阅读:1853回复:5
SOS请教关于IpFilterDriver的问题,立等!!!
用下面NetFlt_SetFilterFunc函数设置了过滤函数后,然后在过滤函数中用GetCurrentProcess取得的进程名为什么不对应啊????
偏移量我在DriverEntry开始调用了 ProcessNameOffset = GetProcessNameOffset(); NTSTATUS NetFlt_SetFilterFunc(PacketFilterExtensionPtr filterFunction) { NTSTATUS status = STATUS_SUCCESS, waitStatus=STATUS_SUCCESS; UNICODE_STRING filterName; PDEVICE_OBJECT ipDeviceObject=NULL; PFILE_OBJECT ipFileObject=NULL; PF_SET_EXTENSION_HOOK_INFO filterData; KEVENT event; IO_STATUS_BLOCK ioStatus; PIRP irp; dprintf("[NetLink] NetFlt_SetFilterFunc.\n"); RtlInitUnicodeString(&filterName, DD_IPFLTRDRVR_DEVICE_NAME); status = IoGetDeviceObjectPointer(&filterName,STANDARD_RIGHTS_ALL, &ipFileObject, &ipDeviceObject); if (NT_SUCCESS(status)){ filterData.ExtensionPointer = filterFunction; KeInitializeEvent(&event, NotificationEvent, FALSE); irp = IoBuildDeviceIoControlRequest(IOCTL_PF_SET_EXTENSION_POINTER, ipDeviceObject, (PVOID) &filterData, sizeof(PF_SET_EXTENSION_HOOK_INFO), NULL, 0, FALSE, &event, &ioStatus); if(irp != NULL){ status = IoCallDriver(ipDeviceObject, irp); if (status == STATUS_PENDING) { waitStatus = KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, NULL); if (waitStatus != STATUS_SUCCESS ) { } } status = ioStatus.Status; if(!NT_SUCCESS(status)){ dprintf("[NetLink] NetFlt_SetFilterFunc : IoCallDriver != STATUS_SUCCESS\n"); } }else{ status = STATUS_INSUFFICIENT_RESOURCES; dprintf("[NetLink] NetFlt_SetFilterFunc : STATUS_INSUFFICIENT_RESOURCES\n"); } if(ipFileObject != NULL){ ObDereferenceObject(ipFileObject); } ipFileObject = NULL; ipDeviceObject = NULL; }else{ dprintf("[NetLink] NetFlt_SetFilterFunc : IoGetDeviceObjectPointer != STATUS_SUCCESS\n"); } return status; } ULONG GetProcessNameOffset( void ) { #define SYSNAME "System" ULONG i; PEPROCESS peProcess = PsGetCurrentProcess(); if(!peProcess) { return 0; } for(i = 0; i < 3*PAGE_SIZE; i++) { if( strncmp(SYSNAME, (PCHAR)peProcess + i, strlen(SYSNAME)) == 0) { return i; } } return 0; } BOOLEAN GetCurrentProcess( OUT PCHAR pszName, IN ULONG uiNameLen, OUT ULONG *pID ) { PEPROCESS peCurProc; char *nameStr; if( ProcessNameOffset){ peCurProc = PsGetCurrentProcess(); nameStr = (PCHAR)peCurProc + ProcessNameOffset; if (pszName) strncpy( pszName, nameStr ,uiNameLen); if( pID) *pID = (ULONG)PsGetCurrentProcessId(); return TRUE; } return FALSE; } |
|
|
沙发#
发布于:2008-02-25 17:41
立等!!!!!!!!!!
|
|
|
板凳#
发布于:2008-02-25 17:47
???
|
|
|
地板#
发布于:2008-02-25 17:49
SOS
|
|
|
地下室#
发布于:2008-02-29 12:32
进程上下文早就切换了。
|
|
5楼#
发布于:2008-03-04 12:59
应该怎么解决
|
|
|