关于IP Filter Hook Driver,46分

请问我能否用IP Filter Hook Driver截获
所有的IP,ICMP包并做协议分析，该如何编写？

看我写的这段代码：
PF_FORWARD_ACTION IpHook( unsigned char   *PacketHeader,
                          unsigned char   *Packet,
                          unsigned int    PacketLength,
                          unsigned int    RecvInterfaceIndex,
                          unsigned int    SendInterfaceIndex,
                          IPAddr          RecvLinkNextHop,
                          IPAddr          SendLinkNextHop
                          )
{
PIPHEADER pHdr = ( PIPHEADER )PacketHeader;
if( pHdr->protocol == 1 ) { // 1 是icmp ?
return PF_DROP;
}
return PF_PASS;
}

NTSTATUS EnableICMP( BOOLEAN bEnable ) {
NTSTATUS rc;
UNICODE_STRING IpfilterName;
PDEVICE_OBJECT   pDeviceObject;
PFILE_OBJECT pFileObject;
PIRP pIrp;

IO_STATUS_BLOCK ioStatus;
PF_SET_EXTENSION_HOOK_INFO hookInfo;

RtlInitUnicodeString( &IpfilterName, DD_IPFLTRDRVR_DEVICE_NAME );
rc = IoGetDeviceObjectPointer( &IpfilterName, FILE_ALL_ACCESS, &pFileObject, &pDeviceObject );
if( rc == STATUS_SUCCESS ) {
hookInfo.ExtensionPointer = IpHook;
if( bEnable ) {
pIrp = IoBuildDeviceIoControlRequest( IOCTL_PF_SET_EXTENSION_POINTER,
pDeviceObject,
NULL,
sizeof( PF_SET_EXTENSION_HOOK_INFO ),
NULL,
0,
FALSE,
NULL,
&ioStatus );

} else {
pIrp = IoBuildDeviceIoControlRequest( IOCTL_PF_SET_EXTENSION_POINTER,
pDeviceObject,
&hookInfo,
sizeof( PF_SET_EXTENSION_HOOK_INFO ),
NULL,
0,
FALSE,
NULL,
&ioStatus );
}

if( pIrp ) {
rc = IoCallDriver( pDeviceObject, pIrp );
}
}
return rc;
}

这下，大家满意了吧！

 ;) ;) ;)