²é¿´: 637  |  »Ø¸´: 2
µ±Ç°Ö»ÏÔʾÂú×ãÖ¸¶¨Ìõ¼þµÄ»ØÌû£¬µã»÷ÕâÀï²é¿´±¾»°ÌâµÄËùÓлØÌû

zhmindyx

гæ (³õÈëÎÄ̳)

[ÇóÖú] ÇóÖúhook³ÌÐòµÄ×¢½â

ÓÐһϼ¸¶ÎHOOK³ÌÐò£¬¿´²»Ì«¶®£¬ÇóÖÐÎÄ×¢½â


NTSTATUS HookExistingNDISProtocols(void)
{
UINT *ProtocolPtr;
NDIS_HANDLE hBogusProtocol = NULL;
PNDIS_OPEN_BLOCK OpenBlockPtr = NULL;
PNDIS_PROTOCOL_HOOK pNode;

hBogusProtocol = RegisterBogusNDISProtocol();
if(hBogusProtocol == NULL) return STATUS_UNSUCCESSFUL;

ProtocolPtr = (UINT*)hBogusProtocol;
ProtocolPtr = (UINT*)((PBYTE)ProtocolPtr + sizeof(REFERENCE) + 8);
ProtocolPtr = (UINT*)(*ProtocolPtr);

while(ProtocolPtr != NULL) {
OpenBlockPtr = (PNDIS_OPEN_BLOCK)(*ProtocolPtr);
if(OpenBlockPtr != NULL) {
pNode = NewNDISNode();
if(pNode != NULL) {
pNode->ProtocolBindingContext = OpenBlockPtr->ProtocolBindingContext;
pNode->MacBindingContext = OpenBlockPtr->MacBindingHandle;
pNode->OpenBlockPtr = OpenBlockPtr;
pNode->RealSendHandler = OpenBlockPtr->SendHandler;
//How about WanSendHandler?
pNode->RealPostNt31ReceiveHandler = OpenBlockPtr->PostNt31ReceiveHandler;

InsertNDISNode(pNode);

OpenBlockPtr->SendHandler = NDISSendHandler;
//How about WanSendHandler?
OpenBlockPtr->PostNt31ReceiveHandler = NDISPostNt31ReceiveHandler;
}
}

ProtocolPtr = (UINT*)((PBYTE)ProtocolPtr + sizeof(REFERENCE) + 8);
ProtocolPtr = (UINT*)(*ProtocolPtr);
}

DeregisterBogusNDISProtocol(hBogusProtocol);

return STATUS_SUCCESS;
}

NTSTATUS HookExistingNDISProtocols(void)
{
UINT *ProtocolPtr;
NDIS_HANDLE hBogusProtocol = NULL;
PNDIS_OPEN_BLOCK OpenBlockPtr = NULL;
PNDIS_PROTOCOL_HOOK pNode;

hBogusProtocol = RegisterBogusNDISProtocol();
if(hBogusProtocol == NULL) return STATUS_UNSUCCESSFUL;

ProtocolPtr = (UINT*)hBogusProtocol;
ProtocolPtr = (UINT*)((PBYTE)ProtocolPtr + sizeof(REFERENCE) + 8);
ProtocolPtr = (UINT*)(*ProtocolPtr);

while(ProtocolPtr != NULL) {
OpenBlockPtr = (PNDIS_OPEN_BLOCK)(*ProtocolPtr);
if(OpenBlockPtr != NULL) {
pNode = NewNDISNode();
if(pNode != NULL) {
pNode->ProtocolBindingContext = OpenBlockPtr->ProtocolBindingContext;
pNode->MacBindingContext = OpenBlockPtr->MacBindingHandle;
pNode->OpenBlockPtr = OpenBlockPtr;
pNode->RealSendHandler = OpenBlockPtr->SendHandler;
//How about WanSendHandler?
pNode->RealPostNt31ReceiveHandler = OpenBlockPtr->PostNt31ReceiveHandler;

InsertNDISNode(pNode);

OpenBlockPtr->SendHandler = NDISSendHandler;
//How about WanSendHandler?
OpenBlockPtr->PostNt31ReceiveHandler = NDISPostNt31ReceiveHandler;
}
}

ProtocolPtr = (UINT*)((PBYTE)ProtocolPtr + sizeof(REFERENCE) + 8);
ProtocolPtr = (UINT*)(*ProtocolPtr);
}

DeregisterBogusNDISProtocol(hBogusProtocol);

return STATUS_SUCCESS;
}


NDIS_STATUS NDISSendHandler(
IN NDIS_HANDLE MacBindingHandle,
IN PNDIS_PACKET Packet)
{
PNDIS_PROTOCOL_HOOK Node;

Node = FindNDISNode(MacBindingHandle,2);
if(Node == NULL) return NDIS_STATUS_SUCCESS;

return Node->RealSendHandler(MacBindingHandle,Packet);
}

NDIS_STATUS NDISPostNt31ReceiveHandler(
IN NDIS_HANDLE ProtocolBindingContext,
IN NDIS_HANDLE MacReceiveContext,
IN PVOID HeaderBuffer,
IN UINT HeaderBufferSize,
IN PVOID LookAheadBuffer,
IN UINT LookAheadBufferSize,
IN UINT PacketSize)
{
PNDIS_PROTOCOL_HOOK Node;

Node = FindNDISNode(ProtocolBindingContext,1);
if(Node == NULL) return NDIS_STATUS_SUCCESS;

return Node->RealPostNt31ReceiveHandler(ProtocolBindingContext,MacReceiveContext,
HeaderBuffer,HeaderBufferSize,LookAheadBuffer,LookAheadBufferSize,PacketSize);
}
»Ø¸´´ËÂ¥

» ²ÂÄãϲ»¶

» ±¾Ö÷ÌâÏà¹Ø¼ÛÖµÌùÍÆ¼ö£¬¶ÔÄúͬÑùÓаïÖú:

ÒÑÔÄ   »Ø¸´´ËÂ¥   ¹Ø×¢TA ¸øTA·¢ÏûÏ¢ ËÍTAºì»¨ TAµÄ»ØÌû

nbjnh

ľ³æ (ÕýʽдÊÖ)

¡¾´ð°¸¡¿Ó¦Öú»ØÌû

¡ï ¡ï ¡ï ¡ï ¡ï
¸Ðл²ÎÓ룬ӦÖúÖ¸Êý +1
zhmindyx: ½ð±Ò+5, ¡ï¡ï¡ï¡ï¡ï×î¼Ñ´ð°¸ 2012-03-26 08:34:44
NTSTATUS HookExistingNDISProtocols(void)
{
UINT *ProtocolPtr;
NDIS_HANDLE hBogusProtocol = NULL;  //¶¨ÒåÒ»¸ö¼ÙЭÒéÖ¸Õë
PNDIS_OPEN_BLOCK OpenBlockPtr = NULL;
PNDIS_PROTOCOL_HOOK pNode;

hBogusProtocol = RegisterBogusNDISProtocol();//×¢²á¼ÙЭÒ飬ÒÔ»ñµÃЭÒéÁ´±íÖ¸Õë
if(hBogusProtocol == NULL) return STATUS_UNSUCCESSFUL;//ЭÒé×¢²á²»³É¹¦£¬ºóÃæµÄû·¨ÍæÁË£¬Í˳ö

ProtocolPtr = (UINT*)hBogusProtocol;
ProtocolPtr = (UINT*)((PBYTE)ProtocolPtr + sizeof(REFERENCE) + 8);
ProtocolPtr = (UINT*)(*ProtocolPtr);
//¹À¼ÆÂ¥Ö÷¿ÉÄÜÊÇ¿´²»¶®ÉÏÃæÈý¾ä£¡ÒªÁ˽âÉÏÃæÈý¾äÏÈÒªÇå³þNDIS_HANDLEµÄ½á¹¹¡£
//µÚ¶þ¾äÊÇËãÈ¡ndisProtocolListÖ¸ÕëλÖ㻵ÚÈý¾äÊÇÈ¡¸ÃЭÒéÁ´±íµÄµØÖ·
/*********************************************************************
struct PROTOCOL_HANDLE{
        LIST_ENTRY                protocolEntry;  // +sizeof(REFERENCE)
        ULONG                        UnKnown1[2];        // +8
        PLIST_ENTRY                ndisProtocolList;
        _NDIS50_PROTOCOL_CHARACTERISTICS Characteristics;
        _WORK_QUEUE_ITEM        Queue;
        KMUTEX                                Mutex;
        ULONG                                Unknown3[5];
        USHORT                                NameBuff[Characteristics->Name.Length+1];
};//±¾½á¹¹´ÓNdisRegisterProtocolÖÐÖ±½Óµ¼³ö£¬Ò²¿ÉÒÔÈÏΪNDIS_HANDLE½á¹¹
//Æäʵ¾ÍÊÇNDIS_OPEN_BLOCK½á¹¹¼´
struct _NDIS_PROTOCOL_BLOCK
{
PNDIS_OPEN_BLOCK        OpenQueue;
REFERENCE                        Ref;
UINT                                Length;
NDIS50_PROTOCOL_CHARACTERISTICS        ProtocolCharacteristics;
struct _NDIS_PROTOCOL_BLOCK                *NextProtocol;
ULONG        MaxPatternSize;
#if defined(NDIS_WRAPPER)
        struct _NDIS_PROTOCOL_FILTER * ProtocolFilter[NdisMediumMax+1];
        WORK_QUEUE_ITEM        WorkItem;
        KMUTEX                        Mutex;
        PKEVENT                        DeregEvent;
#endif
};
//²»¹ÜÊÇÄÄÒ»¸ö½á¹¹£¬×ÜÖ®ProtocolPtr×îºóÖ¸ÏòЭÒéÁ´±íµÄÆðµã¡£
*********************************************************************/
while(ProtocolPtr != NULL) {   //Ñ­»·´¦ÀíЭÒéÁ´±í
OpenBlockPtr = (PNDIS_OPEN_BLOCK)(*ProtocolPtr);//ȡһ¸öЭÒé
if(OpenBlockPtr != NULL) {//Èç¹ûЭÒ鲻Ϊ¿Õ
pNode = NewNDISNode();//´´½¨Ò»¸öнáµã£¬ÓÃÓÚ±£´æÔ­Ê¼Ð­ÒéÊý¾Ý£¬ÒÔ±¸»Ö¸´HOOK
if(pNode != NULL) {
pNode->ProtocolBindingContext = OpenBlockPtr->ProtocolBindingContext;
pNode->MacBindingContext = OpenBlockPtr->MacBindingHandle;
pNode->OpenBlockPtr = OpenBlockPtr;
pNode->RealSendHandler = OpenBlockPtr->SendHandler;
//How about WanSendHandler?
pNode->RealPostNt31ReceiveHandler = OpenBlockPtr->PostNt31ReceiveHandler;

InsertNDISNode(pNode);

OpenBlockPtr->SendHandler = NDISSendHandler;//ÐÞ¸ÄЭÒé·¢ËÍÀý³ÌÈë¿Ú
//How about WanSendHandler?
OpenBlockPtr->PostNt31ReceiveHandler = NDISPostNt31ReceiveHandler;//ÐÞ¸ÄЭÒé½ÓÊÕÀý³ÌÈë¿Ú
/****************************************************************************************
µ±Íø¿¨ÓÐÊý¾Ý°ü½øÈëʱ£¬»áͨ¹ý±íÖÐReceiveHandle»òReceivePacketHandler֪ͨЭÒéÇý¶¯³ÌÐòÓÐÒ»
¸ö¸ÃЭÒéµÄÊý¾Ý°ü½øÈ룬·´Ö®Ð­ÒéÇý¶¯³ÌÐòÊÇͨ¹ýSendHandler»òSendPacketsHandlerº¯ÊýÏòÍø¿¨Çý¶¯
·¢ËÍÊý¾Ý°üµ½ÍøÂçÉÏÈ¥µÄ¡£Ö»ÒªÄܹ»½«Ã¿Ò»¸öЭÒé³ÌÐòËùÌîдµÄÅÉ·¢º¯ÊýÖ¸Ïò×Ô¼ºµÄº¯Êý,¾ÍÄܳɹ¦µÄ
¶ÔÊý¾Ý°ü½øÐÐÀ¹½Ø¡£´ÓÉÏÃæÁ½¾ä´úÂëÀ´¿´£¬ËùÓÐЭÒéÊÕ¡¢·¢Àý³ÌÈ«²¿±»ÖØÐÂÖ¸Ïòµ½NDISSendHandler()
ºÍNDISPostNt31ReceiveHandler()º¯ÊýÖУ¬ÄÇôËùÓеĹýÂ˹¤×÷½«ÔÚÕâÁ½¸öº¯ÊýÖÐÍê³É£¬²¢ÇÒÍê³É¹ýÂË
ºó£¬ÔÙ½«Êý¾Ý°üת¸øÔ­À´µÄÀý³Ì½øÐд¦Àí¡£
*****************************************************************************************/
}
}
ProtocolPtr = (UINT*)((PBYTE)ProtocolPtr + sizeof(REFERENCE) + 8);
ProtocolPtr = (UINT*)(*ProtocolPtr);
//ÉÏÃæÁ½¾ä£¬¼ÆËãÏÂÒ»¸öЭÒéÈë¿Ú¡£
}

DeregisterBogusNDISProtocol(hBogusProtocol);

return STATUS_SUCCESS;
}

NDIS_STATUS NDISSendHandler(
IN NDIS_HANDLE MacBindingHandle,
IN PNDIS_PACKET Packet)
{
PNDIS_PROTOCOL_HOOK Node;

Node = FindNDISNode(MacBindingHandle,2);
if(Node == NULL) return NDIS_STATUS_SUCCESS;

return Node->RealSendHandler(MacBindingHandle,Packet);
//·¢ËÍÀý³ÌûÓÐ×öÈκδ¦Àí£¬Ö±½Ó½«Êý¾Ý°ü´«¸ø±£´æÔÚNodeÖеÄÔ­Àý³Ì´¦Àí¡£
//µ±È»£¬Èç¹ûÐèÒª×ö¹ýÂ˵ϰ£¬Ò²¿ÉÒÔÌí´úÂë¡£
}

NDIS_STATUS NDISPostNt31ReceiveHandler(
IN NDIS_HANDLE ProtocolBindingContext,
IN NDIS_HANDLE MacReceiveContext,
IN PVOID HeaderBuffer,
IN UINT HeaderBufferSize,
IN PVOID LookAheadBuffer,
IN UINT LookAheadBufferSize,
IN UINT PacketSize)
{
PNDIS_PROTOCOL_HOOK Node;

Node = FindNDISNode(ProtocolBindingContext,1);
if(Node == NULL) return NDIS_STATUS_SUCCESS;

return Node->RealPostNt31ReceiveHandler(ProtocolBindingContext,MacReceiveContext,
HeaderBuffer,HeaderBufferSize,LookAheadBuffer,LookAheadBufferSize,PacketSize);
//ÊÕµ½µÄ°ü³öûÓд¦Àí£¬Ò²ÊÇÖ±½Ó´«¸øÔ­Àý³Ì´¦ÀíµÄ£¬×Ô¼º¼Ó¹ýÂË´úÂë°É¡£¿´Ñù×ÓÓ¦¸ÃÊÇÒ»¸ö
//·À»ðǽµÄ¿ò¼Ü³ÌÐò¡£
}
²»¿É³Ëϲ¶øÇáŵ£¬²»¿ÉÒò×í¶øÉúàÁ£¬²»¿É³Ë¿ì¶ø¶àÊ£¬²»¿ÉÒò¾ë¶øÏÊÖÕ¡£
3Â¥2012-03-22 09:15:37
ÒÑÔÄ   »Ø¸´´ËÂ¥   ¹Ø×¢TA ¸øTA·¢ÏûÏ¢ ËÍTAºì»¨ TAµÄ»ØÌû
²é¿´È«²¿ 3 ¸ö»Ø´ð

cmdblock

Òø³æ (ÕýʽдÊÖ)

¡¾´ð°¸¡¿Ó¦Öú»ØÌû

¸Ðл²ÎÓ룬ӦÖúÖ¸Êý +1
Õâô¶ÌСµÄ´úÂë¿ÉÒÔÓÃC++×Ô¶¯Éú³ÉÁ÷³ÌͼµÄÈí¼þÀ´½â¾ö
2Â¥2012-03-21 10:19:55
ÒÑÔÄ   »Ø¸´´ËÂ¥   ¹Ø×¢TA ¸øTA·¢ÏûÏ¢ ËÍTAºì»¨ TAµÄ»ØÌû
×î¾ßÈËÆøÈÈÌûÍÆ¼ö [²é¿´È«²¿] ×÷Õß »Ø/¿´ ×îºó·¢±í
[¿¼ÑÐ] 349Çóµ÷¼Á +4 ½Ü˹ËþÀï˹ 2026-03-21 4/200 2026-03-26 23:11 by ²»³Ôô~µÄ؈
[¿¼ÑÐ] 071000ÉúÎïѧÇóµ÷¼Á£¬³õÊԳɼ¨343 +6 ССÌðÃæÍÅ 2026-03-25 6/300 2026-03-26 23:01 by ²»³Ôô~µÄ؈
[¿¼ÑÐ] 333Çóµ÷¼Á +7 87639 2026-03-21 12/600 2026-03-26 22:08 by ²»³Ôô~µÄ؈
[¿¼ÑÐ] Çóµ÷¼Á +6 °×QF 2026-03-21 6/300 2026-03-26 20:37 by fmesaito
[¿¼ÑÐ] ¡¾Ë«Ò»Á÷ԺУÐÂÄÜÔ´¡¢»·¾³²ÄÁÏ£¬²ÄÁϼӹ¤ÓëÄ£ÄâÕÐÊÕ´óÁ¿µ÷¼Á¡¿ +4 Higraduate 2026-03-22 8/400 2026-03-26 20:34 by Higraduate
[¿¼ÑÐ] ÉúÎïѧѧ˶£¬Ò»Ö¾Ô¸ºþÄÏ´óѧ£¬³õÊԳɼ¨338 +4 YYYYYNNNNN 2026-03-26 4/200 2026-03-26 19:00 by macy2011
[¿¼ÑÐ] 312Çóµ÷¼Á +8 Éϰ¶°ÉZJY 2026-03-22 12/600 2026-03-26 18:49 by muchong357
[¿¼ÑÐ] ²ÄÁÏ277Çóµ÷¼Á +5 min3 2026-03-24 5/250 2026-03-26 15:13 by zzll406
[²ÄÁϹ¤³Ì] Ò»Ö¾Ô¸C9²ÄÁÏÓ뻯¹¤×¨Òµ×Ü·Ö300Çóµ÷¼Á +5 Âü111 2026-03-24 6/300 2026-03-26 13:04 by 13756423260
[¿¼ÑÐ] »·¾³×¨Ë¶324·ÖÇóµ÷¼ÁÍÆ¼ö +5 ÐùСÄþ¡ª¡ª 2026-03-26 5/250 2026-03-26 12:05 by i_cooler
[¿¼ÑÐ] ´ò¹ýºÜ¶à¾ºÈü£¬085406¿ØÖƹ¤³Ì300·Ö£¬Çóµ÷¼Á +3 askeladz 2026-03-26 3/150 2026-03-26 09:08 by ¸øÄãÄã×¢ÒâÐÝÏ¢
[¿¼ÑÐ] 290·Öµ÷¼ÁÇóÖú +3 ¼ªÏéÖ¹Ö¹³Â 2026-03-25 3/150 2026-03-25 19:58 by barlinike
[¿¼ÑÐ] 0703»¯Ñ§µ÷¼Á£¬Çóµ¼Ê¦ÊÕ +7 ÌìÌìºÃÔËÀ´Éϰ¶° 2026-03-24 7/350 2026-03-24 20:26 by peike
[¿¼ÑÐ] ²ÄÁÏ¿¼Ñе÷¼ÁÉú +3 »ÆÁ»Ò»ÃÎǧÄê 2026-03-24 3/150 2026-03-24 17:00 by barlinike
[¿¼ÑÐ] 277·ÖÇóµ÷¼Á£¬¿çµ÷²ÄÁÏ +3 ¿¼Ñе÷¼Álxh 2026-03-24 3/150 2026-03-24 13:52 by JourneyLucky
[»ù½ðÉêÇë] Çë½ÌÏ´ó¼Ò 2026Äê¹ú¼Ò»ù½ðÉêÇëÊÇ˫äÉóÂ𣿠+3 lishucheng1 2026-03-22 5/250 2026-03-24 08:22 by gltch
[¿¼ÑÐ] һ־Ըɽ¶«´óѧҩѧѧ˶Çóµ÷¼Á +3 ¿ª¿ªÐÄÐÄû·³ÄÕ 2026-03-23 4/200 2026-03-24 00:06 by ¿ª¿ªÐÄÐÄû·³ÄÕ
[¿¼ÑÐ] 311Çóµ÷¼Á +3 26ÑÐ0 2026-03-20 3/150 2026-03-22 14:46 by ColorlessPI
[¿¼ÑÐ] Çóµ÷¼Á +5 Zhangbod 2026-03-21 7/350 2026-03-22 13:13 by Zhangbod
[¿¼ÑÐ] Ò»Ö¾Ô¸ÄÏÀí¹¤085701»·¾³302Çóµ÷¼ÁԺУ +3 ¿ûè÷ÎÀ¶Ó 2026-03-20 3/150 2026-03-20 19:28 by zhukairuo
ÐÅÏ¢Ìáʾ
ÇëÌî´¦ÀíÒâ¼û