|
|
 |
 |
|
|
|
|
|
sniffer技术原理及应用(1)
|
|
|
|
编辑：华夏媒体 作者：未知 来源：网络 时间：2006-07-29 总浏览量：1530 |
|
文字大小：[ 大 中 小 ]
文字颜色： 双击滚屏/单击停止 |
|
[上一页] [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [下一页]
|
PF_SET_EXTENSION_HOOK_INFO filterData;
KEVENT event;
IO_STATUS_BLOCK ioStatus;
PIRP irp;
//首先获得一个设备指针。
//first of all, we have to get a pointer to IpFilterDriver Device
RtlInitUnicodeString(&filterName, DD_IPFLTRDRVR_DEVICE_NAME);
status = IoGetDeviceObjectPointer(&filterName,STANDARD_RIGHTS_ALL,
&ipFileObject, &ipDeviceObject);
if(NT_SUCCESS(status))
{
//一些初始化工作，填充filterData。
//initialize the struct with functions parameters
filterData.ExtensionPointer = filterFunction;
//we need initialize the event used later by the IpFilterDriver to
signal us
//when it finished its work
KeInitializeEvent(&event, NotificationEvent, FALSE);
//这个就是最重要的注册回调函数过程。DDK中具体讲述是这样的
//IOCTL_PF_SET_EXTENSION_POINTER registers filter-hook callback functions to
the IP filter driver
//to inform the IP filter driver to call those filter hook callbacks for every IP packet
//that is received or transmitted. Also, IOCTL_PF_SET_EXTENSION_POINTER
clears filter-hook
//callback functions from the IP filter driver. （看到了吧，最后一句话，注册新的回调函
数，就将原先的清除掉了，
//所以说系统中只存在一个这样的驱动有用。）
//we build the irp needed to establish fitler function这个地方仅
仅是生成这样的IRP，并没有注册
irp =
IoBuildDeviceIoControlRequest(IOCTL_PF_SET_EXTENSION_POINTER,
ipDeviceObject,
(PVOID) &filterData,
sizeof(PF_SET_EXTENSION_HOOK_INFO),
NULL,
0,
FALSE,
&event,
&ioStatus);
if(irp != NULL)
{
// we send the IRP
//这个地方才是真正的注册呀。
status = IoCallDriver(ipDeviceObject, irp);
//and finally, we wait for "acknowledge" of
IpDriverFilter
if (status == STATUS_PENDING)
{
waitStatus = KeWaitForSingleObject(&event,
Executive, KernelMode, FALSE, NULL);
if (waitStatus != STATUS_SUCCESS )
{}
}
status = ioStatus.Status;
if(!NT_SUCCESS(status)){}
}
else
{
//if we cant allocate the space, we return the
|
|
[上一页] [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [下一页]
|
|
|
打印 收藏 关闭 至顶部 |
|
 |
|