阅读:1484回复:0
关于TDI监听端口的一个疑问?
写了个TDI Filter,测试的时候用flashfxp下载文件,用的是port模式,检测到flashfxp首先会创建一个address_object,然后会紧跟着创建四个connection endpoint进行关联,正常情况下创建一个endpoint不就可以了吗,怎么会连续创建这么多呢,而且还都关联到同一个address object上?
下面是windbg输出的调试信息: TDIF - Type: 1 - PID: 1332 - IRP_MJ_CREATE - TransportAddress: 0x81618b20 - AddrCount:1 - 0.0.0.0:0 TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xb TDI_SET_EVENT_HANDLER - TDI_EVENT_ERROR TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xb TDI_SET_EVENT_HANDLER - TDI_EVENT_DISCONNECT TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xb TDI_SET_EVENT_HANDLER - TDI_EVENT_RECEIVE TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xb TDI_SET_EVENT_HANDLER - TDI_EVENT_RECEIVE_EXPEDITED TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xb TDI_SET_EVENT_HANDLER - TDI_EVENT_CHAINED_RECEIVE TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xc TDI_QUERY_INFORMATION - QRY_OBJ: 0x81618b20 - TDI_QUERY_ADDRESS_INFO TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xc TDI_QUERY_INFORMATION - QRY_OBJ: 0x81618b20 - TDI_QUERY_ADDRESS_INFO TDIF - Type: 1 - PID: 1332 - IRP_MJ_CREATE - ConnectionContext: 0x816d5f28 - AddrCount:0 - NotNULL TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0x1 TDI_ASSOCIATE_ADDRESS - Associate(Con_Addr) - 0x816d5f28_0x81618b20 TDIF - Type: 1 - PID: 1332 - IRP_MJ_CREATE - ConnectionContext: 0x815e9c08 - AddrCount:0 - NotNULL TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0x1 TDI_ASSOCIATE_ADDRESS - Associate(Con_Addr) - 0x815e9c08_0x81618b20 TDIF - Type: 1 - PID: 1332 - IRP_MJ_CREATE - ConnectionContext: 0x8159eab8 - AddrCount:0 - NotNULL TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0x1 TDI_ASSOCIATE_ADDRESS - Associate(Con_Addr) - 0x8159eab8_0x81618b20 TDIF - Type: 1 - PID: 1332 - IRP_MJ_CREATE - ConnectionContext: 0x816e1028 - AddrCount:0 - NotNULL TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0x1 TDI_ASSOCIATE_ADDRESS - Associate(Con_Addr) - 0x816e1028_0x81618b20 TDIF - Type: 1 - PID: 1332 - IRP_MJ_CREATE - ConnectionContext: 0x813f8028 - AddrCount:0 - NotNULL TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0x1 TDI_ASSOCIATE_ADDRESS - Associate(Con_Addr) - 0x813f8028_0x81618b20 TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xb TDI_SET_EVENT_HANDLER - TDI_EVENT_CONNECT TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xc TDI_QUERY_INFORMATION - QRY_OBJ: 0x81618b20 - TDI_QUERY_ADDRESS_INFO TDIF - Type: 1 - PID: 996 - Internal Device IO - 0xc TDI_QUERY_INFORMATION - QRY_OBJ: 0x81618b20 - TDI_QUERY_ADDRESS_INFO TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xc TDI_QUERY_INFORMATION - QRY_OBJ: 0x8160e430 - TDI_QUERY_ADDRESS_INFO TDIF - Type: 1 - PID: 1332 - Internal Device IO - 0xc TDI_QUERY_INFORMATION - QRY_OBJ: 0x81618b20 - TDI_QUERY_ADDRESS_INFO |
|