|
阅读：5395回复：11
搞过ndis 6 hook的大牛们现身一下帮忙指点下~
我想在win7里用hook ndis实现过滤发送的包
SendHandler SendPacketsHandler SendCompleteHandler 在xp平台我是hook 这3个的。但是在7里就不行了 首先SendHandler有，但是在发包的时候根本不会调用它，我无法通过hook SendHandler过滤发送的包 SendPacketsHandler和SendCompleteHandler是根本没有的。好奇怪啊 搞过ndis 6 hook的大牛们现身一下帮忙指点下~ 谢谢啦。。 dt _NDIS_OPEN_BLOCK 859e3008 +0x000 MacHandle : 0x05520112 +0x000 Header : _NDIS_OBJECT_HEADER +0x004 BindingHandle : 0x859e3008 +0x008 MiniportHandle : 0x85c870e0 +0x00c ProtocolHandle : 0x85b09708 +0x010 ProtocolBindingContext : 0x859e1400 +0x014 NextSendHandler : (null) +0x018 NextSendContext : (null) +0x01c MiniportAdapterContext : 0x85cc2160 +0x020 Reserved1 : 0 '' +0x021 CallingFromNdis6Protocol : 0 '' +0x022 Reserved3 : 0 '' +0x023 Reserved4 : 0 '' +0x024 NextReturnNetBufferListsHandler : (null) +0x028 Reserved5 : 0 +0x02c NextReturnNetBufferListsContext : (null) +0x030 SendHandler : 0x880f1382 ndis!ndisMSend+0 +0x030 WanSendHandler : 0x880f1382 ndis!ndisMSend+0 +0x034 TransferDataHandler : 0x880eeac0 ndis!ndisMTransferData+0 +0x038 SendCompleteHandler : (null) +0x03c TransferDataCompleteHandler : (null) +0x040 ReceiveHandler : (null) +0x044 ReceiveCompleteHandler : 0x880ba4d1 ndis!NdisFreeSpinLock+0 +0x048 WanReceiveHandler : (null) +0x04c RequestCompleteHandler : (null) +0x050 ReceivePacketHandler : (null) +0x054 SendPacketsHandler : (null) +0x058 ResetHandler : 0x880f2979 ndis!ndisMReset+0 +0x05c RequestHandler : 0x880ee374 ndis!ndisLegacyRequest+0 +0x060 OidRequestHandler : 0x880ed425 ndis!ndisMOidRequest+0 +0x064 ResetCompleteHandler : (null) +0x068 StatusHandler : 0x8824ab85 tcpip!FlStatus+0 +0x068 StatusHandlerEx : 0x8824ab85 tcpip!FlStatus+0 +0x06c StatusCompleteHandler : (null) +0x070 Flags : 0x1000000 +0x074 References : 1 +0x078 SpinLock : 0 +0x07c FilterHandle : (null) +0x080 FrameTypeArraySize : 2 +0x084 FrameTypeArray : [4] 8 +0x08c ProtocolOptions : 0 +0x090 CurrentLookahead : 0x52 +0x094 WSendHandler : (null) +0x098 WTransferDataHandler : (null) +0x09c WSendPacketsHandler : (null) +0x0a0 CancelSendPacketsHandler : 0x8e3bac8e E1G60I32!E1000CancelSendNetBufferLists+0 +0x0a4 WakeUpEnable : 0 +0x0a8 PMCurrentParameters : _NDIS_PM_PARAMETERS +0x0b8 CloseCompleteEvent : (null) +0x0bc QC : _QUEUED_CLOSE +0x0d0 AfReferences : 0 +0x0d4 NextGlobalOpen : 0x859c4008 +0x0d8 MiniportNextOpen : (null) +0x0dc ProtocolNextOpen : (null) +0x0e0 BindDeviceName : 0x85c87f30 "\DEVICE\{AE242048-1C75-4B88-80A6-3DE1B0B0B603}" +0x0e4 RootDeviceName : 0x85c67eb4 "\DEVICE\{AE242048-1C75-4B88-80A6-3DE1B0B0B603}" +0x0e8 FilterNextOpen : (null) +0x0ec PacketFilters : 0xb +0x0f0 OldPacketFilters : 0 +0x0f4 MaxMulticastAddresses : 0x80 +0x0f8 MCastAddressBuf : 0x859e3870 +0x0fc NumAddresses : 3 +0x100 OldMCastAddressBuf : 0x859e4008 +0x104 OldNumAddresses : 0 +0x0f4 FunctionalAddress : 0x80 +0x0f8 OldFunctionalAddress : 0x859e3870 +0x0fc UsingGroupAddress : 0x3 '' +0x0fd OldUsingGroupAddress : 0 '' +0x100 FARefCount : [32] 0x859e4008 +0x180 OldFARefCount : [32] 0 +0x200 RSSParametersBuf : [604] "" +0x45c NdisRSSParameters : (null) +0x460 PatternList : _SINGLE_LIST_ENTRY +0x464 WOLPatternList : _SINGLE_LIST_ENTRY +0x468 PMProtocolOffloadList : _SINGLE_LIST_ENTRY +0x46c ProtSendNetBufferListsComplete : 0x8829b124 tcpip!FlSendNetBufferListChainComplete+0 +0x470 SendCompleteNdisPacketContext : 0x859e1400 +0x474 SendCompleteNetBufferListsContext : 0x859e1400 +0x478 ReceiveNetBufferLists : 0x882b8c72 tcpip!FlReceiveNetBufferListChain+0 +0x47c ReceiveNetBufferListsContext : 0x859e1400 +0x480 SavedSendNBLHandler : (null) +0x484 SavedSendPacketsHandler : (null) +0x488 SavedCancelSendPacketsHandler : 0x8e3bac8e E1G60I32!E1000CancelSendNetBufferLists+0 +0x48c SavedSendHandler : 0x880f1382 ndis!ndisMSend+0 +0x48c SavedWanSendHandler : 0x880f1382 ndis!ndisMSend+0 +0x490 InitiateOffloadCompleteHandler : 0x8830c00a tcpip!FlInitiateOffloadComplete+0 +0x494 TerminateOffloadCompleteHandler : 0x8830c065 tcpip!FlTerminateOffloadComplete+0 +0x498 UpdateOffloadCompleteHandler : 0x8830c0ec tcpip!FlUpdateOffloadStateComplete+0 +0x49c InvalidateOffloadCompleteHandler : 0x8830c11d tcpip!FlInvalidateOffloadStateComplete+0 +0x4a0 QueryOffloadCompleteHandler : 0x8830c14e tcpip!FlQueryOffloadStateComplete+0 +0x4a4 IndicateOffloadEventHandler : (null) +0x4a8 TcpOffloadSendCompleteHandler : 0x8830c304 tcpip!FlDisconnectOffloadComplete+0 +0x4ac TcpOffloadReceiveCompleteHandler : 0x8830c339 tcpip!FlReceiveOffloadComplete+0 +0x4b0 TcpOffloadDisconnectCompleteHandler : 0x8830c304 tcpip!FlDisconnectOffloadComplete+0 +0x4b4 TcpOffloadForwardCompleteHandler : 0x8830c304 tcpip!FlDisconnectOffloadComplete+0 +0x4b8 TcpOffloadEventHandler : 0x882db10b tcpip!TcpOffloadEventHandler+0 +0x4bc TcpOffloadReceiveIndicateHandler : 0x8830c36e tcpip!FlReceiveIndicateHandler+0 +0x4c0 ProtocolMajorVersion : 6 +0x4c4 IfBlock : (null) +0x4c8 PnPStateLock : _NDIS_SPIN_LOCK +0x4d0 PnPState : 0 ( Ndis5StateUnused ) +0x4d4 TranslationState : 0 ( OpenDontXlate ) +0x4d8 OutstandingSends : 0 +0x4dc PauseEvent : _NDIS_EVENT +0x4ec Ndis5WanSendHandler : (null) +0x4f0 ProtSendCompleteHandler : (null) +0x4f4 OidRequestCompleteHandler : 0x882c0591 tcpip!FlDirectRequestComplete+0 +0x4f8 OidRequestCompleteContext : 0x859e1400 +0x4fc NumOfPauseRestartRequests : 0 +0x500 State : 0 ( NdisOpenStateRunning ) +0x504 Offload : 0x859e3e88 +0x508 StatusUnbindWorkItem : (null) +0x510 DpcStartCycle : 0 +0x518 NumberOfNetBufferLists : 1 +0x51c ReceivedAPacket : 0x859e3558 "" +0x520 DirectOidRequestCompleteHandler : 0x882c0591 tcpip!FlDirectRequestComplete+0 +0x524 DirectOidRequestHandler : 0x8808e23b ndis!ndisMDirectOidRequest+0 +0x528 DirectOidRequestCompleteContext : 0x859e1400 +0x52c ReceiveQueueList : _LIST_ENTRY [ 0x859e3534 - 0x859e3534 ] +0x534 NumReceiveQueues : 0 +0x538 SharedMemoryBlockList : _LIST_ENTRY [ 0x859e3540 - 0x859e3540 ] +0x540 AllocateSharedMemoryHandler : (null) +0x544 FreeSharedMemoryHandler : (null) +0x548 AllocateSharedMemoryContext : (null) +0x550 NextAf : 0x1ddc0000 +0x554 MiniportCoCreateVcHandler : 0xa4c9a85c +ffffffffa4c9a85c +0x558 MiniportCoRequestHandler : 0x040900ac +40900ac +0x55c CoCreateVcHandler : 0x66695049 +66695049 +0x560 CoDeleteVcHandler : (null) +0x564 CmActivateVcCompleteHandler : (null) +0x568 CmDeactivateVcCompleteHandler : (null) +0x56c CoRequestCompleteHandler : (null) +0x570 CoRequestHandler : (null) +0x574 ActiveVcHead : _LIST_ENTRY [ 0x0 - 0x0 ] +0x57c InactiveVcHead : _LIST_ENTRY [ 0x0 - 0x0 ] +0x584 PendingAfNotifications : 0 +0x588 AfNotifyCompleteEvent : (null) +0x58c MiniportCoOidRequestHandler : (null) +0x590 CoOidRequestCompleteHandler : (null) +0x594 CoOidRequestHandler : (null) |
|
最新喜欢： yeaipi...
|
|
沙发#
发布于：2010-05-15 15:45
这个OpenBlock是 物理网卡和TCPIP的
|
|
|
板凳#
发布于：2010-05-16 23:11
呵呵,的确是这样.
send 和receive都是NULL. 唯一RASPPPOE和NDISWAN例外,他们都有send handle,receive handle,唯独没有sendpackethandle,receivepackethandle. 观察一下,有值的都是FILITER的新值 ReceiveNetBufferLists : 0x85bab72a void tcpip!FlReceiveNetBufferListChain+0 |
|
|
地板#
发布于：2010-05-18 13:42
hook NdisSendNetBufferLists 搞定。。。。。。
|
|
|
地下室#
发布于：2010-05-18 14:11
回 3楼(mengxp) 的帖子
怎么搞定的？能否详细点 |
|
|
5楼#
发布于：2010-05-18 20:49
其实我们HOOK的还是FLT的函数,微软他这么说:
FilerReceiveNetBufferLists is an optional function for filter drivers. If provided, this function process receive indications made by underlying NIC or lower level filter drivers. This function can also be called as a result of loopback. If this handler is NULL, NDIS will skip calling this filter when processing a receive indication and will call the next upper filter in the stack with a non-NULL FitlerReceiveNetBufferLists handler or the procotol driver. A filter that doesn't provide a FilterReceiveNetBufferLists handler can not provided a FilterReturnNetBufferLists handler or a initiate a receive indication on its own. |
|
|
6楼#
发布于：2010-05-21 18:59
直接hook ndis导出函数NdisSendNetBufferLists
|
|
|
7楼#
发布于：2011-01-11 09:16
楼上正解。 欢迎一起讨论， QQ 273623676。 可以出售
|
|
|
|
8楼#
发布于：2011-01-11 09:18
以正常的思路把sendhandler做个Inline HOOK ,其他模块和NDIS5HOOK 一样处理。建议多看一下DNSO5HOOK 和LWF
|
|
|
|
9楼#
发布于：2011-01-12 12:39
聊天记录 ： 哈哈
NDIS6 HOOK 发包是hook NdisSendNetBufferLists 收包是HOOK _ndis_open_block PROTOCOL BLOCK里的ReceiveNetBufferLists？ |
|
|
|
10楼#
发布于：2011-01-18 16:50
。。。。
 |
|
|
11楼#
发布于：2011-01-18 17:04
引用第10楼robinh00d于2011-01-18 16:50发表的 : 哈哈robinh00d： 把你的聊天记录写上了。 因为你的思路是正确的 |
|
|
