鬼仔's Blog

NdisZeroMemory(&BogusProtocol,sizeof(NDIS_PROTOCOL_CHARACTERISTICS));
BogusProtocol.MajorNdisVersion = 0x04;
BogusProtocol.MinorNdisVersion = 0x0;

NdisInitUnicodeString(&ProtocolName,L"BogusProtocol");
BogusProtocol.Name = ProtocolName;
BogusProtocol.ReceiveHandler = DummyNDISProtocolReceive;
BogusProtocol.BindAdapterHandler = dummyptbindadapt;
BogusProtocol.UnbindAdapterHandler = dummyptunbindadapt;

NdisRegisterProtocol(&Status,&hBogusProtocol,&BogusProtocol,
sizeof(NDIS_PROTOCOL_CHARACTERISTICS));

#if defined(NDIS_WRAPPER)

//
// The stuff below is for CO drivers/protocols. This part is not allocated for CL drivers.
//
struct _NDIS_OPEN_CO
{
....
};
#endif
};

typedef struct _NDIS_COMMON_OPEN_BLOCK
{
PVOID MacHandle; // needed for backward compatibility
NDIS_HANDLE BindingHandle; // Miniport's open context
PNDIS_MINIPORT_BLOCK MiniportHandle; // pointer to the miniport
PNDIS_PROTOCOL_BLOCK ProtocolHandle; // pointer to our protocol
NDIS_HANDLE ProtocolBindingContext;// context when calling ProtXX funcs
PNDIS_OPEN_BLOCK MiniportNextOpen; // used by adapter's OpenQueue
PNDIS_OPEN_BLOCK ProtocolNextOpen; // used by protocol's OpenQueue
NDIS_HANDLE MiniportAdapterContext; // context for miniport
BOOLEAN Reserved1;
BOOLEAN Reserved2;
BOOLEAN Reserved3;
BOOLEAN Reserved4;
PNDIS_STRING BindDeviceName;
KSPIN_LOCK Reserved5;
PNDIS_STRING RootDeviceName;

//
// These are referenced by the macros used by protocols to call.
// All of the ones referenced by the macros are internal NDIS handlers for the miniports
//
union
{
SEND_HANDLER SendHandler;
WAN_SEND_HANDLER WanSendHandler;
};
TRANSFER_DATA_HANDLER TransferDataHandler;

//
// These are referenced internally by NDIS
//
SEND_COMPLETE_HANDLER SendCompleteHandler;
TRANSFER_DATA_COMPLETE_HANDLER TransferDataCompleteHandler;
RECEIVE_HANDLER ReceiveHandler;
RECEIVE_COMPLETE_HANDLER ReceiveCompleteHandler;
WAN_RECEIVE_HANDLER WanReceiveHandler;
REQUEST_COMPLETE_HANDLER RequestCompleteHandler;

//
// NDIS 4.0 extensions
//
RECEIVE_PACKET_HANDLER ReceivePacketHandler;
SEND_PACKETS_HANDLER SendPacketsHandler;

//
// More Cached Handlers
//
RESET_HANDLER ResetHandler;
REQUEST_HANDLER RequestHandler;
RESET_COMPLETE_HANDLER ResetCompleteHandler;
STATUS_HANDLER StatusHandler;
STATUS_COMPLETE_HANDLER StatusCompleteHandler;

#if defined(NDIS_WRAPPER)
....
#endif

case IRP_MJ_INTERNAL_DEVICE_CONTROL:
switch(irpsp->MinorFunction)
{
///原来想得要监控的几个似乎afd并不使用，而是用set event handler
case TDI_LISTEN:
#ifdef bydbg
DbgPrint("bytdiflt:TDI_LISTEN traped.should caused by kmd other than AFD.\n");

#endif
stat=gettcpportbyfile(irpsp->FileObject);
#ifdef bydbg
DbgPrint("bytdiflt:**********TDI_EVENT_CONNECT port:%d.***********\n",stat);
#endif
if(stat==0 || stat==-1){break;}//non-tcp or internal error
if(denyport[(unsigned short)stat]==1)//直接失败请求
{
#ifdef bydbg
DbgPrint("bytdiflt:*********port %d blocked!!*********\n",stat);
//DbgBreakPoint();
#endif
stat=STATUS_ACCESS_VIOLATION;
irp->IoStatus.Status=stat;
irp->IoStatus.Information=0;
IoCompleteRequest(irp, IO_NO_INCREMENT);

return stat;
}
break;

case TDI_RECEIVE:
#ifdef bydbg
DbgPrint("bytdiflt:TDI_RECEIVE traped.should caused by kmd other than AFD.\n");
//DbgBreakPoint();
#endif
break;
case TDI_SET_EVENT_HANDLER:
#ifdef bydbg
DbgPrint("bytdiflt:TDI_SET_EVENT_HANDLER traped.req local_node:%x\n",irpsp->FileObject);
DbgPrint("TDI_SET_EVENT_HANDLER EventType:%d EventHandler:%x EventContext:%x\n",
((TDI_REQUEST_KERNEL_SET_EVENT*)&(irpsp->Parameters))->EventType,
((TDI_REQUEST_KERNEL_SET_EVENT*)&(irpsp->Parameters))->EventHandler,
((TDI_REQUEST_KERNEL_SET_EVENT*)&(irpsp->Parameters))->EventContext
);
#endif
switch(((TDI_REQUEST_KERNEL_SET_EVENT*)&(irpsp->Parameters))->EventType){
case TDI_EVENT_CONNECT:
tmpstrptr="TDI_EVENT_CONNECT";
stat=gettcpportbyfile(irpsp->FileObject);
#ifdef bydbg
DbgPrint("bytdiflt:**********TDI_EVENT_CONNECT port:%d.***********\n",stat);
#endif
if(stat==0 || stat==-1){break;}//non-tcp or internal error
if(denyport[(unsigned short)stat]==1)//完成请求但不做事情
{
#ifdef bydbg
DbgPrint("bytdiflt:*********port %d blocked!!*********\n",stat);
//DbgBreakPoint();
#endif
stat=STATUS_SUCCESS;
irp->IoStatus.Status=stat;
irp->IoStatus.Information=0;
IoCompleteRequest(irp, IO_NO_INCREMENT);
return stat;
}
break;

case TDI_EVENT_RECEIVE:
tmpstrptr="TDI_EVENT_RECEIVE";
break;
case TDI_EVENT_CHAINED_RECEIVE:
tmpstrptr="TDI_EVENT_CHAINED_RECEIVE";
break;
case TDI_EVENT_RECEIVE_EXPEDITED:
tmpstrptr="TDI_EVENT_RECEIVE_EXPEDITED";
break;
case TDI_EVENT_CHAINED_RECEIVE_EXPEDITED:
tmpstrptr="TDI_EVENT_CHAINED_RECEIVE_EXPEDITED";
break;
case TDI_EVENT_RECEIVE_DATAGRAM:
tmpstrptr="TDI_EVENT_RECEIVE_DATAGRAM";
break;

default:
tmpstrptr="Other TDI_EVENT";
break;
}
#ifdef bydbg
DbgPrint("EventType is:%s\n",tmpstrptr);
#endif
break;
case TDI_CONNECT://处理主动外出连接
stat=gettcpportbyfile(irpsp->FileObject);
#ifdef bydbg
if(stat==0 || stat==-1)//non-tcp or internal error
{DbgPrint("bytdiflt:**********TDI_CONNECT local port UNKNOWN.***********\n");}
else
{DbgPrint("bytdiflt:**********TDI_CONNECT local port:%d.************\n",stat);}
//DbgBreakPoint();
#endif
break;

....

PsGetCurrentProcessId....//判断进程号