TDI 传输层接口,即将淘汰的技术,取代TDI的技术是WFP(windows过滤平台)
1.绑定TDI设备 \Device\Tcp \Device\Udp \Device\RawIp 分别为 TCP协议 UDP协议 和原始IP包
1.1生成设备来绑定这些设备 IoAttachDevice 根据已知设备名字来绑定
1.1.1生成自己的设备 status = IoCreateDevice
1.1.2设置设备IO为直接IO方式
1.1.3初始化要绑定的设备名为Unicode字符串
1.1.4绑定设备
1.2分发函数(直接调用真实设备的处理过程或者自己处理)
1.2.1将所有分发函数设置默认处理过程,对于这些请求,大部分都直接 IoSkipCurrentIrpStackLocation 和 IoCallDriver 传递到下层
1.2.2这里因为设备只有6个,所以通过逐条比较判断IRP请求发送给那个的即可
1.2.3过滤创建请求可以-->向下完成-->完成函数-->请求IP地址和端口-->另一个完成函数-->>得到IP地址和端口
1.2.4保存信息
生成设备
status = misakaCreateDevice(
PDRIVER_OBJECT 驱动对象,
ULONG 设备扩展,
PUNICODE_STRING 设备名字,
DEVICE_TYPE 设备类型,
ULONG 设备特征,
BOOLEAN ,
PDEVICE_OBJECT 生成的设备指针
);
算是成功了的代码,书上说虽然可以动态卸载网络过滤驱动,但是很容易蓝屏,如果要卸载直接重启.
#include
#include
//定义变量
PDEVICE_OBJECT msk_tcp_fltobj = NULL;
PDEVICE_OBJECT msk_udp_fltobj = NULL;
PDEVICE_OBJECT msk_ip_fltobj = NULL;
PDEVICE_OBJECT msk_tcp_oldobj = NULL;
PDEVICE_OBJECT msk_udp_oldobj = NULL;
PDEVICE_OBJECT msk_ip_oldobj = NULL;
//声明函数
int misaka_tdi_create(PIRP irp);
//绑定设备 TDI
NTSTATUS misakaAttachDevice(PDRIVER_OBJECT DriverObject, PDEVICE_OBJECT *fltobj, PDEVICE_OBJECT *oldobj, wchar_t *devname){
NTSTATUS status;
UNICODE_STRING str;
status = IoCreateDevice(DriverObject, 0, NULL, FILE_DEVICE_UNKNOWN, 0, TRUE, fltobj);
if (status != STATUS_SUCCESS){
DbgPrint("misaka: create device failed %S 0x%x\r\n", devname, status);
return status;
}
//设置设备IO方式为直接IO
(*fltobj)->Flags |= DO_DIRECT_IO;
//将设备名初始化为Unicode字符串
RtlInitUnicodeString(&str, devname);
//绑定设备
status = IoAttachDevice(*fltobj, &str, oldobj);
if (status != STATUS_SUCCESS){
DbgPrint("misaka: attach device failed %S 0x%x\r\n", devname, status);
return status;
}
DbgPrint("misaka: device attach success %S fileobj 0x%x\r\n", devname, *fltobj);
return STATUS_SUCCESS;
}
//所有分发函数
NTSTATUS misakaAllDispatch(IN PDEVICE_OBJECT DeviceObject,IN PIRP irp){
NTSTATUS status;
PIO_STACK_LOCATION irps;
irps = IoGetCurrentIrpStackLocation(irp);
switch (irps->MajorFunction){
case IRP_MJ_CREATE :
DbgPrint("misaka: IRP_MJ_DEVICE_CONTROL\r\n");
misaka_tdi_create(irp);
break;
case IRP_MJ_DEVICE_CONTROL:
DbgPrint("misaka: IRP_MJ_DEVICE_CONTROL\r\n");
break;
case IRP_MJ_INTERNAL_DEVICE_CONTROL:
DbgPrint("misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL\r\n");
break;
case IRP_MJ_CLOSE :
DbgPrint("misaka: IRP_MJ_CLOSE\r\n");
break;
case IRP_MJ_CLEANUP:
DbgPrint("misaka: IRP_MJ_CLEANUP\r\n");
break;
default:
DbgPrint("misaka: more\r\n");
}
IoSkipCurrentIrpStackLocation(irp);
if (DeviceObject == msk_tcp_fltobj){ return IoCallDriver(msk_tcp_oldobj, irp); }
if (DeviceObject == msk_udp_fltobj){ return IoCallDriver(msk_udp_oldobj, irp); }
if (DeviceObject == msk_ip_fltobj){ return IoCallDriver(msk_ip_oldobj, irp); }
return STATUS_SUCCESS;
}
//卸载函数
VOID misakaUnload(IN PDRIVER_OBJECT DriverObject){
//对绑定设备解除绑定,对生成设备删除设备
if (msk_tcp_oldobj != NULL){ IoDetachDevice(msk_tcp_oldobj); }
if (msk_udp_oldobj != NULL){ IoDetachDevice(msk_udp_oldobj); }
if (msk_ip_oldobj != NULL){ IoDetachDevice(msk_ip_oldobj); }
if (msk_tcp_fltobj != NULL){ IoDeleteDevice(msk_tcp_fltobj); }
if (msk_udp_fltobj != NULL){ IoDeleteDevice(msk_udp_fltobj); }
if (msk_ip_fltobj != NULL){ IoDeleteDevice(msk_ip_fltobj); }
DbgPrint("misaka: unload misaka driver service ok.\r\n");
}
//驱动入口
NTSTATUS DriverEntry(IN PDRIVER_OBJECT driver, IN PUNICODE_STRING reg_path){
DbgPrint("misaka: hello ,wecome to use misaka driver service .\r\n");
NTSTATUS status = STATUS_SUCCESS;
//生成过滤设备并绑定目标设备
status = misakaAttachDevice(driver, &msk_tcp_fltobj, &msk_tcp_oldobj, L"\\Device\\Tcp");
if (status != STATUS_SUCCESS){ misakaUnload(driver); return status; }
status = misakaAttachDevice(driver, &msk_udp_fltobj, &msk_udp_oldobj, L"\\Device\\Udp");
if (status != STATUS_SUCCESS){ misakaUnload(driver); return status; }
status = misakaAttachDevice(driver, &msk_ip_fltobj, &msk_ip_oldobj, L"\\Device\\RawIp");
if (status != STATUS_SUCCESS){ misakaUnload(driver); return status; }
int i;
for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++){
driver->MajorFunction[i] = misakaAllDispatch;
}
driver->DriverUnload = misakaUnload;
return status;
}
//IRP_MJ_CREATE 的过滤函数
int misaka_tdi_create(PIRP irp){
NTSTATUS status;
//1.得到当前进程 2.获得EA数据
ULONG pid = (ULONG)PsGetCurrentProcessId();
FILE_FULL_EA_INFORMATION *ea = (FILE_FULL_EA_INFORMATION*)irp->AssociatedIrp.SystemBuffer;
if (ea != NULL){
//TdiTransportAddress 表示生成的是传输层地址 TdiConnectionContext 表示生成的是连接终端(本机用来维护连接的数据结构)
if (ea->EaNameLength == TDI_TRANSPORT_ADDRESS_LENGTH && memcmp(ea->EaName, TdiTransportAddress, TDI_TRANSPORT_ADDRESS_LENGTH) == 0){
//捕获传输层地址的生成,当生成成功后向该文件对象发送查询请求查询IP地址和端口
//因为完成函数往往不在 PASSIVE 级别,所以在这里分配一个空的请求
//PIRP queryirp = TdiBuildInternalDeviceControlIrp(TDI_QUERY_INFORMATION, devobj, irps->FileObject, NULL, NULL);
//if (queryirp == NULL){ DbgPrint("misaka: TdiBuildInternalDeviceControlIrp\r\n"); return STATUS_SUCCESS; }
//completion->routine = tdi_create_addrobj_complete;
//completion->context = queryirp;
DbgPrint("misaka: TdiTransportAddress\r\n");
return STATUS_SUCCESS;
} else if (ea->EaNameLength == TDI_CONNECTION_CONTEXT_LENGTH && memcmp(ea->EaName, TdiConnectionContext, TDI_CONNECTION_CONTEXT_LENGTH) == 0){
//捕获连接终端的生成
DbgPrint("misaka: TdiConnectionContext\r\n");
return STATUS_SUCCESS;
}
}
return STATUS_SUCCESS;
}
这个代码只是显示了网络的IRP请求类型.并没有获取其中的数据
misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL
misaka: IRP_MJ_DEVICE_CONTROL
misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL
misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL
misaka: IRP_MJ_DEVICE_CONTROL
misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL
misaka: TdiConnectionContext
misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL
misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL
misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL
misaka: IRP_MJ_INTERNAL_DEVICE_CONTROL
misaka: IRP_MJ_CLEANUP
misaka: IRP_MJ_CLOSE
