispatch;
}
}
ObDereferenceObject(pFileObj);
return STATUS_SUCCESS;
}
ObDereferenceObject(pFileObj);
}
g_pMyHookDevice=NULL;
}
else//取消附着
{
if(g_pMyHookDevice)
{
pDeviceEx=(PTCPIP_HOOK_EX)g_pMyHookDevice->DeviceExtension;
IoDetachDevice( pDeviceEx->pDeviceObj);
            IoDeleteDevice( g_pMyHookDevice );
g_pMyHookDevice=NULL;
}
return STATUS_SUCCESS;
}
return STATUS_UNSUCCESSFUL;
}

NTSTATUS vtwoOpen(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
NTSTATUS status;
PTCPIP_HOOK_EX pDeviceEx;
pDeviceEx=(PTCPIP_HOOK_EX )DeviceObject->DeviceExtension;//DeviceExtension
if(!pDeviceEx->bTcp)//若是用于和应用通信的设备
{
Irp->IoStatus.Status=status=STATUS_SUCCESS;
Irp->IoStatus.Information=0;
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return status;

}
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(pDeviceEx->pDeviceObj,Irp);
}



NTSTATUS vtwoClose(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
NTSTATUS status;
PTCPIP_HOOK_EX pDeviceEx;
pDeviceEx=(PTCPIP_HOOK_EX )DeviceObject->DeviceExtension;

if(!pDeviceEx->bTcp)//若是用于和应用通信的设备
{
Irp->IoStatus.Status=status=STATUS_SUCCESS;
Irp->IoStatus.Information=0;
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return status;
}
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(pDeviceEx->pDeviceObj,Irp);


}

VOID  vtwoUnload(IN PDRIVER_OBJECT DriverObject )
{
HookTcp(DriverObject,0);
IoDeleteDevice(g_pMyDevice);
IoDeleteSymbolicLink(&WIN32_name);
}
//驱动入口
NTSTATUS  DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath )
{
NTSTATUS status;
    UNICODE_STRING NT_name;
PTCPIP_HOOK_EX pDeviceEx;
int i;
g_pMyDriver=DriverObject;
DriverObject->DriverUnload = vtwoUnload;


DriverObject->MajorFunction[IRP_MJ_CREATE] = vtwoOpen;
   DriverObject->MajorFunction[IRP_MJ_CLOSE]  = vtwoClose;
    //DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]  = vtwoIoControl;
    //DbgPrint(\"************My Entry is call!*********-> hgj <-\");
  
    RtlInitUnicodeString(&NT_name,L\"\\\\Device\\\\HGJ_Tcp\");
    RtlInitUnicodeString(&WIN32_name,L\"\\\\DosDevices\\\\HGJ_Tcp\");
//创建一个设备，此备用与和应用程序通信
status = IoCreateDevice( DriverObject,
sizeof(TCPIP_HOOK_EX), //设备扩展
&NT_name, //设备名，可选
FILE_DEVICE_UNKNOWN, //设备类型
0, //设备特征，如无可为0
FALSE, //排斥
&g_pMyDevice);

    if (NT_SUCCESS(status))
{

g_pMyDevice->Flags |= DO_BUFFERED_IO;//由操作系统负责内存管理
pDeviceEx=(PTCPIP_HOOK_EX)g_pMyDevice->DeviceExtension;
pDeviceEx->pDeviceObj=NULL;
pDeviceEx->bTcp=0;
pDeviceEx->bHooked=0;

if (NT_SUCCESS(IoCreateSymbolicLink( &WIN32_name, &NT_name )))
{
if(NT_SUCCESS(HookTcp(DriverObject,1)))
{
return STATUS_SUCCESS;
}
}
IoDeleteDevice(g_pMyDevice);
}
    return STATUS_UNSUCCESSFUL;

}




//SOURCES
TARGETNAME=MyFilter
TARGETTYPE=DRIVER
TARGETPATH=SYS
TARGETLIBS=$(DDK_LIB_PATH)\\tdi.lib
INCLUDES=D:\\NTDDK\\INC
SOURCES=MyFilter.C

大哥你要早点发，可省俺多少事啊？嘿嘿

不错不错，虽然我不是搞HOOK NDIS的，不过这种有成就就一起共享我觉得真的很好，大家都这样的话那我们的水平就能进步很快啦，鼓励共享

如何修改注册表并且加载驱动？？

支持！！！

大哥救命的东西呀

如果我没有看错的话, 这好象是一个 TDI filter driver.

sourceforge上有一个完整的sample

Simple TDI-Based Open Source Personal Firewall for Windows NT4/2000/XP/2003

http://sourceforge.net/projects/tdifw/

楼上的，你给的那个网址好象找不到你说的东西

能不能提供的详细点！

谢谢拉！

下面是详细的下载地址：
http://sourceforge.net/project/showfiles.php?group_id=90762&package_id=95509&release_id=317436