{"id":550,"date":"2012-06-29T01:49:30","date_gmt":"2012-06-28T17:49:30","guid":{"rendered":"http:\/\/newbiecoder.0ginr.com\/blog\/?p=550"},"modified":"2012-07-06T03:15:32","modified_gmt":"2012-07-05T19:15:32","slug":"%e7%9b%91%e5%90%ac-ip-%e6%95%b0%e6%8d%ae%e5%8c%85","status":"publish","type":"post","link":"https:\/\/newbiecoder.0ginr.com\/blog\/?p=550","title":{"rendered":"\u76d1\u542c IP \u6570\u636e\u5305"},"content":{"rendered":"

\u5229\u7528\u7cfb\u7edf\u7684 ipfltdrv.sys \u5b9e\u73b0\u7684\u8fc7\u6ee4\u5668\u94a9\u5b50\u9a71\u52a8\uff08Filter-Hook Drivers\uff09\u3002<\/p>\n

\u6d4b\u8bd5\u524d\u8bf7\u786e\u4fdd SystemRoot\\System32\\Drivers\\ipfltdrv.sys \u5df2\u7ecf\u52a0\u8f7d\uff08\u5b58\u5728\u8bbe\u5907 \\Device\\IpFilterdriver\uff09\u3002\u5982\u679c\u6ca1\u6709\u52a0\u8f7d\u7684\u8bdd\u53ef\u4ee5\u7528\u5404\u79cd\u52a0\u8f7d\u9a71\u52a8\u7684\u5de5\u5177\u6765\u52a0\u8f7d\uff08\u6bd4\u5982 Coderui<\/a> \u7684 InstDrv.exe<\/a>\uff09\u3002<\/p>\n

\u6ce8\u610f\u5728\u56de\u8c03\u91cc\u9762\uff0cPacket \u662f\u5305\u62ec\u4e86 TCP \/ UDP \/ IGMP \/ ICMP \u7684\u62a5\u5934\u7684\uff08\u4f46\u662f\u4e0d\u5305\u62ec IP \u62a5\u5934\u3002\uff09\u3002<\/p>\n

[FilterHookDriver] DriverEntry: Driver loaded. Built time: Jun 29 2012 01:37:03.\r\n[FilterHookDriver] PacketFilterCallbackProc: Sent a packet from 10.0.0.2 to 10.0.0.1 with length 8\r\n[FilterHookDriver] PacketFilterCallbackProc: Sent a packet from 10.0.0.2 to 10.0.0.255 with length 8\r\n[FilterHookDriver] PacketFilterCallbackProc: Received a packet from 10.0.0.2 to 10.0.0.255 with length 209\r\n[FilterHookDriver] PacketFilterCallbackProc: Received a packet from 10.0.0.1 to 10.0.0.2 with length 1064\r\n[FilterHookDriver] PacketFilterCallbackProc: Sent a packet from 10.0.0.2 to 10.0.0.1 with length 8\r\n[FilterHookDriver] PacketFilterCallbackProc: Received a packet from 10.0.0.1 to 10.0.0.2 with length 1064\r\n[FilterHookDriver] PacketFilterCallbackProc: Sent a packet from 10.0.0.2 to 10.0.0.1 with length 8\r\n[FilterHookDriver] PacketFilterCallbackProc: Received a packet from 10.0.0.1 to 10.0.0.2 with length 1064\r\n[FilterHookDriver] DriverUnload: Driver unloaded.<\/pre>\n
#include 
\n#include 
\n#include \n#include <\/p>\n
\/\/
\n\/\/ \u7c7b\u578b\u5b9a\u4e49\u3002
\n\/\/<\/p>\n
typedef struct _IP_HEADER {
\n\tUCHAR HeaderVersion;
\n\tUCHAR TypeOfService;
\n\tUSHORT PacketSize;
\n\tUSHORT PacketId;<\/p>\n
\t\/\/
\n\t\/\/ \u5206\u7247\u504f\u79fb\u4e5f\u5728 Flags \u4e2d\u3002\u53c2\u8003 IP \u62a5\u5934\u3002
\n\t\/\/<\/p>\n
\tUSHORT Flags;
\n\tUCHAR TimeToLive;
\n\tUCHAR Protocol;
\n\tUSHORT Checksum;
\n\tULONG Source;
\n\tULONG Destination;
\n} IP_HEADER, *PIP_HEADER;<\/p>\n
typedef PacketFilterExtensionPtr PACKET_FILTER_EXTENSION_PTR;<\/p>\n
\/\/
\n\/\/ \u5b57\u7b26\u4e32\u5f62\u5f0f\u7684 IP \u5730\u5740\u7684\u6700\u5927\u957f\u5ea6\u3002
\n\/\/<\/p>\n
#define STRING_ADDRESS_LENGTH 16<\/p>\n
\/\/
\n\/\/ \u8f93\u51fa\u8c03\u8bd5\u4fe1\u606f\u3002
\n\/\/<\/p>\n
#define PROJECT_NAME \"FilterHookDriver\"<\/p>\n
#define DbgWrite(Format, ...) DbgPrint(\"[\" PROJECT_NAME \"] \" __FUNCTION__ \": \" Format, __VA_ARGS__)
\n#define DbgWriteLine(Format, ...) DbgWrite(Format \"\\n\", __VA_ARGS__)<\/p>\n
\/\/
\n\/\/ \u4fee\u6539\u6307\u9488\u4f4d\u7f6e\u3002
\n\/\/<\/p>\n
#define PointerAdd(Pointer, Increment, Type) ((Type)((ULONG_PTR)(Pointer) + (Increment)))<\/p>\n
\/\/
\n\/\/ \u8ba1\u7b97\u9759\u6001\u6570\u7ec4\u4e2d\u7684\u5143\u7d20\u4e2a\u6570\u3002
\n\/\/<\/p>\n
#define CountOf(Array) ((sizeof(Array) \/ sizeof((Array)[0])))<\/p>\n
\/\/
\n\/\/ \u8fc7\u6ee4\u5668\u9a71\u52a8\u7684\u8bbe\u5907\u5bf9\u8c61\u540d\u79f0\u3002
\n\/\/<\/p>\n
#define IP_FILTER_DEVICE_NAME L\"\\\\Device\\\\Ipfilterdriver\"<\/p>\n
\/\/
\n\/\/ \u51fd\u6570\u539f\u578b\u3002
\n\/\/<\/p>\n
DRIVER_INITIALIZE DriverEntry;<\/p>\n
DRIVER_UNLOAD DriverUnload;<\/p>\n
NTSTATUS OpenFilterDeviceObject(
\n\t__out PDEVICE_OBJECT *DeviceObject
\n\t);<\/p>\n
NTSTATUS RegisterFilterCallback(
\n\t__in PACKET_FILTER_EXTENSION_PTR FilterCallbackProc
\n\t);<\/p>\n
\/\/
\n\/\/ \u51fd\u6570\u6240\u5c5e\u533a\u6bb5\u6807\u8bb0\u3002
\n\/\/<\/p>\n
#ifdef ALLOC_PRAGMA
\n#pragma alloc_text(INIT, DriverEntry)
\n#pragma alloc_text(PAGE, DriverUnload)
\n#pragma alloc_text(PAGE, OpenFilterDeviceObject)
\n#pragma alloc_text(PAGE, RegisterFilterCallback)
\n#endif<\/p>\n
\/\/
\n\/\/ \u5c06 ULONG \u578b IP \u5730\u5740\u8f6c\u6362\u4e3a xxx.xxx.xxx.xxx \u5f62\u5f0f\u7684 IP \u5730\u5740\u3002
\n\/\/
\n\/\/ StringAddress \u7684\u957f\u5ea6\u81f3\u5c11\u9700\u8981\u4e3a STRING_ADDRESS_LENGTH\u3002
\n\/\/<\/p>\n
VOID ConvertNumericAddressToString(
\n\t__out PUCHAR StringAddress,
\n\t__in ULONG NumericAddress
\n\t)
\n{
\n\tULONG CurrentPosition;
\n\tULONG Index;<\/p>\n
\tCurrentPosition = 0;<\/p>\n
\t\/\/
\n\t\/\/ \u5c06 IP \u5730\u5740\u6309\u5b57\u8282\u5206\u5f00\uff0c\u5206\u522b\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\u5199\u5165 StringAddress\u3002
\n\t\/\/<\/p>\n
\tfor (Index = 0; Index < sizeof(ULONG); Index++) {\n\t\tLPTSTR DestinationEnd;\n\t\tUCHAR Current;\n\t\tNTSTATUS Status;\n\n\t\t\/\/\n\t\t\/\/ \u5f97\u5230\u8fd9\u4e00\u4f4d\u7684\u6570\u503c\u3002\n\t\t\/\/\n\n\t\tCurrent = *PointerAdd(&NumericAddress, Index, PUCHAR);\n\n\t\t\/\/\n\t\t\/\/ \u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\u3002\n\t\t\/\/\n\n\t\tASSERT(STRING_ADDRESS_LENGTH > CurrentPosition);<\/p>\n
\t\tStatus = RtlStringCchPrintfExA(PointerAdd(StringAddress, CurrentPosition, PCHAR),
\n\t\t\tSTRING_ADDRESS_LENGTH - CurrentPosition, &DestinationEnd, NULL, 0, \"%d\",
\n\t\t\tCurrent);<\/p>\n
\t\tASSERT(NT_SUCCESS(Status));<\/p>\n
\t\tCurrentPosition = (PUCHAR)DestinationEnd - StringAddress;<\/p>\n
\t\t\/\/
\n\t\t\/\/ \u5982\u679c\u4e0d\u662f\u6700\u540e\u4e00\u6bb5\uff0c\u5219\u589e\u52a0\u5206\u9694\u7b26\uff08\u201c.\u201d\uff09\u3002
\n\t\t\/\/<\/p>\n
\t\tif (Index != sizeof(ULONG) - 1) {
\n\t\t\tStringAddress[CurrentPosition++] = '.';
\n\t\t}
\n\t}<\/p>\n
\t\/\/
\n\t\/\/ \u672b\u5c3e\u8865 0\u3002
\n\t\/\/<\/p>\n
\tStringAddress[CurrentPosition++] = 0;<\/p>\n
\tASSERT(CurrentPosition <= STRING_ADDRESS_LENGTH);\n\n\treturn;\n}\n\n\/\/\n\/\/ \u8fc7\u6ee4\u56de\u8c03\u3002\n\/\/\n\/\/ Packet\u3001PacketSize \u5747\u4e0d\u5305\u542b IP \u62a5\u5934\u3002\n\/\/\n\/\/ \u672c\u5e94\u4e3a PacketFilterExtensionPtr \u7c7b\u578b\uff0c\u4e3a\u4e86\u65b9\u4fbf\u5904\u7406\u6b64\u5904\u7a0d\u5fae\u6709\u70b9\u53d8\u5316\u3002\n\/\/ PacketFilterExtensionPtr \u7684\u5b9a\u4e49\u53c2\u8003 \n\/\/ http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/hardware\/ff562312(v=vs.85).aspx\u3002\n\/\/\n\nPF_FORWARD_ACTION PacketFilterCallbackProc(\n\t__in PIP_HEADER Header,\n\t__in PUCHAR Packet,\n\t__in ULONG PacketSize,\n\t__in ULONG ReceiveInterfaceIndex,\n\t__in ULONG SendInterfaceIndex,\n\t__in PVOID ReceiveLinkNextHoop,\n\t__in PVOID SendLinkNextHoop\n\t)\n{\n\tstatic const CHAR *OperationDescription[] = {\"Sent\", \"Received\"};\n\n\tUCHAR Source[STRING_ADDRESS_LENGTH], Destination[STRING_ADDRESS_LENGTH];\n\tULONG OperationType;\n\n\t\/\/\n\t\/\/ \u5c06 IP \u5730\u5740\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\u5f62\u5f0f\u3002\n\t\/\/\n\n\tConvertNumericAddressToString(Source, Header->Source);
\n\tConvertNumericAddressToString(Destination, Header->Destination);<\/p>\n
\t\/\/
\n\t\/\/ \u83b7\u53d6\u64cd\u4f5c\u7c7b\u578b\u3002
\n\t\/\/
\n\t\/\/ \u5982\u679c ReceiveInterfaceIndex \u4e3a INVALID_PF_IF_INDEX\uff0c\u5219\u8868\u793a\u5f53\u524d\u8fc7\u6ee4\u7684\u662f\u53d1\u9001\u64cd\u4f5c\u3002
\n\t\/\/ \u5982\u679c SendInterfaceIndex \u4e3a INVALID_PF_IF_INDEX\uff0c\u5219\u8868\u793a\u5f53\u524d\u8fc7\u6ee4\u7684\u662f\u63a5\u53d7\u64cd\u4f5c\u3002
\n\t\/\/
\n\t\/\/ ReceiveInterfaceIndex \u548c SendInterfaceIndex \u4e2d\u6709\u4e14\u53ea\u53ef\u80fd\u6709\u4e00\u4e2a\u662f INVALID_PF_IF_INDEX\u3002
\n\t\/\/<\/p>\n
\tASSERT(((ReceiveInterfaceIndex == INVALID_PF_IF_INDEX ^
\n\t\tSendInterfaceIndex == INVALID_PF_IF_INDEX)) == TRUE);<\/p>\n
\tif (ReceiveInterfaceIndex == INVALID_PF_IF_INDEX) {
\n\t\tOperationType = 0;
\n\t} else {
\n\t\tOperationType = 1;
\n\t}<\/p>\n
\tASSERT(OperationType < CountOf(OperationDescription));\n\n\t\/\/\n\t\/\/ \u8f93\u51fa\u4fe1\u606f\u3002\n\t\/\/\n\n\tDbgWriteLine(\"%s a packet from %s to %s with length %d\", OperationDescription[OperationType],\n\t\tSource, Destination, PacketSize);\n\n\t\/\/\n\t\/\/ \u653e\u884c\u3002\n\t\/\/\n\n\treturn PF_FORWARD;\n}\n\n\/\/\n\/\/ \u6253\u5f00 IP \u8fc7\u6ee4\u5668\u9a71\u52a8\u7684\u8bbe\u5907\u5bf9\u8c61\u3002\n\/\/\n\/\/ \u8fd9\u4e2a\u51fd\u6570\u5728\u8fd4\u56de\u4e4b\u524d\u4f1a\u5f15\u7528 IP \u8fc7\u6ee4\u5668\u9a71\u52a8\u7684\u8bbe\u5907\u5bf9\u8c61\u3002\u7a0d\u540e\u5e94\u91ca\u653e\u5f15\u7528\u3002\n\/\/\n\nNTSTATUS OpenFilterDeviceObject(\n\t__out PDEVICE_OBJECT *DeviceObject\n\t)\n{\n\tUNICODE_STRING DeviceName = RTL_CONSTANT_STRING(IP_FILTER_DEVICE_NAME);\n\tPDEVICE_OBJECT LocalDeviceObject;\n\tPFILE_OBJECT FileObject;\n\tNTSTATUS Status;\n\n\tPAGED_CODE();\n\n\t\/\/\n\t\/\/ \u83b7\u5f97\u8bbe\u5907\u5bf9\u8c61\u7684\u6307\u9488\u3002\n\t\/\/\n\n\tStatus = IoGetDeviceObjectPointer(&DeviceName, SYNCHRONIZE | GENERIC_READ | GENERIC_WRITE,\n\t\t&FileObject, &LocalDeviceObject);\n\n\tif (!NT_SUCCESS(Status)) {\n\t\treturn Status;\n\t}\n\n\t\/\/\n\t\/\/ IoGetDeviceObjectPointer \u53ea\u4f1a\u5f15\u7528 FileObject \uff08FileObject \u95f4\u63a5\u5f15\u7528\u4e86 DeviceObject\u3002\uff09\n\t\/\/ \u6b64\u5904\u5f15\u7528 DeviceObject \u5e76\u91ca\u653e\u5bf9 FileObject \u7684\u5f15\u7528\u3002\n\t\/\/\n\n\tObReferenceObject((PVOID)LocalDeviceObject);\n\tObDereferenceObject((PVOID)FileObject);\n\n\t\/\/\n\t\/\/ \u8fd4\u56de\u8bbe\u5907\u5bf9\u8c61\u7ed9\u8c03\u7528\u65b9\u3002\n\t\/\/\n\n\t*DeviceObject = LocalDeviceObject;\n\n\treturn Status;\n}\n\n\/\/\n\/\/ \u6ce8\u518c\u8fc7\u6ee4\u56de\u8c03\u3002\n\/\/\n\/\/ FilterCallbackProc \u8f93\u5165 NULL \u5219\u4f1a\u4ece\u8fc7\u6ee4\u5668\u9a71\u52a8\u4e2d\u6e05\u9664\u5df2\u7ecf\u6ce8\u518c\u7684\u8fc7\u6ee4\u56de\u8c03\u3002\n\/\/\n\nNTSTATUS RegisterFilterCallback(\n\t__in PACKET_FILTER_EXTENSION_PTR FilterCallbackProc\n\t)\n{\n\tPF_SET_EXTENSION_HOOK_INFO SetExtensionHookInfo;\n\tPDEVICE_OBJECT FilterDeviceObject;\n\tIO_STATUS_BLOCK IoStatusBlock;\n\tKEVENT Event;\n\tPIRP Irp;\n\tNTSTATUS Status;\n\n\tPAGED_CODE();\n\n\t\/\/\n\t\/\/ \u6253\u5f00\u8fc7\u6ee4\u5668\u9a71\u52a8\u7684\u8bbe\u5907\u5bf9\u8c61\u3002\n\t\/\/\n\n\tStatus = OpenFilterDeviceObject(&FilterDeviceObject);\n\n\tif (!NT_SUCCESS(Status)) {\n\t\treturn Status;\n\t}\n\n\t\/\/\n\t\/\/ \u586b\u5145\u6ce8\u518c\u4fe1\u606f\u3002\n\t\/\/\n\n\tSetExtensionHookInfo.ExtensionPointer = FilterCallbackProc;\n\n\t\/\/\n\t\/\/ \u521d\u59cb\u5316\u7528\u4e8e\u540c\u6b65\u64cd\u4f5c\u7684\u4e8b\u4ef6\u3002\n\t\/\/\n\n\tKeInitializeEvent(&Event, NotificationEvent, FALSE);\n\n\t\/\/\n\t\/\/ \u6784\u9020 IRP\u3002\n\t\/\/\n\n\tIrp = IoBuildDeviceIoControlRequest(IOCTL_PF_SET_EXTENSION_POINTER, FilterDeviceObject, \n\t\t(PVOID)&SetExtensionHookInfo, sizeof(PF_SET_EXTENSION_HOOK_INFO), NULL, 0, FALSE,\n\t\t&Event, &IoStatusBlock);\n\n\tif (!Irp) {\n\t\tObDereferenceObject((PVOID)FilterDeviceObject);\n\n\t\treturn STATUS_INSUFFICIENT_RESOURCES;\n\t}\n\n\t\/\/\n\t\/\/ \u6ce8\u518c\u8fc7\u6ee4\u56de\u8c03\u3002\n\t\/\/\n\n\tStatus = IoCallDriver(FilterDeviceObject, Irp);\n\n\tif (Status == STATUS_PENDING) {\n\t\t(VOID)KeWaitForSingleObject((PVOID)&Event, Executive, KernelMode, FALSE, NULL);\n\n\t\tStatus = IoStatusBlock.Status;\n\t}\n\n\t\/\/\n\t\/\/ \u91ca\u653e\u8d44\u6e90\u3002\n\t\/\/\n\t\/\/ IRP \u4f1a\u7531\u8fc7\u6ee4\u5668\u9a71\u52a8\u5728 IoCompleteRequest \u65f6\u88ab\u7cfb\u7edf\u91ca\u653e\u3002\n\t\/\/\n\n\tObDereferenceObject((PVOID)FilterDeviceObject);\n\n\tif (!NT_SUCCESS(Status)) {\n\t\treturn Status;\n\t}\n\n\treturn Status;\n}\n\n\/\/\n\/\/ \u5165\u53e3\u70b9\u3002\n\/\/\n\nNTSTATUS DriverEntry(\n\t__in PDRIVER_OBJECT DriverObject,\n\t__in PUNICODE_STRING RegistryPath\n\t)\n{\n\tNTSTATUS Status;\n\n\tUNREFERENCED_PARAMETER(RegistryPath);\n\n\tDbgWriteLine(\"Driver loaded. Built time: %s %s.\", __DATE__, __TIME__);\n\n\t\/\/\n\t\/\/ \u586b\u5145\u56de\u8c03\u51fd\u6570\u3002\n\t\/\/\n\n\tDriverObject->DriverUnload = DriverUnload;<\/p>\n
\t\/\/
\n\t\/\/ \u6ce8\u518c\u8fc7\u6ee4\u56de\u8c03\u3002
\n\t\/\/<\/p>\n
\tStatus = RegisterFilterCallback((PACKET_FILTER_EXTENSION_PTR)PacketFilterCallbackProc);<\/p>\n
\tif (!NT_SUCCESS(Status)) {
\n\t\tDbgWriteLine(\"We failed to register our filter hook. Unloading.\");<\/p>\n
\t\treturn Status;
\n\t}<\/p>\n
\treturn Status;
\n}<\/p>\n
\/\/
\n\/\/ \u5378\u8f7d\u56de\u8c03\u3002
\n\/\/<\/p>\n
VOID DriverUnload(
\n\t__in PDRIVER_OBJECT DriverObject
\n\t)
\n{
\n\tNTSTATUS Status;<\/p>\n
\tPAGED_CODE();<\/p>\n
\t\/\/
\n\t\/\/ \u6ce8\u9500\u8fc7\u6ee4\u56de\u8c03\u3002
\n\t\/\/<\/p>\n
\tStatus = RegisterFilterCallback(NULL);<\/p>\n
\tASSERT(NT_SUCCESS(Status));<\/p>\n
\tDbgWriteLine(\"Driver unloaded.\");<\/p>\n
\treturn;
\n}<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"
\u5229\u7528\u7cfb\u7edf\u7684 ipfltdrv.sys \u5b9e\u73b0\u7684\u8fc7\u6ee4\u5668\u94a9\u5b50\u9a71\u52a8\uff08Filter-Hook Drivers\uff09\u3002 \u6d4b\u8bd5\u524d […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-550","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/550","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=550"}],"version-history":[{"count":10,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/550\/revisions"}],"predecessor-version":[{"id":566,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/550\/revisions\/566"}],"wp:attachment":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=550"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}