NDISHook的框架代码

1、_HOOK_CONTEXT_STRUCT | pop caller IP from stack to eaxhook context addressstruct _HOOK_CONTEXT_STRUCT*m_pHookContext;/point thisubyte code3_0x50; /0x50 | push eax| push caller IP from eax to stack ubytecode4_0xE9; /0xE9 | jmp HookProc| jump our hook procudword m_pHookProcOffset;/Protocol Wrapper Ver

2、sion 1.05/Author: gjp/email: /#include NdisHook.h#include HookRule.h#pragma pack(push)#pragma pack(1)typedef struct/runtime code ubytecode1_0x58; /0x58 | pop eaxubyte code2_0x68; /0x68 | push IMM | push our/our context data PVOID m_pBindAdaptHandle; PVOIDm_IsFilterEnabled NULL;NDIS

3、_HANDLE m_ourPacketHandle NULL;PVOID= FALSE;NDIS_HANDLE m_ourBufferPoolHandle = NULL;PNDIS_BUFFER m_ourBuffer =m_ourPacketPoolHandle = = NULL;PNDIS_PACKET m_ourBufferHandle =NULL;voidReadPacket(PNDIS_PACKETPacket,PVOIDpBuffer,udworddwBufSize);uwordm_pOriginalProc; PVOID m_pHookProc; PVOID m_pProtoco

4、lContent; PVOID*m_ppOriginPtr; struct_HOOK_CONTEXT_STRUCT *m_pHookNext; HOOK_CONTEXT_STRUCT;#pragma pack(pop)HOOK_CONTEXT_STRUCT *m_pOurAllOfHookContext = NULL;dwordwswap(uword value);void HookUnload(void) ReleaseHookFunc(); if( m_ourBufferHandle ) NdisFreeBuffer(m_ourBufferHandle); m_ourBufferHandl

5、e = NULL; if( m_ourBuffer ) NdisFreeMemory(m_ourBuffer,MAX_PACKET_SIZE,0);m_ourBuffer = NULL; if( m_ourPacketHandle ) NdisFreePacket(m_ourPacketHandle);m_ourPacketHandle = NULL;if( m_ourBufferPoolHandle ) NdisFreeBufferPool(m_ourBufferPoolHandle);m_ourBufferPoolHandle = NULL; if( m_ourPacketPoolHand

6、le ) NdisFreePacketPool(m_ourPacketPoolHandle); m_ourPacketPoolHandle = NULL; return;dword HookInit(void) NTSTATUS status; m_ourPacketPoolHandle = NULL; NdisAllocatePacketPool(&status,&m_ourPacketPoolHandle,0xFFF,0x10); if( status !=NDIS_STATUS_SUCCESS ) return FALSE; m_ourBufferPoolHandle = NULL;Nd

7、isAllocateBufferPool(&status,&m_ourBufferPoolHandle,0x10); if( status != NDIS_STATUS_SUCCESS ) return FALSE; m_ourBuffer = NULL; status = NdisAllocateMemoryWithTag(&m_ourBuffer,MAX_PACKET_SIZE,NAMW); if( status != NDIS_STATUS_SUCCESS ) return FALSE; m_ourBufferHandle = NULL;NdisAllocateBuffer(&statu

8、s,&m_ourBufferHandle,m_ourBufferPoolHandle,m_ourBuffer,MAX_PACKET_SIZE);if( status != NDIS_STATUS_SUCCESS )return FALSE;m_ourPacketHandle = NULL; NdisAllocatePacket(&status,&m_ourPacketHandle,m_ourPacketPoolHandle); if( status != NDIS_STATUS_SUCCESS ) return FALSE;NdisChainBufferAtFront(m_ourPacketH

9、andle,m_ourBufferHandle); return TRUE;typedef struct _NDIS41_PROTOCOL_CHARACTERISTICS#ifdef_cplusplusNDIS40_PROTOCOL_CHARACTERISTICS Ndis40Chars;#elseNDIS40_PROTOCOL_CHARACTERISTICS;#endif/ / Start of NDIS 4.1extensions. / CO_SEND_COMPLETE_HANDLERCoSendCompleteHandler;CO_STATUS_HANDLER CoStatusHandl

10、er;CoReceivePacketHandler;CO_RECEIVE_PACKET_HANDLERCO_REQUEST_COMPLETE_HANDLER CoRequestCompleteHandler; NDIS41_PROTOCOL_CHARACTERISTICS;dword HookProtocol(void) /Default version is 5.0 NDIS_PROTOCOL_CHARACTERISTICS ourNPC;NDIS_STRING= NDIS_STRING_CONST(HdFw_Slot);NDIS_STA TUS Status; NDIS_HANDLEour

11、ProtocolHandle = NULL; byte *ProtocolChain; dword offset; dwordNDIS_PROTOCOL_BLOCK *pNdisBlock = NULL;/ pNdisBlock pNdisBlock-NextProtocol;/ pNdisBlock-NextProtocol = memset(&ourNPC,0,sizeof(NDIS_PROTOCOL_CHARACTERISTICS); if( m_dwMajorVersion = 0x03 ) len sizeof(NDIS30_PROTOCOL_CHARACTERISTICS); ve

12、rsion 3.10 ourNPC.MajorNdisVersion = 0x03; 0x0A; else if( m_dwMajorVersion = 0x04 ) sizeof(NDIS40_PROTOCOL_CHARACTERISTICS); 0x04;ourNPC.MinorNdisVersion = 0x00;ndis protoNamelen;/NULL;/We must needourNPC.MinorNdisVersion lenourNPC.MajorNdisVersion else /treat as version 5.0atleast ndislen = sizeof(

13、NDIS50_PROTOCOL_CHARACTERISTICS); ourNPC.MajorNdisVersion = 0x05;ourNPC.MinorNdisVersion = 0x00;ourNPC.Name ourNPC.OpenAdapterCompleteHandler = ourNPC.CloseAdapterCompleteHandler=ourNPC.SendCompleteHandler ourNPC.TransferDataCompleteHandler=ourNPC.ResetCompleteHandler ourNPC.RequestCompleteHandler =

14、 PtRequestComplete;= PtReceive; ourNPC.ReceiveCompleteHandler ourNPC.StatusHandler = PtStatus;= PtStatusComplete; ourNPC.BindAdapterHandler protoName; PtOpenAdapterComplete; PtCloseAdapterComplete;= PtSendComplete; PtTransferDataComplete; = PtResetComplete; ourNPC.ReceiveHandler = PtReceiveComplete;

15、ourNPC.UnbindAdapterHandler = PtUnbindAdapter;= PtUnload; ourNPC.ReceivePacketHandler ourNPC.PnPEventHandlerourNPC.StatusCompleteHandler = PtBindAdapter;ourNPC.UnloadHandler= PtReceivePacket;= PtPNPHandler;NdisRegisterProtocol(&Status,&ourProtocolHandle,&ourNPC,len); if( !NT_SUCCESS(Status) | ourPro

16、tocolHandle = NULL ) /NdisRegisterProtocol return hand ProtocolChain = (byte *)ourProtocolHandle;/Obtain pointer to next protocol link. offset = 4; elsereturn FALSE; NDIS_PROTOCOL_BLOCK;DebugInfoCount+;if( m_dwMinorVersion = 0x01 ) offset = 0x60;else/NDIS_PROTOCOL_BLOCK-NextProtocol /Errorbreak;if(

17、ProtocolChain = NULL ) if( m_dwMajorVersion != 4 )reference of while(1) if( m_dwMajorVersion = 0x03 ) if( m_dwMajorVersion = 0x04 )offset = 0x8C;elseif( m_dwMajorVersion = 0x05 ) offset = 0x10; elseProtocolChain = (byte *)(ProtocolChain + offset)0; break; HookFuncBlock(ProtocolChain);NdisDeregisterP

18、rotocol(&Status,ourProtocolHandle);else / (byte *)ourProtocolHandle)0x0C = 0x01;/ NdisDeregisterProtocol(&Status,ourProtocolHandle); returnProtocolContent/VersionTRUE;/NextChain offsetNDIS_PROTOCOL_CHARACTERISTICS0x04NDIS 4.XX0x600x00/ NDIS 4.010x14offset BindingAdaptHandle offset / NDIS 3.XX 0x08/0

19、x140x8C0x140x00/ NDIS 5.XXHOOK_CONTEXT_STRUCTMiniportAdapterContext,UINTHookProtocolWanSend(IN NDIS_HANDLEIN0x10 0x140x00/VOID HookProtocolSendPackets(*pOurContext, IN NDIS_HANDLEIN PPNDIS_PACKETPacketArray,NumberOfPackets );NDIS_STA TUS HOOK_CONTEXT_STRUCTININMacBindingHandle,*pOurContext,IN NDIS_H

20、ANDLE Packet );NDIS_STATUS *pOurContext, IN IN PNDIS_PACKETIN HOOK_CONTEXT_STRUCTLinkHandle,HookProtocolSend( INNDIS_HANDLEPacket );NDIS_STA TUS HookProtocolReceive(*pOurContext, IN NDIS_HANDLE ProtocolBindingContext,PVOIDHOOK_CONTEXT_STRUCTINMacBindingHandle,INNDIS_HANDLE MacReceiveContext, IN PVOI

21、D HeaderBuffer, HeaderBufferSize, IN PVOID LookAheadBuffer, LookaheadBufferSize, IN UINT PacketSizeHookWanReceive( IN HOOK_CONTEXT_STRUCTIN NDIS_HANDLEIN ULONGIN UINTPacket,HookProtocolReceivePacket(IN NDIS_HANDLEPNDIS_PACKET PacketIN HOOK_CONTEXT_STRUCT *pOurContext,OUT PNDIS_STATUSBindContext,ININ

22、 UINT );NDIS_STA TUS *pOurContext, NdisLinkHandle, IN PUCHAR PacketSize HOOK_CONTEXT_STRUCT ProtocolBindingContext, );VOID HookBindAdapterHandler();INT*pOurContext,INStatus,INNDIS_HANDLEDeviceName,INPNDIS_STRINGSystemSpecific1,SystemSpecific2);VOIDIN PVOIDIN PVOIDIN HOOK_CONTEXT_STRUCT *pOurContext,

23、ProtocolBindingContext, IN PNDIS_PACKET Packet,Status);void ReleaseHookFunc(void)pHookContext while(pHookContext)HookSendComplete( IN NDIS_HANDLE NDIS_STATUS Status );voidHOOK_CONTEXT_STRUCT *pHookContext,*pNext;m_pOurAllOfHookContext; m_pOurAllOfHookContext = NULL; while(pHookContext) pNext = pHook

24、Context-m_pHookNext;pHookContext-m_ppOriginPtr0pHookContext-m_pOriginalProc;pNext; return;HOOK_CONTEXT_STRUCTHOOK_CONTEXT_STRUCT *pHookContext; m_pOurAllOfHookContext; while(pHookContext) break;pHookContext = pHookContext-m_pHookNext; pHookContext;HOOK_CONTEXT_STRUCTHOOK_CONTEXT_STRUCT *pHookContext

25、; m_pOurAllOfHookContext; while(pHookContext)INExFreePool(pHookContext); pHookContext*IsHookedNdisFunc(PVOID pAddr) pHookContextif( pHookContext = pAddr )return*IsHookedNdisFuncEx(PVOID *pAddr) pHookContextif( pHookContext-m_ppOriginPtr = pAddr )break; pHookContext =pHookContext-m_pHookNext; return

26、pHookContext;HOOK_CONTEXT_STRUCT *HookNdisFunc(PVOID pHookProc,PVOID *ppOrigProc,PVOID pBindAdaptHandle,PVOID pProtocolContent) HOOK_CONTEXT_STRUCT *pHookContext; PVOID OrgFunc;pHookContext = IsHookedNdisFunc(ppOrigProc0); if( pHookContext ) OrgFunc = pHookContext-m_pOriginalProc; else OrgFunc = ppO

27、rigProc0; if( OrgFunc = NULL ) return NULL; pHookContext = IsHookedNdisFuncEx(ppOrigProc);if( pHookContext )return pHookContext; pHookContext =ExAllocatePoolWithTag(NonPagedPool,sizeof(HOOK_CONTEXT_STRUCT),HCSP);if( pHookContext = NULL )returnmemset(pHookContext,0,sizeof(HOOK_CONTEXT_STRUCT); pHookC

28、ontext-code1_0x58 = 0x58; pHookContext-code2_0x68 pHookContext-code3_0x50 = 0x50; pHookContext-code4_0xE9 pHookContext-m_pHookContext pHookContext-m_pHookProcOffset = (udword)&pHookContext-m_pHookProcOffset) pHookContext-m_pBindAdaptHandle pHookContext-m_pProtocolContent pHookContext-m_pOriginalProc

29、 pHookContext-m_ppOriginPtr = pHookProc; pHookContext-m_pHookNextm_pOurAllOfHookContext return pHookContext;typedef PNDIS_MAC_BLOCK NDIS_HANDLEMacXX funcs PNDIS_ADAPTER_BLOCKNULL;0x68;0xE9; pHookContext;(udword)pHookProc)+ sizeof(udword); pBindAdaptHandle; pProtocolContent;= OrgFunc;/ppOrigProc0; =

30、ppOrigProc; pHookContext-m_pHookProc= m_pOurAllOfHookContext; ppOrigProc0 = pHookContext; _NDIS40_OPEN_BLOCK /adapter PNDIS_PROTOCOL_BLOCK protocol NDIS_HANDLE ProtXX funcsPNDIS_OPEN_BLOCKPNDIS_OPEN_BLOCK PFILE_OBJECT BOOLEAN= pHookContext; struct MacHandle; MacBindingHandle;AdapterHandle; ProtocolH

31、andle;/pointer to our MAC context when calling/ pointer to our / pointer to ourOpenQueue OpenQueue system this struct BOOLEAN processing unload NDIS_HANDLE an internal close KSPIN_LOCK Closing PNDIS_OPEN_BLOCK for getting to MAC routines. They are notProtocolBindingContext;/ context when calling Ada

32、pterNextOpen; / ProtocolNextOpen; / FileObject; Closing; Unloading;/used byused by/ created byTRUE when/ TRUEadapters protocols operating removing when/ 0 indicatesCloseRequestHandle;SpinLock; / guards NextGlobalOpen; / / These are optimizations / necessary, but are here to save a dereferencethrough

33、 the MAC block. /SEND_HANDLER SendHandler;TRANSFER_DA TA_HANDLER TransferDataHandler; / / These are optimizations for getting to PROTOCOL routines. They are not / necessary, but are here to save a dereference through the PROTOCOL block./ SEND_COMPLETE_HANDLERSendCompleteHandler; TRANSFER_DA TA_COMPL

34、ETE_HANDLERTransferDataCompleteHandler; RECEIVE_HANDLER ReceiveHandler; RECEIVE_COMPLETE_HANDLER ReceiveCompleteHandler; / / Extentions toPostNt31ReceiveHandler;RECEIVE_COMPLETE_HANDLERPostNt31ReceiveCompleteHandler;RECEIVE_PACKET_HANDLER/ NDIS 4.0 extensions /ReceivePacketHandler;SEND_PACKETS_HANDL

35、ERSendPacketsHandler; / / Needed for PnP /UNICODE_STRINGAdapterName;/ Upcased name of the adapterwe are bound toNDIS40_OPEN_BLOCK,*PNDIS40_OPEN_BLOCK;voidHookFuncBlock(byte *ProtocolContent) PNDIS_PROTOCOL_CHARACTERISTICS pProChar;dword IsWan; NDIS_STRING WanStringNDIS_STRING_CONST(NDISWAN); NDIS_ST

36、RING DeviceWanString NDIS_STRING_CONST(DEVICENDISWAN); NDIS_STRING TcpipString NDIS_STRING_CONST(Tcpip); NDIS_STRING TcpArpString NDIS_STRING_CONST(TCPIP_WANARP); NDIS_STRING RasArpString NDIS_STRING_CONST(RASARP); if( ProtocolContent = NULL )return; /Getpointer to NDIS_PROTOCOL_CHARACTERISTICS from

37、 protocol contentpProChar(PNDIS_PROTOCOL_CHARACTERISTICS)(ProtocolContent + 0x14);if( KeGetCurrentIrql()= PASSIVE_LEVEL ) /Check protocol name whether is Wan Lan protocol so that wecan correctly hook our functionif( !RtlCompareUnicodeString(&pProChar-Name,&WanString,TRUE) |!RtlCompareUnicodeString(&

38、pProChar-Name,&DeviceWanString,TRUE) ) IsWan = 1; else IsWan = 0; /We r only interest infollowing protocolif( !(!RtlCompareUnicodeString(&pProChar-Name,&TcpipString,TRUE) | !RtlCompareUnicodeString(&pProChar-Name,&TcpArpString,TRUE) | !RtlCompareUnicodeString(&pProChar-Name,&RasArpString,TRUE) ) ret

39、urn; else IsWan = 0; / if( !IsWan ) HookNdisFunc(HookProtocolReceive,(PVOID*)&pProChar-ReceiveHandler,NULL,ProtocolContent);/added by gjp 6.24/_asm int 3;/HookNdisFunc(HookSendComplete,(PVOID*)&pProChar-SendCompleteHandler,NULL,ProtocolContent); / elseHookNdisFunc(HookWanReceive,(PVOID *)&pProChar-W

40、anReceiveHandler,NULL,ProtocolContent);if(pProChar-MajorNdisVersion 0x03 )HookNdisFunc(HookProtocolReceivePacket,(PVOID*)&pProChar-ReceivePacketHandler,NULL,ProtocolContent);HookNdisFunc(HookBindAdapterHandler,(PVOID *)&pProChar-BindAdapterHandler,NULL,ProtocolContent); /pProChar-Name; /We should ob

41、tain and save BindAdaptHandle in order to pass it to NdisTransferData /BindAdaptHandle is pNdisOpenBlock if( m_dwMajorVersion = 0x05 ) pNdisOpenBlock while(pNdisOpenBlock) PNDIS_OPEN_BLOCK pNdisOpenBlock; (PNDIS_OPEN_BLOCK *)ProtocolContent)0;/_asm int 3;if( !IsWan )HookNdisFunc(HookProtocolSend,(PV

42、OID *)&pNdisOpenBlock-SendHandler,pNdisOpenBlock,ProtocolContent);HookNdisFunc(HookProtocolReceive,(PVOID *)&pNdisOpenBlock-PostNt31ReceiveHandler,pNdisOpenBlock,ProtocolContent);/added by gjp 6.24/_asm int 3;/HookNdisFunc(HookSendComplete,(PVOID *)&pNdisOpenBlock-SendCompleteHandler,pNdisOpenBlock,

43、ProtocolContent);/ else HookNdisFunc(HookProtocolWanSend,(PVOID *)&pNdisOpenBlock-WanSendHandler,pNdisOpenBlock,ProtocolContent);HookNdisFunc(HookWanReceive,(PVOID *)&pNdisOpenBlock-WanReceiveHandler,pNdisOpenBlock,ProtocolContent); HookNdisFunc(HookProtocolReceive,(PVOID *)&pNdisOpenBlock-ReceiveHa

44、ndler,pNdisOpenBlock,ProtocolContent);HookNdisFunc(HookProtocolReceivePacket,(PVOID *)&pNdisOpenBlock-ReceivePacketHandler,pNdisOpenBlock,ProtocolContent);HookNdisFunc(HookProtocolSendPackets,(PVOID *)&pNdisOpenBlock-SendPacketsHandler,pNdisOpenBlock,ProtocolContent);pNdisOpenBlock = pNdisOpenBlock-

45、ProtocolNextOpen; elseif( m_dwMajorVersion = 0x04 ) PNDIS40_OPEN_BLOCK pNdisOpenBlock;pNdisOpenBlock = (PNDIS40_OPEN_BLOCK *)ProtocolContent)0; while(pNdisOpenBlock) if( !IsWan ) HookNdisFunc(HookProtocolSend,(PVOID *)&pNdisOpenBlock-SendHandler,pNdisOpenBlock,ProtocolContent);HookNdisFunc(HookProto

46、colReceive,(PVOID *)&pNdisOpenBlock-PostNt31ReceiveHandler,pNdisOpenBlock,ProtocolContent); else HookNdisFunc(HookProtocolWanSend,(PVOID *)&pNdisOpenBlock-SendHandler,pNdisOpenBlock,ProtocolContent);HookNdisFunc(HookWanReceive,(PVOID *)&pNdisOpenBlock-PostNt31ReceiveHandler,pNdisOpenBlock,ProtocolCo

47、ntent); HookNdisFunc(HookProtocolReceive,(PVOID *)&pNdisOpenBlock-ReceiveHandler,pNdisOpenBlock,ProtocolContent);HookNdisFunc(HookProtocolReceivePacket,(PVOID *)&pNdisOpenBlock-ReceivePacketHandler,pNdisOpenBlock,ProtocolContent);HookNdisFunc(HookProtocolSendPackets,(PVOID *)&pNdisOpenBlock-SendPack

48、etsHandler,pNdisOpenBlock,ProtocolContent);pNdisOpenBlock = (PNDIS40_OPEN_BLOCK)pNdisOpenBlock-ProtocolNextOpen; / HookNdisFunc(HookProtocolReceivePacket,(PVOID *)&pNdisOpenBlock-ReceivePacketHandler,pNdisOpenBlock,ProtocolContent); else if( m_dwMajorVersion = 0x03 ) /Unknown information of ndis3.0

49、NDIS_OPEN_BLOCK struct return;void CheckSendHandle(HOOK_CONTEXT_STRUCT*pOurContext) HOOK_CONTEXT_STRUCT *pHookContext; if( pOurContext = NULL | pOurContext-m_pBindAdaptHandle = NULL ) return;if( m_dwMajorVersion = 5 ) PNDIS_OPEN_BLOCK pNdisOpenBlock;pNdisOpenBlock = (PNDIS_OPEN_BLOCK)pOurContext-m_p

50、BindAdaptHandle;pHookContext = (HOOK_CONTEXT_STRUCT *)pNdisOpenBlock-SendHandler;if( pHookContext ) if( !(pHookContext-m_ppOriginPtr = (PVOID*)&pNdisOpenBlock-SendHandler & pHookContext-m_pHookProc = (PVOID)HookProtocolSend) ) pHookContext =IsHookedNdisFuncEx(PVOID *)&pNdisOpenBlock-SendHandler);if(

51、 pHookContext )if( pHookContext-m_pOriginalProc = (PVOID)pNdisOpenBlock-SendHandler) pNdisOpenBlock-SendHandler = (SEND_HANDLER)pHookContext; pHookContext = (HOOK_CONTEXT_STRUCT *)pNdisOpenBlock-SendPacketsHandler;if( pHookContext )if( !(pHookContext-m_ppOriginPtr = (PVOID *)&pNdisOpenBlock-SendPack

52、etsHandler & pHookContext-m_pHookProc = (PVOID)HookProtocolSendPackets) ) pHookContext =IsHookedNdisFuncEx(PVOID *)&pNdisOpenBlock-SendPacketsHandler);if( pHookContext )if( pHookContext-m_pOriginalProc = (PVOID)pNdisOpenBlock-SendPacketsHandler) pNdisOpenBlock-SendPacketsHandler = (SEND_PACKETS_HAND

53、LER)pHookContext; else if( m_dwMajorVersion = 4 ) PNDIS40_OPEN_BLOCK pNdisOpenBlock; pNdisOpenBlock = (PNDIS40_OPEN_BLOCK)pOurContext-m_pBindAdaptHandle;pHookContext=(HOOK_CONTEXT_STRUCT *)pNdisOpenBlock-SendHandler;if( pHookContext ) if( !(pHookContext-m_ppOriginPtr = (PVOID *)&pNdisOpenBlock-SendH

54、andler & pHookContext-m_pHookProc = (PVOID)HookProtocolSend) ) pHookContext =IsHookedNdisFuncEx(PVOID *)&pNdisOpenBlock-SendHandler); if( pHookContext )if( pHookContext-m_pOriginalProc = (PVOID)pNdisOpenBlock-SendHandler) pNdisOpenBlock-SendHandler = (SEND_HANDLER)pHookContext; pHookContext = (HOOK_

55、CONTEXT_STRUCT *)pNdisOpenBlock-SendPacketsHandler; if( pHookContext ) if( !(pHookContext-m_ppOriginPtr = (PVOID& pHookContext-m_pHookProc pHookContext*)&pNdisOpenBlock-SendPacketsHandler(PVOID)HookProtocolSendPackets) ) IsHookedNdisFuncEx(PVOID *)&pNdisOpenBlock-SendPacketsHandler); if( pHookContext )if( pHookContext-m_pOriginalProc = (PVOID)pNdisOpenBlock-SendPacketsHandler) pN