关于ndis 6.0自在例子filter的调试问题
_Use_decl_annotations_
NTSTATUS
DriverEntry(
PDRIVER_OBJECT DriverObject,
PUNICODE_STRING RegistryPath
)
/*++
Routine Description:
First entry point to be called, when this driver is loaded.
Register with NDIS as a filter driver and create a device
for communication with user-mode.
Arguments:
DriverObject - pointer to the system's driver object structure
for this driver
RegistryPath - system's registry path for this driver
Return Value:
STATUS_SUCCESS if all initialization is successful, STATUS_XXX
error code if not.
--*/
{
NDIS_STATUS Status;
NDIS_FILTER_DRIVER_CHARACTERISTICS FChars;
NDIS_STRING ServiceName = RTL_CONSTANT_STRING(FILTER_SERVICE_NAME);
NDIS_STRING UniqueName = RTL_CONSTANT_STRING(FILTER_UNIQUE_NAME);
NDIS_STRING FriendlyName = RTL_CONSTANT_STRING(FILTER_FRIENDLY_NAME);
BOOLEAN bFalse = FALSE;
UNREFERENCED_PARAMETER(RegistryPath);
DEBUGP(DL_TRACE, "===>DriverEntry...\n");
FilterDriverObject = DriverObject;
do
{
NdisZeroMemory(&FChars, sizeof(NDIS_FILTER_DRIVER_CHARACTERISTICS));
FChars.Header.Type = NDIS_OBJECT_TYPE_FILTER_DRIVER_CHARACTERISTICS;
FChars.Header.Size = sizeof(NDIS_FILTER_DRIVER_CHARACTERISTICS);
#if NDIS_SUPPORT_NDIS61
FChars.Header.Revision = NDIS_FILTER_CHARACTERISTICS_REVISION_2;
#else
FChars.Header.Revision = NDIS_FILTER_CHARACTERISTICS_REVISION_1;
#endif
FChars.MajorNdisVersion = FILTER_MAJOR_NDIS_VERSION;
FChars.MinorNdisVersion = FILTER_MINOR_NDIS_VERSION;
FChars.MajorDriverVersion = 1;
FChars.MinorDriverVersion = 0;
FChars.Flags = 0;
FChars.FriendlyName = FriendlyName;
FChars.UniqueName = UniqueName;
FChars.ServiceName = ServiceName;
//
// TODO: Most handlers are optional, however, this sample includes them
// all for illustrative purposes. If you do not need a particular
// handler, set it to NULL and NDIS will more efficiently pass the
// operation through on your behalf.
//
FChars.SetOptionsHandler = FilterRegisterOptions;
FChars.AttachHandler = FilterAttach;
FChars.DetachHandler = FilterDetach;
FChars.RestartHandler = FilterRestart;
FChars.PauseHandler = FilterPause;
FChars.SetFilterModuleOptionsHandler = FilterSetModuleOptions;
FChars.OidRequestHandler = FilterOidRequest;
FChars.OidRequestCompleteHandler = FilterOidRequestComplete;
FChars.CancelOidRequestHandler = FilterCancelOidRequest;
FChars.SendNetBufferListsHandler = FilterSendNetBufferLists;
FChars.ReturnNetBufferListsHandler = FilterReturnNetBufferLists;
FChars.SendNetBufferListsCompleteHandler = FilterSendNetBufferListsComplete;
FChars.ReceiveNetBufferListsHandler = FilterReceiveNetBufferLists;
FChars.DevicePnPEventNotifyHandler = FilterDevicePnPEventNotify;
FChars.NetPnPEventHandler = FilterNetPnPEvent;
FChars.StatusHandler = FilterStatus;
FChars.CancelSendNetBufferListsHandler = FilterCancelSendNetBufferLists;
DriverObject->DriverUnload = FilterUnload;
FilterDriverHandle = NULL;
//
// Initialize spin locks
//
FILTER_INIT_LOCK(&FilterListLock);
InitializeListHead(&FilterModuleList);
Status = NdisFRegisterFilterDriver(DriverObject,
(NDIS_HANDLE)FilterDriverObject,
&FChars,
&FilterDriverHandle);
if (Status != NDIS_STATUS_SUCCESS)
{
DEBUGP(DL_WARN, "Register filter driver failed.\n");
break;
}
Status = FilterRegisterDevice();
if (Status != NDIS_STATUS_SUCCESS)
{
NdisFDeregisterFilterDriver(FilterDriverHandle);
FILTER_FREE_LOCK(&FilterListLock);
DEBUGP(DL_WARN, "Register device for the filter driver failed.\n");
break;
}
}
while(bFalse);相关推荐
NDIS 6.0 Filter Driver
NDIS 6.x LightWeight Filter , Windows Driver , Smaple , Networking , replacement of NDIS 5 Sample Intermediate Driver (Passthru driver)
NDIS 6.0 Filter Driver实战:数据包过滤与MAC地址查询
在Windows网络驱动开发中,NDIS(Network Driver Interface Specification)提供了一套标准化的网络数据路径扩展机制。其中,NDIS过滤驱动(Filter Driver)位于协议驱动与网卡驱动之间,能够以透明方式监控和干预所有收发数据包,是构建网络监控、流量管理及安全过滤功能的理想选择。通过挂载到网卡设备栈,驱动开发者可以截获网络数据包(NBL),进行统计、修改或丢弃,并可通过OID请求查询底层硬件属性,例如获取网卡的真实MAC地址。这种内核态的数据可见性与控制能力
NDIS 6.0 Filter驱动实战:收发数据包与MAC地址查询实现
在Windows网络驱动开发中,NDIS过滤驱动(Filter Driver)位于协议驱动与网卡小端口驱动之间,通过处理NetBufferList(NBL)链实现对数据包的监控、过滤与转发。这种架构天然适合终端安全、流量统计和网络监控等场景,能够在发送与接收路径上插入自定义逻辑,同时保持原始透传语义。对数据包进行采集、记录或注入时,开发者需要深入理解NBL生命周期、OID请求机制以及IRQL约束等底层规则。例如,通过向底层驱动发起OID_802_3_CURRENT_ADDRESS查询,即可在过滤驱动内获取当
NDIS 6.0 Filter驱动数据包收发与MAC地址查询实战指南
在Windows网络驱动开发中,NDIS(网络驱动接口规范)是连接协议栈与物理网卡的核心框架。Filter驱动(LWF)作为轻量级的过滤模块,通过回调机制透明介入数据包的发送与接收路径,实现对网络流量的实时监控与处理。NET_BUFFER_LIST承载着数据包的完整生命周期,而OID请求则用于向底层网卡查询MAC地址等关键属性,是驱动层获取硬件信息的标准通道。这类底层技术广泛应用于流量监控、防火墙、协议分析和链路聚合等场景。掌握NDIS Filter驱动的收发回调实现与OID查询机制,不仅是构建高性能网络功
基于NDIS 6.x的Filter生成代码
操作系统: win 10 x64 VS版本: VisualStudio.17.Release/17.11.4+35312.102 Windows Driver Kit 10.0.26100.1 内容概要: 默认情况下生成的NDIS Filter Sample,作为讲解用的; 可以从里面看到WDF和NDIS的基本运行方式。


驱动开发/核心开发
