阅读:2304回复:2
在ReceivePacketHandler中修改数据包
我做的NDIS HOOK ,在NDISReceivePacketHandler中已经可以拦截到数据;我想在里面修改数据,但是没有成功,所以,我想先第一步把数据复制出来,然后创建一个自己的PACK,然后调用真实的ReceivePacketHandler函数发送给上层;但是这样还是上层收不到数据,请各位高手帮忙看一下原因;谢谢
NDIS_STATUS NDISReceivePacketHandler( IN NDIS_HANDLE BindingHandle, IN PNDIS_PACKET Packet) { //获取接收的值在变量:pPacketBuf RtlCopyMemory(pReplaceBuf,pPacketBuf,nPacketSize); NdisAllocatePacket(&ndisStatus, &pNewPacket, g_PktSendPool); //生成一个新包 if(NDIS_STATUS_SUCCESS == ndisStatus) { NdisAllocateBuffer(&ndisStatus, &pNewBuffer, g_BufSendPool, pReplaceBuf, nPacketSize); //为新包分配内存 if(NDIS_STATUS_SUCCESS == ndisStatus) { //把内存连接到包上 NdisChainBufferAtFront(pNewPacket, pNewBuffer); NdisSetPacketFlags(pNewPacket, NDIS_FLAGS_DONT_LOOPBACK); pNewPacket->Private.Head->Next=NULL; pNewPacket->Private.Tail=NULL; NdisMIndicateReceivePacket(BindingHandle,&pNewPacket,1); ndisStatus = Node->RealReceivePacketHandler(BindingHandle, pNewPacket); if (ndisStatus != IRP_PAGING_IO) { ExFreePool(pReplaceBuf); FreePacket(pNewPacket); } ExFreePool(pPacketBuf); return ndisStatus; } } } 请各位指点。谢谢 |
|
沙发#
发布于:2012-09-27 14:04
请大家指点一下;补充如下:
谢谢; pPacketBuf 为得到原始的包的内容;nPacketSize为原始包的长度 我想用自己的包代替原始的包,并不对内容做任何修改;但是结果上层程序好像不认这个包;直接扔掉了(通过发送的包的ACK值推测的,也有可能我根本没有提交到上层成功); 我已经确认过,pPacketBuf的值是完全正确的,构造好的包pNewPacket,我尝试取里面的内容,也是正确的; 我怀疑是不是我使用方法根本就有错误,请各位高手指点; pReplaceBuf = ExAllocatePoolWithTag(NonPagedPool, 1600, NDIS_TAG); if (pReplaceBuf == NULL) { DbgPrint("分配内存失败1\r\n"); break; } RtlCopyMemory(pReplaceBuf,pPacketBuf,nPacketSize); NdisAllocatePacket(&ndisStatus, &pNewPacket, g_PktSendPool); //生成一个新包 if(NDIS_STATUS_SUCCESS == ndisStatus) { NdisAllocateBuffer(&ndisStatus, &pNewBuffer, g_BufSendPool, pReplaceBuf, nPacketSize); //为新包分配内存 if(NDIS_STATUS_SUCCESS == ndisStatus) { //把内存连接到包上 NdisChainBufferAtFront(pNewPacket, pNewBuffer); ndisStatus = Node->RealReceivePacketHandler(BindingHandle, pNewPacket); if (ndisStatus != IRP_PAGING_IO) { ExFreePool(pReplaceBuf); FreePacket(pNewPacket); } ExFreePool(pPacketBuf); return ndisStatus; } } |
|
板凳#
发布于:2012-10-13 21:17
ndissend 试试那。 ndishook中,ndissend肯定可以
|
|
|