请教高手：写ndis中间层驱动如何入门？多谢！！！

本人是一名大四学生，因毕业设计需要写ndis中间层驱动程序。但是有关这方面的资料非常的少。希望各位高手推荐一些这方面的资料和入门的方法，使小弟少走一些弯路！
多谢了！！！！！！！！

论坛有好多人做这个东西，有用吗？

送你一个我写的代码。获得发送数据。。解释头协议。。。 NDIS层驱动！！  稍微修改下可以获得接收数据和过滤 ;)

多谢了！！！！！ :) :) :)

你好象忘记一见事情。。给分哟 ;)

请你详细解释一下你修改得那些地方好吗
好像你修改了MPSend，如果我修改PtReceive是不是效果一样呢？
我想通过一种方式，在应用程序控制驱动的过虑设置，我该怎么做呢？（我基础比较差，可是周围了解NDIS的人根本没有，麻烦大家了）

我下了你的程序，正在学习中，我不是楼主怎么给分。我刚来，不知道怎么给分，怎么个给法

我初学NDIS
你给的程序怎么没法编译呢？
我用的是DDK for 2000 cheched build environment
以下是错误信息，请各位高人指点一二
E:\\work\\spassthru>build
BUILD: Object root set to: ==> objchk
BUILD: /i switch ignored
BUILD: Compile and Link for i386
BUILD: Loading C:\\NTDDK\\build.dat...
BUILD: Computing Include file dependencies:
BUILD: Examining e:\\work\\spassthru directory for files to compile.
BUILD: e:\\work\\spassthru\\passthru.rc: c:\\ntddk\\inc\\winbase.h: cannot find includ
e file <macwin32.h>
BUILD: e:\\work\\spassthru\\passthru.rc: c:\\ntddk\\inc\\wingdi.h: cannot find include
 file <macwin32.h>
BUILD: e:\\work\\spassthru\\passthru.rc: c:\\ntddk\\inc\\winuser.h: cannot find includ
e file <macwin32.h>
BUILD: e:\\work\\spassthru\\passthru.rc: c:\\ntddk\\inc\\winnls.h: cannot find include
 file <macwin32.h>
BUILD: e:\\work\\spassthru\\passthru.rc: c:\\ntddk\\inc\\winreg.h: cannot find include
 file <macwin32.h>
BUILD: e:\\work\\spassthru\\passthru.rc: c:\\ntddk\\inc\\mmsystem.h: cannot find inclu
de file <macwin32.h>
    e:\\work\\spassthru - 4 source files (3,205 lines)
BUILD: Saving C:\\NTDDK\\build.dat...
BUILD: Compiling e:\\work\\spassthru directory
Compiling Precompiled Header - precomp.h for i386
Compiling - passthru.c for i386
passthru.c(151) : error C4013: \'KeInitializeEvent\' undefined; assuming extern re
turning int
passthru.c(151) : error C2065: \'NotificationEvent\' : undeclared identifier
Compiling - protocol.c for i386
Compiling - miniport.c for i386
miniport.c(470) : error C4013: \'KeSetEvent\' undefined; assuming extern returning
 int
miniport.c(472) : error C4013: \'PsCreateSystemThread\' undefined; assuming extern
 returning int
miniport.c(481) : error C4013: \'KeWaitForSingleObject\' undefined; assuming exter
n returning int
miniport.c(483) : error C2065: \'Executive\' : undeclared identifier
miniport.c(643) : error C4020: \'strstr\' : too many actual parameters
miniport.c(647) : error C2143: syntax error : missing \';\' before \'type\'
miniport.c(672) : error C2275: \'NDIS_STATUS\' : illegal use of this type as an ex
pression
c:\\ntddk\\inc\\ddk\\ndis.h(4455) : error see declaration of \'NDIS_STATUS\'
miniport.c(672) : error C2146: syntax error : missing \';\' before identifier \'Sta
tus\'
miniport.c(672) : error C2065: \'Status\' : undeclared identifier
miniport.c(673) : error C2275: \'UINT\' : illegal use of this type as an expressio
n
c:\\ntddk\\inc\\ddk\\ndis.h(4431) : error see declaration of \'UINT\'
miniport.c(673) : error C2146: syntax error : missing \';\' before identifier \'i\'
miniport.c(673) : error C2065: \'i\' : undeclared identifier
miniport.c(674) : error C2275: \'PVOID\' : illegal use of this type as an expressi
on
c:\\ntddk\\inc\\ddk\\ndis.h(244) : error see declaration of \'PVOID\'
miniport.c(674) : error C2146: syntax error : missing \';\' before identifier \'Med
iaSpecificInfo\'
miniport.c(674) : error C2065: \'MediaSpecificInfo\' : undeclared identifier
miniport.c(674) : error C4047: \'=\' : \'int \' differs in levels of indirection fro
m \'void *\'
miniport.c(675) : error C2275: \'UINT\' : illegal use of this type as an expressio
n
c:\\ntddk\\inc\\ddk\\ndis.h(4431) : error see declaration of \'UINT\'
miniport.c(675) : error C2146: syntax error : missing \';\' before identifier \'Med
iaSpecificInfoSize\'
miniport.c(675) : error C2065: \'MediaSpecificInfoSize\' : undeclared identifier
miniport.c(681) : error C2065: \'pAdapt\' : undeclared identifier
miniport.c(681) : error C2223: left of \'->pSecondaryAdapt\' must point to struct/
union
miniport.c(683) : error C2065: \'NumberOfPackets\' : undeclared identifier
miniport.c(688) : error C2065: \'PacketArray\' : undeclared identifier
miniport.c(688) : error C2109: subscript requires array or pointer type
miniport.c(688) : error C4047: \'=\' : \'struct _NDIS_PACKET *\' differs in levels o
f indirection from \'int \'
miniport.c(690) : error C2223: left of \'->MPDeviceState\' must point to struct/un
ion
miniport.c(690) : error C2223: left of \'->PTDeviceState\' must point to struct/un
ion
miniport.c(698) : error C2223: left of \'->SendPacketPoolHandle\' must point to st
ruct/union
miniport.c(698) : error C2198: \'NdisAllocatePacket\' : too few actual parameters
miniport.c(732) : error C4047: \'=\' : \'int \' differs in levels of indirection fro
m \'void *\'
miniport.c(732) : error C4047: \'=\' : \'int \' differs in levels of indirection fro
m \'void *\'
miniport.c(738) : error C4047: \'=\' : \'void *\' differs in levels of indirection f
rom \'int \'
miniport.c(742) : error C2223: left of \'->BindingHandle\' must point to struct/un
ion
miniport.c(743) : error C2198: \'NdisSend\' : too few actual parameters
miniport.c(761) : error C2223: left of \'->pPrimaryAdapt\' must point to struct/un
ion
miniport.c(761) : error C2223: left of \'->pPrimaryAdapt\' must point to struct/un
ion
miniport.c(771) : error C2143: syntax error : missing \';\' before \'type\'
miniport.c(812) : error C2275: \'NDIS_STATUS\' : illegal use of this type as an ex
pression
c:\\ntddk\\inc\\ddk\\ndis.h(4455) : error see declaration of \'NDIS_STATUS\'
miniport.c(812) : error C2146: syntax error : missing \';\' before identifier \'Sta
tus\'
miniport.c(819) : error C2065: \'Oid\' : undeclared identifier
miniport.c(828) : error C2223: left of \'->MPDeviceState\' must point to struct/un
ion
miniport.c(828) : error C2223: left of \'->StandingBy\' must point to struct/union

miniport.c(838) : error C2223: left of \'->pSecondaryAdapt\' must point to struct/
union
miniport.c(844) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(845) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(846) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(846) : error C2065: \'InformationBuffer\' : undeclared identifier
miniport.c(847) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(847) : error C2065: \'InformationBufferLength\' : undeclared identifier

miniport.c(848) : error C2223: left of \'->BytesNeeded\' must point to struct/unio
n
miniport.c(848) : error C2065: \'BytesNeeded\' : undeclared identifier
miniport.c(849) : error C2223: left of \'->BytesReadOrWritten\' must point to stru
ct/union
miniport.c(849) : error C2065: \'BytesWritten\' : undeclared identifier
miniport.c(850) : error C2223: left of \'->OutstandingRequests\' must point to str
uct/union
miniport.c(855) : error C2223: left of \'->PTDeviceState\' must point to struct/un
ion
miniport.c(857) : error C2223: left of \'->QueuedRequest\' must point to struct/un
ion
miniport.c(866) : error C2223: left of \'->BindingHandle\' must point to struct/un
ion
miniport.c(867) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(867) : error C2198: \'NdisRequest\' : too few actual parameters
miniport.c(875) : error C2100: illegal indirection
miniport.c(875) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(876) : error C2100: illegal indirection
miniport.c(876) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(885) : error C4047: \'function\' : \'struct _ADAPT *\' differs in levels
of indirection from \'int \'
miniport.c(885) : error C4024: \'MPQueryPNPCapbilities\' : different types for for
mal and actual parameter 1
miniport.c(890) : error C2223: left of \'->OutstandingRequests\' must point to str
uct/union
miniport.c(895) : error C4098: \'FilterAnalysePacket\' : \'void\' function returning
 a value
miniport.c(901) : error C2143: syntax error : missing \';\' before \'type\'
miniport.c(932) : error C2275: \'PNDIS_PM_WAKE_UP_CAPABILITIES\' : illegal use of
this type as an expression
c:\\ntddk\\inc\\ntddndis.h(1207) : error see declaration of \'PNDIS_PM_WAKE_UP_CAPAB
ILITIES\'
miniport.c(932) : error C2146: syntax error : missing \';\' before identifier \'pPM
struct\'
miniport.c(932) : error C2065: \'pPMstruct\' : undeclared identifier
miniport.c(934) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(936) : error C2065: \'pPNPCapabilities\' : undeclared identifier
miniport.c(936) : error C2223: left of \'->Request\' must point to struct/union
miniport.c(941) : error C2223: left of \'->WakeUpCapabilities\' must point to stru
ct/union
miniport.c(942) : error C2223: left of \'->MinMagicPacketWakeUp\' must point to st
ruct/union
miniport.c(943) : error C2223: left of \'->MinPatternWakeUp\' must point to struct
/union
miniport.c(944) : error C2223: left of \'->MinLinkChangeWakeUp\' must point to str
uct/union
miniport.c(945) : error C2223: left of \'->BytesReadOrWritten\' must point to stru
ct/union
miniport.c(946) : error C2223: left of \'->BytesNeeded\' must point to struct/unio
n
miniport.c(953) : error C2223: left of \'->MPDeviceState\' must point to struct/un
ion
miniport.c(954) : error C2223: left of \'->PTDeviceState\' must point to struct/un
ion
miniport.c(956) : error C2065: \'pStatus\' : undeclared identifier
miniport.c(956) : error C2100: illegal indirection
miniport.c(960) : error C2223: left of \'->BytesNeeded\' must point to struct/unio
n
miniport.c(961) : error C2100: illegal indirection
BUILD: Compile errors: not linking e:\\work\\spassthru directory
BUILD: Done

    4 files compiled - 94 Errors -  3205 LPS

帖子上面不是有个给分的嘛。。 你看到我的名字 在旁边选择给分就可以了。。 你在接收那里也是一样的

请帮我看看问题出在哪里好吗
就是编译过不去……

仔细看看DDK文档，再把Passthru读一遍，就差不多入门了。

有什么看不懂地方再问 ;)

老大 是不是miniport.c 里的FilterAnalysePacket这个函数还有部分没有写完？
VOID FilterAnalysePacket(IN PVOID Context)
{
char *buffer=PacketBuffer+54;
    char* pdest;
int   result;
NTSTATUS ntstatus=STATUS_SUCCESS;

if(strncmp(buffer,\"DATA\",4)!=0)
{
if(strncmp(buffer+6,\"From:\",5)!=0)
{
pdest=strstr(buffer,\"To:\",PacketBufferLen);

就没有下文了 这个函数是用来分析包的长度的吧

对，这个是我要过滤邮件包，和邮件包还原的。。 ;)

志同道合啊~~
我的毕设也是做有关ＮＤＩＳ的啊~~
加我ＱＱ:274791658

大家有空聊一聊啊~~

yangmin26,你的程序对TCP包的分析很不错。能不能再问一个问题？
在miniport.c模块中的mpsend函数中，将数据包packet的内容复制到一个字符缓冲区pPacketContent中，然后再分析这个缓冲区。从而得到协议，端口等信息。现在的问题是，我怎样才能利用这个缓冲区把这个包重新封包并且将这个包转发出去，而不用微软提供的这个来发包，不用再另外开一个NDIS_Packet的mypacket数据结构，而是直接用这个缓冲区重新封包然后再将包转发出去。
下面是微软提供的模块：
NdisAllocatePacket(&Status, &MyPacket, pAdapt->SendPacketPoolHandle);
if (Status == NDIS_STATUS_SUCCESS)
{
PNDIS_PACKET_EXTENSION Old, New;

Rsvd = (PRSVD)(MyPacket->ProtocolReserved);
Rsvd->OriginalPkt = Packet;
MyPacket->Private.Flags = Flags;

MyPacket->Private.Head = Packet->Private.Head;
MyPacket->Private.Tail = Packet->Private.Tail;
NdisSetPacketFlags(MyPacket, NDIS_FLAGS_DONT_LOOPBACK);

NdisMoveMemory(NDIS_OOB_DATA_FROM_PACKET(MyPacket),
  NDIS_OOB_DATA_FROM_PACKET(Packet),
  sizeof(NDIS_PACKET_OOB_DATA));

NdisIMCopySendPerPacketInfo(MyPacket, Packet);

NDIS_GET_PACKET_MEDIA_SPECIFIC_INFO(
Packet, &MediaSpecificInfo, &MediaSpecificInfoSize);

if (MediaSpecificInfo || MediaSpecificInfoSize)
{
NDIS_SET_PACKET_MEDIA_SPECIFIC_INFO(
MyPacket, MediaSpecificInfo, MediaSpecificInfoSize);
}

NdisSend(&Status, pAdapt->BindingHandle, MyPacket);



thanks!

我想修改包的内容，直接修改pPacketContent这个缓冲区，然后再将这个缓冲区重新封包转发出去

我想修改包的内容，直接修改pPacketContent这个缓冲区，然后再将这个缓冲区重新封包转发出去

我也遇到了同样的问题。
向各位大侠求救！！