ndis filter drivers指南.pdf

NDIS Filter Drivers

SamllBug

2010/10/18

1 NDISFilterDrivers ..................................................................................................... 4 1.1 FilterDrivers ..................................................................................................... 4 1.2 FilterDrivers ..................................................................................................... 5 1.3 FilterDrivers ..................................................................................................... 5 1.4 MandatoryFilterDrivers ............................................................................................ 6

2 NDISFilterDrivers ..................................................................................................... 7 2.1 FilterDriver..................................................................................................... 7 2.2 FilterDrivers ..................................................................................................... 11 2.3 FilterModule ...................................................................................... 12 2.4 FilterModule.................................................................................................... 14 2.5 FilterModule.................................................................................................... 18 2.6 FilterModule........................................................................................ 20 2.6.1 FilterModule ............................................................................................ 20 2.6.2 FilterModule ............................................................................................ 24

2.7 DataBypassMode.................................................................................................... 26

2.8 FilterDriver........................................................................................... 26 2.9 FilterModule ........................................................................................ 27 2.9.1 FilterDriver ............................................................................... 27 2.9.2 FilterDriver ............................................................................... 28 2.9.3 FilterDriver ............................................................... 30 2.9.4 FilterDriver ............................................................................... 31

2.10 FilterModuleOID ............................................................................................. 33 2.10.1 FilterDriverOID ..................................................................... 33 2.10.2 FilterDriverOID ......................................................................... 34 2.10.3 FilterModuleOIDDirectOIDRequest ................................... 35

2.11 FilterModulePnP..................................................................................... 36 2.12 FilterModule .......................................................................................... 37

3 NDISFilterDrivers ................................................................................................... 37

3.1 FilterDriver................................................................................... 38 3.2 FilterDriverINF ..................................................................................... 39 3.2.1 MonitoringFilterDriverINF .......................................................... 39 3.2.2 ModifyingFilterDriverINF ............................................................ 42

3.3 FilterDriver....................................................................................... 45 4 ................................................................................................................................. 46 4.1 NET_BUFFER ............................................................................................. 46 4.1.1 .................................................................................................. 46 4.1.2 RetreatAdvance .................................................................................... 52 4.1.3 ...................................................................................................... 54 4.1.4 IRQL................................................................................................... 54 4.1.5 .............................................................................................. 55 4.1.6 .................................................................................. 61 4.1.7 NET_BUFFER_LIST............................................................................. 62

4.2 NDIS .................................................................................................. 66 4.2.1 NDIS ...................................................................................... 66 4.2.2 NDIS ...................................................................... 66 4.2.3 NDIS ...................................................................................... 67 4.2.4 NDIS .................................................................................................. 67 4.2.5 NDIS WMI ............................................................................ 67

DDK

[email protected]

1 NDISFilterDriversFilterDriversMiniportDriversfilteringservice

NDISMiniportDriversProtocolDriversFilter DriversNDISDDKMSDNDriver StackManagement

FilterDrivers1) 2) FilterDrivers

1.1 FilterDrivers FilterDrivers :1) FilterDriversFilterModuleFilterModule

FilterDrivers FilterModule2) FilterModule

3) FilterModuleintermediatedriver

(miniportadapter) FilterModule (miniportadapter)Becausefilterdriversdo not implement virtual miniports like an intermediate driver, filter drivers are not

associatedwithadeviceobject.Aminiportadapterwithoverlyingfiltermodulesfunctionsas

amodifiedversionoftheminiportadapter.4) NDIS FilterModule5) NDIS FilterModule

6) NDIS FilterModule7) FilterDrivers FilterModule

(Filter modules are not associated with any particular binding between overlyingprotocoldriversandtheminiportadapter.)

8) FilterDrivers Filterdriverscanselecttheservicesthatarefilteredandcanbebypassedforthe services that arenot filtered.The selectionof the services that arebypassed and the

servicesthatarefilteredcanbereconfigureddynamically.9) NDIS FilterDrivers COPY

1.2 FilterDrivers FilterDrivers 1) 2) 3) 4) OID 5) OID6) OID 7) 8) 9)

1.3 FilterDrivers FilterDrivers1) Monitoring

MonitoringFilterDrivers

2) Modifying

The type ofmodificationisdriverspecific INF FilterType 0x00000001 monitoringfilter

0x00000002 modifyingfilter mandatory( INF)

modifyingfilter mandatory Filter

1.4 MandatoryFilterDriversMandatory Filter Drivers

MandatoryFilterModuleModifyingMonitoringFilterDrivers Mandatory filterintermediatedriversMandatory

MandatoryFilterDriversNDIS FilterModule FilterDrivers

MandatoryFilterDriversNDIS FilterModule optionalFilterDrivers FilterDriversMandatory FilterDriversNDIS

Mandatory Filter Drivers miniportadapter NDIS

INF Mandatory Optional INF FilterRunType 0x00000001 Mandatory 0x00000002 Optional

DDK filter INF;

;Ndiinstallationsupport

;

[Inst_Ndi]

HKR,Ndi,Service,,"NdisMon"

HKR,Ndi,CoServices,0x00010000,"NdisMon"

HKR,Ndi,HelpText,,%NdisMon_HelpText%

HKR,Ndi,FilterClass,,compression

HKR,Ndi,FilterType,0x00010001,0x00000001

HKR,Ndi\Interfaces,UpperRange,,"noupper"

HKR,Ndi\Interfaces,LowerRange,,"nolower"

HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"

HKR,Ndi,FilterRunType,0x00010001,1

Modifying filter MandatoryFilterDrivers INF DDK

2 NDISFilterDrivers Filter MiniportDrivers ProtocolDrivers

DDK FilterDrivers

2.1 FilterDriver FilterDriverFilterDreivers

Filter Drivers Miniport Drivers miniportadatpter FilterDrivers FilterDrivers NDIS FilterModule

FilterDrivers DDK StartingaDriverStack

FilterDrivers DriverEntry DriverEntry NdisFRegisterFilterDriver FilterXXX NdisFRegisterFilterDriver STATUS_SUCCESS DriverEntry

1 I/O 2 FilterDrivers DriverEntry DriverObject NdisFRegisterFilterDriver NDIS

NDISFilterDriverFilterDrivers Filter Drivers DriverEntry NdisFRegisterFilterDriver

FilterXXX NDIS_FILTER_DRIVER_CHARACTERISTICS NdisFRegisterFilterDriver FilterCharacteristics NDIS_FILTER_DRIVER_CHARACTERISTICSMandatory Optional FilterXXX Optional BYPASS

NdisFRegisterFilterDriver :NDIS_STATUS

NdisFRegisterFilterDriver(

IN PDRIVER_OBJECT DriverObject,

IN NDIS_HANDLE FilterDriverContext,

IN PNDIS_FILTER_DRIVER_CHARACTERISTICS FilterCharacteristics,

OUT PNDIS_HANDLE NdisFilterDriverHandle

);

NDIS_FILTER_DRIVER_CHARACTERISTICStypedef struct _NDIS_FILTER_DRIVER_CHARACTERISTICS { NDIS_OBJECT_HEADER Header; UCHAR MajorNdisVersion; UCHAR MinorNdisVersion; UCHAR MajorDriverVersion; UCHAR MinorDriverVersion;

ULONG Flags; NDIS_STRING FriendlyName; NDIS_STRING UniqueName; NDIS_STRING ServiceName; SET_OPTIONS_HANDLER SetOptionsHandler; FILTER_SET_FILTER_MODULE_OPTIONS_HANDLER SetFilterModuleOptionsHandler; FILTER_ATTACH_HANDLER AttachHandler; FILTER_DETACH_HANDLER DetachHandler; FILTER_RESTART_HANDLER RestartHandler; FILTER_PAUSE_HANDLER PauseHandler; FILTER_SEND_NET_BUFFER_LISTS_HANDLER SendNetBufferListsHandler; FILTER_SEND_NET_BUFFER_LISTS_COMPLETE_HANDLER SendNetBufferListsCompleteHandler; FILTER_CANCEL_SEND_HANDLER CancelSendNetBufferListsHandler; FILTER_RECEIVE_NET_BUFFER_LISTS_HANDLER ReceiveNetBufferListsHandler; FILTER_RETURN_NET_BUFFER_LISTS_HANDLER ReturnNetBufferListsHandler; FILTER_OID_REQUEST_HANDLER OidRequestHandler; FILTER_OID_REQUEST_COMPLETE_HANDLER OidRequestCompleteHandler; FILTER_CANCEL_OID_REQUEST_HANDLER CancelOidRequestHandler; FILTER_DEVICE_PNP_EVENT_NOTIFY_HANDLER DevicePnPEventNotifyHandler; FILTER_NET_PNP_EVENT_HANDLER NetPnPEventHandler; FILTER_STATUS_HANDLER StatusHandler; FILTER_DIRECT_OID_REQUEST_HANDLER DirectOidRequestHandler; FILTER_DIRECT_OID_REQUEST_COMPLETE_HANDLER DirectOidRequestCompleteHandler; FILTER_CANCEL_DIRECT_OID_REQUEST_HANDLER CancelDirectOidRequestHandler; } NDIS_FILTER_DRIVER_CHARACTERISTICS, *PNDIS_FILTER_DRIVER_CHARACTERISTICS;

NDIS_FILTER_DRIVER_CHARACTERISTICS Mandatory

FilterAttach

FilterDetach

FilterRestart

FilterPause

NDIS_FILTER_DRIVER_CHARACTERISTICS Optional

FilterSetOptions

FilterSetModuleOptions

FilterOidRequest

FilterOidRequestComplete

FilterStatus

FilterNetPnPEvent

FilterDevicePnPEventNotify

FilterCancelSendNetBufferLists

NDIS_FILTER_DRIVER_CHARACTERISTICS Optional

FilterSendNetBufferLists

FilterSendNetBufferListsComplete

FilterReturnNetBufferLists

FilterReceiveNetBufferLists

NDIS_FILTER_PARTIAL_CHARACTERISTICS FilterSetModuleOptions NdisSetOptionalHandles FilterDrivers FilterSetModuleOpitons FilterModule

NdisFRegisterFilterDriver NDIS NdisFilterDriverHandle Filter DriverFilter Driver NDIS NdisFDeregisterFilterDriver NdisFDeregisterFilterDriver

FilterSetOptions FilterMoudle DetachedNDIS FilterSetPtions FilterAttach Filter Module FilterAttach

Filter Drivers DriverEntry FilterDriverUnload DDK DriverEntry NDIS_STATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath ) { NDIS_STATUS Status; NDIS_FILTER_DRIVER_CHARACTERISTICS FChars; NDIS_STRING ServiceName; NDIS_STRING UniqueName; NDIS_STRING FriendlyName; DEBUGP(DL_TRACE,("===>DriverEntry...\n")); RtlInitUnicodeString(&ServiceName, FILTER_SERVICE_NAME); RtlInitUnicodeString(&FriendlyName, FILTER_FRIENDLY_NAME);

RtlInitUnicodeString(&UniqueName, FILTER_UNIQUE_NAME); FilterDriverObject = DriverObject; do { NdisZeroMemory(&FChars, sizeof(NDIS_FILTER_DRIVER_CHARACTERISTICS)); FChars.Header.Type = NDIS_OBJECT_TYPE_FILTER_DRIVER_CHARACTERISTICS; FChars.Header.Size = sizeof(NDIS_FILTER_DRIVER_CHARACTERISTICS); FChars.Header.Revision = NDIS_FILTER_CHARACTERISTICS_REVISION_1; FChars.MajorNdisVersion = FILTER_MAJOR_NDIS_VERSION; FChars.MinorNdisVersion = FILTER_MINOR_NDIS_VERSION; FChars.MajorDriverVersion = 1; FChars.MinorDriverVersion = 0; FChars.Flags = 0; FChars.FriendlyName = FriendlyName; FChars.UniqueName = UniqueName; FChars.ServiceName = ServiceName; // // for the time being, there is no additional options to register // but let's have this handler anyway // FChars.SetOptionsHandler = FilterRegisterOptions; FChars.AttachHandler = FilterAttach; FChars.DetachHandler = FilterDetach; FChars.RestartHandler = FilterRestart; FChars.PauseHandler = FilterPause; FChars.SetFilterModuleOptionsHandler = FilterSetModuleOptions; FChars.OidRequestHandler = FilterOidRequest; FChars.OidRequestCompleteHandler = FilterOidRequestComplete; FChars.CancelOidRequestHandler = FilterCancelOidRequest; FChars.SendNetBufferListsHandler = FilterSendNetBufferLists; FChars.ReturnNetBufferListsHandler = FilterReturnNetBufferLists; FChars.SendNetBufferListsCompleteHandler = FilterSendNetBufferListsComplete; FChars.ReceiveNetBufferListsHandler = FilterReceiveNetBufferLists; FChars.DevicePnPEventNotifyHandler = FilterDevicePnPEventNotify; FChars.NetPnPEventHandler = FilterNetPnPEvent; FChars.StatusHandler = FilterStatus; FChars.CancelSendNetBufferListsHandler = FilterCancelSendNetBufferLists; DriverObject->DriverUnload = FilterUnload;

FilterDriverHandle = NULL; FILTER_INIT_LOCK(&FilterListLock); InitializeListHead(&FilterModuleList); Status = NdisFRegisterFilterDriver(DriverObject, (NDIS_HANDLE)FilterDriverObject, &FChars, &FilterDriverHandle); if (Status != NDIS_STATUS_SUCCESS) { DEBUGP(DL_WARN, ("MSFilter: Register filter driver failed.\n")); break; } // // Initilize spin locks // Status = FilterRegisterDevice(); if (Status != NDIS_STATUS_SUCCESS) { NdisFDeregisterFilterDriver(FilterDriverHandle); FILTER_FREE_LOCK(&FilterListLock); DEBUGP(DL_WARN, ("MSFilter: Register device for the filter driver failed.\n")); break; } } while(FALSE); DEBUGP(DL_TRACE, ("

MiniportAdapter Unload FilterDrivers Unload FilterDriverUnload

FilterDriverUnload Filter Driver FilterDriverUnload FilterDriver

Filter Driver FilterDriverUnload NdisFDeregisterFilterDriver NdisFRegisterFilterDriver

FilterDetach FilterDriver FilterModule FilterDriverUnload DDK filter FilterDriverUnload VOID FilterUnload( IN PDRIVER_OBJECT DriverObject ) { DEBUGP(DL_TRACE, ("===>FilterUnload\n")); // // Should free the filter context list // FilterDeregisterDevice(); NdisFDeregisterFilterDriver(FilterDriverHandle); #if DBG FILTER_ACQUIRE_LOCK(&FilterListLock, FALSE); ASSERT(IsListEmpty(&FilterModuleList)); FILTER_RELEASE_LOCK(&FilterListLock, FALSE); #endif FILTER_FREE_LOCK(&FilterListLock); DEBUGP(DL_TRACE, ("

FilterDriver FilterModule3 Paused

FilterDriver4 Restarting

Filter Driver Filter Module

5 Running FilterDriver FilterModule

6 Pauseing Filter Driver Filter Module

FilterModule/

Event/State Detached Attaching Paused Restarting Running Pausing

FilterAttach Attaching

Attachis

complete

Paused

FilterDetach Detached

FilterRestart Restarting

Restartis

complete

Running

FilterPause Pausing

Pauseis

complete

Paused

Attachfailed Detached

Restart

failed

Paused

Sendand

Receive

Running Pausing

OID Paused Restarting Running Pausing

Requests

1 FilterAttach

NDIS FilterAttach FilterModule2 Attachiscomplete

FilterModule Attaching FilterDriver FilterModuleFilterModule Paused

3 FilterDetach NDIS Filter Driver FilterDetach Filter Module

4 FilterRestart NDIS FilterDriver FilterRestart FilterModue

5 Restartiscomplete FilterModule RestartingFilterModuel Running

6 FilterPause NDIS FilterDriver FilterPause FilterModule

7 Pauseiscomplete Filter Driver Filter Module Paused

8 Attachfail NDIS FilterAttach Filter Module Detached

9 Restartfail NDIS FilterRestart FilterModule Paused

10 SendandReceiveOperationsFilterModule Pauseing Running

11 OIDRequestsFilterModule RunnigRestartingPaused Pauseing OID

2.4 FilterModule FilterModuleNDIS FilterDriver FilterAttach

FilterAttach FilterModule Attaching FilterAttach DDK NDIS_STATUS

FilterAttach( IN NDIS_HANDLE NdisFilterHandle, IN NDIS_HANDLE FilterDriverContext,

IN PNDIS_FILTER_ATTACH_PARAMETERS AttachParameters );

NDIS NdisFilterHandle Filter Driver NdisXXX FilterModuleOID FilterModule Attaching1 FilterModule2 NDIS FilterAttach NdisFilterHandle NdisFSetAttributes

NdisFSetAttributes FilterModuleContext FilterModule NdisFRegisterFilterDriver FilterDriverContext NDIS Filter Drivers FilterXXX FilterAttach FilterDriverContext NdisFRegisterFilterDriver FilterDriverContext NdisFSetAttributes DDKNDIS_STATUS

NdisFSetAttributes( IN NDIS_HANDLE NdisFilterHandle, IN NDIS_HANDLE FilterModuleContext, IN PNDIS_FILTER_ATTRIBUTES FilterAttributes );

3 FilterModule4 FilterModule Paused 5 Detached6 NDIS_STATUS_SUCCESS NDIS

FilterModule FilterDriverOptionalMandatory FilterAtt ch NDIS FilterDriver Attaching OID

Running PauseingOID PausedRestartingRunning Pauseing NDIS FilterDetach FilterAttach Filter Module Filter Module DDK filter FilterAttach NDIS_STATUS FilterAttach( IN NDIS_HANDLE NdisFilterHandle, IN NDIS_HANDLE FilterDriverContext, IN PNDIS_FILTER_ATTACH_PARAMETERS AttachParameters ) { PMS_FILTER pFilter = NULL; NDIS_STATUS Status = NDIS_STATUS_SUCCESS; PFL_NDIS_FILTER_LIST FilterHandleEntry; NDIS_FILTER_ATTRIBUTES FilterAttributes; ULONG Size;

DEBUGP(DL_TRACE, ("===>FilterAttach: NdisFilterHandle %p\n", NdisFilterHandle)); do { ASSERT(FilterDriverContext == (NDIS_HANDLE)FilterDriverObject); if (FilterDriverContext != (NDIS_HANDLE)FilterDriverObject) { Status = NDIS_STATUS_INVALID_PARAMETER; break; } if (AttachParameters->MiniportMediaType != NdisMedium802_3) { DEBUGP(DL_ERROR, ("MSFilter: Doesn't support media type other than NdisMedium802_3.\n")); Status = NDIS_STATUS_INVALID_PARAMETER; break; } Size = sizeof(MS_FILTER) + AttachParameters->FilterModuleGuidName->Length + AttachParameters->BaseMiniportInstanceName->Length + AttachParameters->BaseMiniportName->Length; pFilter = (PMS_FILTER)FILTER_ALLOC_MEM(NdisFilterHandle, Size); if (pFilter == NULL) { DEBUGP(DL_WARN, ("MSFilter: Failed to allocate context structure.\n")); Status = NDIS_STATUS_RESOURCES; break; } NdisZeroMemory(pFilter, sizeof(MS_FILTER)); pFilter->FilterModuleName.Length = pFilter->FilterModuleName.MaximumLength = AttachParameters->FilterModuleGuidName->Length; pFilter->FilterModuleName.Buffer = (PWSTR)((PUCHAR)pFilter + sizeof(MS_FILTER)); NdisMoveMemory(pFilter->FilterModuleName.Buffer, AttachParameters->FilterModuleGuidName->Buffer,

pFilter->FilterModuleName.Length); pFilter->MiniportFriendlyName.Length = pFilter->MiniportFriendlyName.MaximumLength = AttachParameters->BaseMiniportInstanceName->Length; pFilter->MiniportFriendlyName.Buffer = (PWSTR)((PUCHAR)pFilter->FilterModuleName.Buffer + pFilter->FilterModuleName.Length); NdisMoveMemory(pFilter->MiniportFriendlyName.Buffer, AttachParameters->BaseMiniportInstanceName->Buffer, pFilter->MiniportFriendlyName.Length); pFilter->MiniportName.Length = pFilter->MiniportName.MaximumLength = AttachParameters->BaseMiniportName->Length; pFilter->MiniportName.Buffer = (PWSTR)((PUCHAR)pFilter->MiniportFriendlyName.Buffer + pFilter->MiniportFriendlyName.Length); NdisMoveMemory(pFilter->MiniportName.Buffer, AttachParameters->BaseMiniportName->Buffer, pFilter->MiniportName.Length); pFilter->MiniportIfIndex = AttachParameters->BaseMiniportIfIndex; // // The filter should intialize NoTrackReceives and NoTrackSends properly, for this // driver, since its default characteristic has both send and receive handler, they // are initiazed to FALSE. // pFilter->TrackReceives = TRUE; pFilter->TrackSends = TRUE; pFilter->FilterHandle = NdisFilterHandle; NdisZeroMemory(&FilterAttributes, sizeof(NDIS_FILTER_ATTRIBUTES)); FilterAttributes.Header.Revision = NDIS_FILTER_ATTRIBUTES_REVISION_1; FilterAttributes.Header.Size = sizeof(NDIS_FILTER_ATTRIBUTES); FilterAttributes.Header.Type = NDIS_OBJECT_TYPE_FILTER_ATTRIBUTES; FilterAttributes.Flags = 0;

Status = NdisFSetAttributes(NdisFilterHandle, pFilter, &FilterAttributes); if (Status != NDIS_STATUS_SUCCESS) { DEBUGP(DL_WARN, ("MSFilter: Failed to set attributes.\n")); break; } pFilter->State = FilterPaused; FILTER_ACQUIRE_LOCK(&FilterListLock, FALSE); InsertHeadList(&FilterModuleList, &pFilter->FilterModuleLink); FILTER_RELEASE_LOCK(&FilterListLock, FALSE); } while (FALSE); if (Status != NDIS_STATUS_SUCCESS) { if (pFilter != NULL) { FILTER_FREE_MEM(pFilter); } } DEBUGP(DL_TRACE, ("

{ PMS_FILTER pFilter = (PMS_FILTER)FilterModuleContext; PFL_NDIS_FILTER_LIST pEntry; PLIST_ENTRY pLink; DEBUGP(DL_TRACE, ("===>FilterDetach: FilterInstance %p\n", FilterModuleContext)); // // Filter must be in paused state // FILTER_ASSERT(pFilter->State == FilterPaused); // // Don't come up anything that would prevent the filter from detaching // // // Free filter instance name if allocated. // if (pFilter->FilterName.Buffer != NULL) { FILTER_FREE_MEM(pFilter->FilterName.Buffer); } FILTER_ACQUIRE_LOCK(&FilterListLock, FALSE); RemoveEntryList(&pFilter->FilterModuleLink); FILTER_RELEASE_LOCK(&FilterListLock, FALSE); // // Free the memory allocated FILTER_FREE_MEM(pFilter); // // Alway return success // DEBUGP(DL_TRACE, ("

}

2.6 FilterModule NDIS Filter Module Filter Module

NDIS Paused FilterModule Running FilterModule Paused FilterModule

2.6.1 FilterModule

Paused FilterModule FilterSetModuleOptions FilterRestart FilterModule FilterRestart Restarting FilterDriver FilterSetModuleOptions FilterModule DataBypassModel

Filter Driver FilterRestart NDIS FilterRestartParameters RestartAttributes NDIS_RESTART_ATTRIBUTES FilterDrivers DDK FilterRestart

Filter Module FilterRestart FilterSetModuleOptions .

NDIS Filter Module FilterModule Restarting1 2 FilterModule3 4 5 NdisFSendNetBufferListsComplete FilterSendNetBufferLists

NET_BUFFER_LIST NDIS_STATUS_PAUSED6 NdisFIndicateStatus 7 OID 8 9 NdisFReturnNetBufferLists

10 OID 11 FilterStatus12 NDIS_STATUS_SUCCESS FilterModule

Mandatory FilterDriver NDIS FilterDriverFilterDriver

NDIS_STATUS_SUCCESS NDIS_STATUS_PENDING NDIS_STATUS_PENDING NdisFRestartComplete NdisFRestartComplete ()

FilterModule Running Filter Driver FilterRestart NDISNdis FilterModule Running DDK Filter FilterRestart NDIS_STATUS FilterRestart( IN NDIS_HANDLE FilterModuleContext, IN PNDIS_FILTER_RESTART_PARAMETERS RestartParameters ) { NDIS_STATUS Status; PMS_FILTER pFilter = (PMS_FILTER)FilterModuleContext; // BUGBUG, the cast may be wrong NDIS_HANDLE ConfigurationHandle = NULL; PNDIS_RESTART_GENERAL_ATTRIBUTES NdisGeneralAttributes; PNDIS_RESTART_ATTRIBUTES NdisRestartAttributes; NDIS_CONFIGURATION_OBJECT ConfigObject; DEBUGP(DL_TRACE, ("===>FilterRestart: FilterModuleContext %p\n", FilterModuleContext)); FILTER_ASSERT(pFilter->State == FilterPaused); ConfigObject.Header.Type = NDIS_OBJECT_TYPE_CONFIGURATION_OBJECT; ConfigObject.Header.Revision = NDIS_CONFIGURATION_OBJECT_REVISION_1; ConfigObject.Header.Size = sizeof(NDIS_CONFIGURATION_OBJECT); ConfigObject.NdisHandle = FilterDriverHandle; ConfigObject.Flags = 0; Status = NdisOpenConfigurationEx(&ConfigObject, &ConfigurationHandle); if (Status != NDIS_STATUS_SUCCESS) { // // Filter driver can choose to fail the restart if it cannot open the configuration // #if 0 // // The code is here just to demonstrate how to call NDIS to write an eventlog. If drivers need to write // an event log.

// PWCHAR ErrorString = L"NdisMon"; DEBUGP(DL_WARN, ("FilterRestart: Cannot open configuration.\n")); NdisWriteEventLogEntry(FilterDriverObject, EVENT_NDIS_DRIVER_FAILURE, 0, 1, &ErrorString, sizeof(Status), &Status); #endif } if (Status == NDIS_STATUS_SUCCESS) { NdisCloseConfiguration(ConfigurationHandle); } NdisRestartAttributes = RestartParameters->RestartAttributes; // // If NdisRestartAttributes is not NULL, then miniport can modify generic attributes and add // new media specific info attributes at the end. Otherwise, NDIS restarts the miniport because // of other reason, miniport should not try to modify/add attributes // if (NdisRestartAttributes != NULL) { PNDIS_RESTART_ATTRIBUTES NextAttributes; ASSERT(NdisRestartAttributes->Oid == OID_GEN_MINIPORT_RESTART_ATTRIBUTES); NdisGeneralAttributes = (PNDIS_RESTART_GENERAL_ATTRIBUTES)NdisRestartAttributes->Data; // // Check to see if we need to change any attributes, for example, the driver can change the current // MAC address here. Or the driver can add media specific info attributes.

// NdisGeneralAttributes->LookaheadSize = 128; // // Check the next attributes to see whether the filter need to modify // NextAttributes = NdisRestartAttributes->Next; while (NextAttributes != NULL) { // // If somehow the filter needs to change a attributes which requires more space then // the current attributes: // 1. Remove the attribute from the Attributes list: // TempAttributes = NextAttributes; // NextAttributes = NextAttributes->Next; // 2. Free the memory for the current attributes: NdisFreeMemory(TempAttributes, 0 , 0); // 3. Dynamically allocate the memory for the new attributes by calling // NdisAllocateMemoryWithTagPriority: // NewAttributes = NdisAllocateMemoryWithTagPriority(Handle, size, Priority); // 4. Fill in the new attribute // 5. NewAttributes->Next = NextAttributes; // 6. NextAttributes = NewAttributes; // Just to make the next statement works. // NextAttributes = NextAttributes->Next; } // // Add a new attributes at the end // 1. Dynamically allocate the memory for the new attributes by calling // NdisAllocateMemoryWithTagPriority. // 2. Fill in the new attribute // 3. NextAttributes->Next = NewAttributes; // 4. NewAttributes->Next = NULL; } //

// If everything is OK, set the filter in running state // If it get preempted, it doesn't matter // pFilter->State = FilterRunning; // when successful Status = NDIS_STATUS_SUCCESS; if (Status != NDIS_STATUS_SUCCESS) { pFilter->State = FilterPaused; } DEBUGP(DL_TRACE, ("

FilterPaused NDIS_STATUS_SUCCUSS NDIS_STATUS_PENDING NDIS_STATUS_PENDING NdisFPauseComplete FilterModule Paused 1 2 NdisFReturnNetBufferLists NDIS

3 4 NdisFSendNetBufferListsComplete FilterSendNetBufferLists

NET_BUFFER_LIST NDIS_STATUS_PAUSED 5 NdisFIndicateStatus 6 FilterStatus7 FIlterOidRequest OID 8 OID

FilterModule Pauseing NDIS PnP FilterModule Paused NDISDDK Filter FilterPause NDIS_STATUS FilterPause( IN NDIS_HANDLE FilterModuleContext, IN PNDIS_FILTER_PAUSE_PARAMETERS PauseParameters ) { PMS_FILTER pFilter = (PMS_FILTER)(FilterModuleContext); NDIS_STATUS Status; UNREFERENCED_PARAMETER(PauseParameters); DEBUGP(DL_TRACE, ("===>NDISMON FilterPause: FilterInstance %p\n", FilterModuleContext)); // // Set the flag that the filter is going to pause // FILTER_ASSERT(pFilter->State == FilterRunning); FILTER_ACQUIRE_LOCK(&pFilter->Lock, FALSE); pFilter->State = FilterPausing; FILTER_RELEASE_LOCK(&pFilter->Lock, FALSE); Status = NDIS_STATUS_SUCCESS;

pFilter->State = FilterPaused; DEBUGP(DL_TRACE, ("

FilterSetOptions NdifFRegisterFilterDriver FilterSetOption Optional Service FilterXXX

NdisSetOptionalHandlers ( FilterModule)OptionalFilterDriverService

FilterModule FilterXXX DataBypassMode NdisSetOptionalHandlers FilterRestart FilterModule FilterModule

2.9 FilterModule NDIS6.0FilterDriverFilterDriver

FilterModuleMiniport Adapter Filter Module

Filter Driver NDIS_PACKET NET_BUFFER NDIS NET_BUFFER NDIS_PACKET

FilterDriver FilterModule FilterXXX

FilterDriver

2.9.1 FilterDriver

Filter Driver Filter Driver Filter Driver NET_BUFFER_LIST NET_BUFFER

NdisAllocateNetBufferListPool

NdisAllocateNetBufferPool

NdisAllocateNetBufferAndNetBufferList

NdisAllocateNetBufferList

NdisAllocateNetBuffer

NdisAllocateNetBufferAndNetBufferList NdisAllocateNetBufferList NdisAllocateNetBuffer NdisAllocateNetBufferAndNetBufferList NET_BUFFER_LIST NET_BUFFER NdisAllocateNetBufferAndNetBufferList NdisAllocateNetBufferListPool

AllocateNetBuffer TRUEFilter Driver

FilterDriver FilterRestart FilterDriver RestartingFilterDriver FilterDriver Restarting

NdisFreeNetBufferListPool

NdisFreeNetBufferPool

NdisFreeNetBufferList

NdisFreeNetBuffer

NET_BUFFER_LISTNdisAllocateNetBufferNET_BUFFER NET_BUFFER NdisAllocateNetBufferAndNetBufferList NdisFreeNetBufferList NET_BUFFER_LIST

2.9.2 FilterDriverFilter Driver

NdisFSendNetBufferLists NET_BUFFER_LIST FilterModule

1 FilterDriver FilterDriver

Filter Driver NdisFSendNetBufferLists NET_BUFFERLIST Filter Driver NET_BUFFER_LIST SourceHandle NdisFSendNetBufferLists NdisFilterHandle NDIS NET_BUFFER_LIST SourceHandle NdisFSendNetBufferLists NET_BUFFER_LIST_INFO Filter Driver NdisSentNetBufferLists NET_BUFFER_LIST NDIS

NDIS FilterSendNetBufferListsComplete Filter Driver

NDIS NdisFSendNetBufferLists FilterSendNetBufferListsComplete NDIS FilterSendNetBufferListsComplete Filter Driver NDIS FilterSendNetBufferListsComplete NET_BUFFER_LIST FilterSendNetBufferListsComplete NDIS FilterSendNetBufferListsComplete FilterDriver FilterSendNetBufferListsComplete NdisFSendNetBufferLists

NDIS FilterDriver NdisFSendNetBufferLists FilterSendNetBufferListsComplete FilterDriver NdisFSendNetBufferLists SendFlags NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK NDIS

Filter Driver NdisFSendNetBufferComplete

2

NDIS FilterDriver FilterSendNetBufferLists Filter Driver NET_BUFFER_LIST SourceHandle FilterSendNetBufferLists NDIS_BUFFER_LIST1 NdisFSendBufferLists NDIS Filter

Driver

2 NdisFSendNetBufferListsComplete 3

4

NdisFSendNetBufferComplete NdisMSendNetBufferListsComplete

NDIS Filter Driver FilterSendNetBufferLists Filter Driver FilterSendNetBufferLists FilterSendNetBufferComplete

NET_BUFFER_LIST FilterModule FilterSendNetBufferListsComplete NDIS ProtocolSendNetBufferListsComplete FilterDriver FilterSendNetBufferLists FilterSendNetBufferListsComplete Filter DriverNDIS FilterSendNetBufferLists SendFlags NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK Filter Driver NdisFSendNetBufferLists NDIS FilterDriver NDIS NDIS FilterDriver FilterDriver NDIS Filter Driver

2.9.3 FilterDriver FilterDriver

1 FilterDriver FilterDriver

NDIS_SET_NET_BUFFER_LIST_CANCEL_ID NET_BUFFER_LIST Id ID NdisGenratePartialCanceId ID ID DriverEntry NdisGenratePartialCanceld ID ID NdisFCancelSendNetBufferLists ID NDIS_GET_NET_BUFFER_LIST_CANCEL_ID Filter Driver NET_BUFFER_LIST ID NdisFCancelSendNetBufferLists NET_BUFFER_LIST ID NdisFCancelSendNetBufferLists

NDIS

NdisMSendNetBufferListCompleteNET_BUFFER_LIST NDIS_STATUS_CANCELLEDNDIS FilterDriver FilterSendNetBufferListsComplete FilterSendNetBufferListsComplete NDIS_SET_NET_BUFFER_LIST_CANCEL_ID NET_BUFFER_LIST ID NULL ID NET_BUFFER_LIST

2

NET_BUFFER_LIST IDNDIS Filter Driver FilterCancelSendNetBufferLists ID NET_BUFFER_LIST FilterCanCelSendNetBufferLists

1) FilterDriver NDIS_GET_NET_BUFFER_LSIT_CANCEL_ID NET_BUFFER_LIST ID FilterCancelSendBufferLists ID

2) ID FilterCancelSentBufferLists ID 3) NdisFSendNetBufferListsComplete NET_BUFFER_LIST

NDIS_STATUS_CANCELLED4) NdisFCancelSendNetBufferLists ID

FilterDriver

2.9.4 FilterDriver Filter Driver NdisMIndicateReceiveNetBufferLists NDIS NET_BUFFER_LIST FilterModule

1) FilterDriver

Filter Driver NdisFIndicateReceiveNetBufferLists NET_BUFFER_LIST Filter Driver FilterDriver NdisFIndicateReceiveNetBufferLists NDIS_STATUS_SUCCESSNDIS FilterReturnNetBufferLists Filter Driver NET_BUFFER_LIST FilterReturnNetBufferLists Filter Driver NdisFIndicateReceiveNetBufferLists ReceiveFlags NDIS_RECEIVE_FLAGS_RESOURCES FilterDriver NET_BUFFER_LIST FilterDriver NET_BUFFER_LIST NDIS FilterReturnNetBufferLists NET_BUFFER_LIST

FilterDriver FilterReturnNetBufferLists NdisFReturnNetBufferLists

2)

NDIS FilterReceiveNetBufferLists NDIS Filter Driver FilterReceiveNetBufferLists

FilterReceiveNetBufferLists ReciverFlags NDIS_RECEIVE_FLAGS_RESOURCES FilterDriverNET_BUFFER_LIST FilterReturnNetBufferLists FilterDriverFilter Driver

Filter Driver NET_BUFFER_LIST FilterReceiveNetBufferLists NET_BUFFER_LIST

Filter Driver

FilterReceiveNetBufferLists1 NDIS

: NDIS FilterReceiveNetBufferLists ReceiveFlags NDIS_RECEIVE_FLAGS_RESOURCES FilterDriver FilterReturnNetBufferLists

2 FilterReceiveNetBufferLists ReceiveFlags NDIS_RECEIVE_FLAGS_RESOURCES Filter Drivre NdisFReturnNetBufferList

3 FilterReceiveNetBufferLists ReceiveFlagsNDIS_RECEIVE_FLAGS_RESOURCES NET_BUFFER_LIST NET_BUFFER_LIST FilterDriver NdisFIndicateNetBufferLists

FilterDriverNET_BUFFER_LIST NDIS Filter Driver FilterReturnNetBufferLists FilterReturnNetBufferLists FilterReciveNetBufferLists FilterModuleNET_BUFFER_LISTNDIS FilterReceiveNetBufferLists ReceiveFlags NDIS_RECEIVE_FLAGS_RESOURCES FilterDrivre NdisFReturnNetBufferList FilterReceiveNetBufferLists

2.10 FilterModuleOIDNDIS IDOID

NDISOIDsFilterDriver OID NDIS 6.1 OID DirectOIDRequestInterface OID OID IPSec Offload Version 2IPSecV2 OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SAOID OID OID NDIS

OID

2.10.1 FilterDriverOID

FilterDriverOIDNDIS FilterDriver FilterOidRequest OID FilterDriver NdisFOidRequest

NDIS FilterCancelOidRequest OID NDIS FilterCancelOidRequest FilterDriver NdisFCancelOidRequestNdisFOidRequest NdisFCancelOidRequest

OID

Filter Driver FilterOidRequest OID NDIS_STATS_SUCCESS NDIS_STATUS_PENDING FilterOidRequest OID

Filter DriverOIDOIDNDIS_OID_REQUESTSupportRevisionOIDSpecifyingNDISVersionInformation

FilterOidRequest NDIS_STATUS_PENDING OID NdisFOidRequestComplete NdisFOidRequestComplete OidRequest Status

FilterOidRequest NDIS_STATUS_SUCCESS FIlterOidRequest OidRequest NdisFOidRequestComplete

OIDFilter Driver NdisFOidRequest OID NDIS_STATUS_SUCCESS NDIS_STATUS_PENDING NdisFOidRequestComplete

OID OID FilterDriver

FilterDriver OID RestartingRunningPausing Paused

FilterDriver OID NDIS

OID FilterModule OID OID

FilterDriver OID :Filter Driver Filter Driver

OID_GEN_MAXIMUM_FRAME_SIZE FilterDriver

2.10.2 FilterDriverOIDFilterDriver NdisFOidRequest OID

Filter Driver NdisFOidRequest NDIS OID

NdisFOidRequest OID NDIS_STATUS_SUCCESS NDIS_STATUS_PENDING

SupportRevisionSpecifyingNDISVersionInformation

NdisFOidRequest NDIS_STATUS_PENDINGNDIS OID FilterOidRequestComplete NdisFOidRequestComplete OidRequest Status

NdisFOidRequest NDIS_STATUS_SUCCESS NdisFOidRequest OidRequest FilterOidRequestComplete

FilterDriver NdisFOidRequest OID RestartingRunningPausing Paused

Filter Driver FilterOidRequestComplete NdisFOidRequestComplete

2.10.3 FilterModuleOIDDirectOIDRequest OID Filter Driver NDIS_FILTER_DRIVER_CHARACTERISTICS

FilterXXX NDIS NdisFDirectXXX OID OID NdisFDirectOidRequest

FilterDirectOidRequest NdisFOidRequest FilterOidRequest NDIS 6.1 OID OID 6.1 6.1

OID OID OID OID OID OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SA

OID OID NDIS OID OID OID OID DISPATCH_LEVEL

OID OID OID

DirectOIDfunction StandardOIDfunction

FilterDirectOidRequest FilterOidRequest

FilterCancelDirectOidRequest FilterCancelOidRequest

FilterDirectOidRequestComplete FilterOidRequestComplete

NdisFDirectOidRequest NdisFOidRequest

NdisFDirectOidRequestComplete NdisFDirectOidRequestComplete

NdisFCancelDirectOidRequest NdisFCancelOidRequest

2.11 FilterModulePnPFilterDriver PnP

FilterDriver PnP

FilterDriver FilterPnpEventNotify NDIS PnPMiniportDevicePnPEventNotify

FilterDriver NdisFDevicePnPEventNotify

FilterDriver

Filter Driver FilterNetPnpEvent PnP ProtocolNetPnPEvent

Filter Driver PnP NdisFNetPnpEvent

FilterDriverNDISPnPFilterDriverDDKModifyingaRunningDriverStack

PnPNDISDDKPausingaDriverStack

2.12 FilterModule FilterDriver FilterStatus NDIS

FilterDriver

NdisMIndicateStatusExNdisFIndicateStatsNDISFilterDriverFilterStatusDDKAdapterStatusIndications

FilterDriver FilterStatus NdisFIndicateStatus NdisFIndicateStatus NdisFIndicateStatus

Filter Driver NDIS FilterStatus NdisFIndicateStatus

Filter Driver SourceHandle FilteAttech NdisFilterHandle OID OID DestinationHandle RequestId OID

Filter Driver NdisFIndicateStatus NDIS ProtocolStatusEx FilterStatus

3 NDISFilterDrivers NDISFilterDriverFilterDriver

Filter DriverMiniportAdapter NDIS FilterModuleFilterDriver

(virtualminiport) Filter Driver INF

Filter Driver INF INF Prolocol INFFile INFMiniportINFFile

FilterDriver INF

3.1 FilterDriver INFUpperRanget LowerRange

Filter Driver UpperRange LowerRange noupper

nolower FilterDriver INF

HKR, Ndi\Interfaces,UpperRange,,"noupper" HKR, Ndi\Interfaces,LowerRange,,"nolower"

FilterDriver INF FilterMediaTypes FilterDriver FilterDriver FilterDriver INF FilterMediaTypes FilterMediaTypes

HKR, Ndi\Interfaces, FilterMediaTypes,,"ethernet"

FilterMediaTypes LowerRange

ethernet Ethernetadapter

atm ATMadapter

tokenring tokenringadapter

serial serialadapter

fddi FDDIadapter

baseband basebandadapter

broadband broadbandadapter

arcnet Arcnetadapter

isdn ISDNadapter

localtalk LocalTalkadapter

wan WANadapter

nolower

ndis5 NDIS5.x ATM

Ndisatm NDIS5.x ATM

Wlan native802.11wirelessLANadapter.

FilterDriverFilterDriverProtocoltoAdapterBanding FilterMediaTypes

3.2 FilterDriverINF FilterDriver INF Modifying

MonitoringMandatory Optional INF FilterDriver FilterModule Filter Drivr GUIDFIDGUID MonitoringModifying FilterDriver

3.2.1 MonitoringFilterDriverINF FilterDriverMonitoring FilterDriver:

1) INF Class NetService ClassGUIDClass =NetService

ClassGUID ={4D36E974E32511CEBFC108002BE10318}

2) DDInstall, INF Characteristics[Install]

AddReg=Inst_Ndi

Characteristics=0x40000

NetCfgInstanceId="{5cbf81bd505547cd9055a76b2b4e3697}"

Copyfiles=NdisMon.copyfiles.sys

0x40000 NCF_LW_FILTER Filter Driver NCF_FILTER(0x400)

3) NetCfgInstanceId Id FilterDriver NdisFRegisterFilterDriver FilterDriver Uuidgent.exe[Install]

AddReg=Inst_Ndi




4) DDInstall, INF AddReg Ndi Ndi Service[Install]

AddReg=Inst_Ndi




[Inst_Ndi]










5) Filter Driver FilterType FilterRunType FilterDriverMonitoringMandatory[Inst_Ndi]










FilterType 0x00000001Monitoring FilterDriverFilterRunType 1 Mandatory 2 Optional

6) FilterDriver[Install.Services]

AddService=NdisMon,,NdisMon_Service_Inst

[NdisMon_Service_Inst]

DisplayName =%NdisMon_Desc%

ServiceType =1;SERVICE_KERNEL_DRIVER

StartType =1;SERVICE_SYSTEM_START

ErrorControl =1;SERVICE_ERROR_NORMAL

ServiceBinary =%12%\NdisMon.sys

LoadOrderGroup =NDIS

Description =%NdisMon_Desc%

AddReg =Common.Params.reg

7) INF CoService FilterDriver[Inst_Ndi]










8) INF FilterClass Filter Driver Monitoring FilterDriver

9) Filter [Inst_Ndi]










10) Filter Driver FilterModule[Common.Params.reg]

HKR,FilterDriverParams\DriverParam, ParamDesc, ,"DriverparamforMon"

HKR,FilterDriverParams\DriverParam, default, ,"5"

HKR,FilterDriverParams\DriverParam, type, ,"int"

HKR,FilterAdapterParams\AdapterParam, ParamDesc, ,"AdapterparamforMon"

HKR,FilterAdapterParams\AdapterParam, default, ,"10"

HKR,FilterAdapterParams\AdapterParam, type, ,"int"

HKR,FilterInstanceParams\InstanceParam,ParamDesc,,"Instanceparamforlwf"

HKR,FilterInstanceParams\InstanceParam,default,,"15"

HKR,FilterInstanceParams\InstanceParam,type,,"int"

3.2.2 ModifyingFilterDriverINF FilterDriverModifying FilterDriver:

1) INF Class NetService ClassGUIDClass =NetService

ClassGUID ={4D36E974E32511CEBFC108002BE10318}

2) DDInstall, INF Characteristics[Install]

AddReg=Inst_Ndi




0x40000 NCF_LW_FILTER Filter Driver NCF_FILTER(0x400)

3) NetCfgInstanceId Id FilterDriver NdisFRegisterFilterDriver FilterDriver Uuidgent.exe[Install]

AddReg=Inst_Ndi




4) DDInstall, INF AddReg Ndi Ndi Service[Install]

AddReg=Inst_Ndi




[Inst_Ndi]

HKR,Ndi,Service,,"NdisLwf"

HKR,Ndi,CoServices,0x00010000,"NdisLwf"

HKR,Ndi,HelpText,,%NdisLwf_HelpText%







5) Filter Driver FilterType FilterRunType FilterDriverMonitoringMandatory[Inst_Ndi]










FilterType 0x00000002 Modifying Filter DriverFilterRunType 1 Mandatory 2 Optional

6) FilterDriver[Install.Services]

AddService=NdisLwf,,NdisLwf_Service_Inst

[NdisLwf_Service_Inst]

DisplayName =%NdisLwf_Desc%

ServiceType =1;SERVICE_KERNEL_DRIVER

StartType =1;SERVICE_SYSTEM_START

ErrorControl =1;SERVICE_ERROR_NORMAL

ServiceBinary =%12%\NdisLwf.sys

LoadOrderGroup =NDIS

Description =%NdisLwf_Desc%

AddReg =Common.Params.reg

7) INF CoService FilterDriver[Inst_Ndi]










8) INF FilterClass FilterDriverModifying FilterDriver

scheduler FilterDriverEncryption 802.1p

Encryption Scheduler Compression

Compression Encryption Vpn

Vpn Compression loadbalance

Loadbalance PacketScheduling Failover. FilterDriver

failover Loadbalance Diagnostic

Diagnostic FilterDriver FailOver

Custom FilterDriver Diagnostic Modifying Filter Driver

Modifying FilterDriver FilterClassic schedulerFilter Driver FilterDriver

[Inst_Ndi]










9) Filter [Inst_Ndi]










10) Filter Driver FilterModule[Common.Params.reg]

HKR,FilterDriverParams\DriverParam, ParamDesc, ,"DriverparamforLwf"

HKR,FilterDriverParams\DriverParam, default, ,"5"

HKR,FilterDriverParams\DriverParam, type, ,"int"

HKR,FilterAdapterParams\AdapterParam, ParamDesc, ,"AdapterparamforLwf"

HKR,FilterAdapterParams\AdapterParam, default, ,"10"

HKR,FilterAdapterParams\AdapterParam, type, ,"int"

HKR,FilterInstanceParams\InstanceParam,ParamDesc,,"Instanceparamforlwf"

HKR,FilterInstanceParams\InstanceParam,default,,"15"

HKR,FilterInstanceParams\InstanceParam,type,,"int"

3.3 FilterDriverNDIS FilterDriverFilterDriver

PnPNDIS_STATUS

NdisOpenConfigurationEx(

INPNDIS_CONFIGURATION_OBJECTConfigObject,

OUTPNDIS_HANDLEConfigurationHandle

);

NdisOpenConfigurationEx NdisFRegisterFilterDriver NDIS_CONFIGURATION_OBJECT NdisHandle NdisOpenConfigurationEx Filter Driver NdisDeregisterFilterDriver

FilterAttech NdisHandle NdisOpenConfigurationEx Filter Module FilterDetach Filter Module Monitoring Filter Driver NDIS_CONFIGURATION_OBJECT Flags NDIS_CONFIG_FLAG_FILTER_INSTANCE_CONFIGURATION FilterModuleModifying FilterDriver

FilterDriverNdisClosConfiguration

4 4.1 NET_BUFFER4.1.1

NDISNDIS6.0 1) NET_BUFFER 2) NET_BUFFERLIST 3) NET_BUFFER_LIST_CONTEXT :

NDIS 6.0 NET_BUFFER NET_BUFFER MDL MDL NET_BUFFER NDIS 5.X NDIS_PACKET NDIS MDL

NET_BUFFERNET_BUFFER_LISNET_BUFFER NULL NDIS NET_BUFFER_LIST NET_BUFFER

NET_BUFFER_LIST NET_BUFFER NET_BUFFER_LIST NET_BUFFER_LIST_CONTEXT NDIS NET_BUFFER_LIST_CONTEXT

NET_BUFFER_LIST NET_BUFFER_LIST NULL

4.1.1.1 NET_BUFFER

NDIS6.0 NET_BUFFER NDIS5.X NDIS_PACKET NET_BUFFER

NET_BUFFER

NET_BUFFER NetBufferHeader NET_BUFFER_HEADER NET_BUFFER_DATA NetBufferData NDIS NET_BUFFER

NET_BUFFER_NEXT_NB

NET_BUFFER_FIRST_MDL

NET_BUFFER_DATA_OFFSET

NET_BUFFER_DATA_LENGTH

NET_BUFFER_PROTOCOL_RESERVED

NET_BUFFER_MINIPORT_RESERVED

NET_BUFFER_CHECKSUM_BIAS

NET_BUFFER_CURRENT_MDL

NET_BUFFER_CURRENT_MDL_OFFSET

NdisGetPoolFromNetBuffer

NET_BUFFER NDIS ProtocolReserved

MiniportReserved

NdisPoolHandle

NET_BUFFER NET_BUFFERNext

NET_BUFFER NET_BUFFER NULLDataLength

MDL DataOffset

MDL CurrentMdl

MDL MDL NDIS MDLMDLCurrentMdlOffset

CurrentMdlMDL

NDISMDL

Retreat Advance Retreat Advance

NET_BUFFER UsedDataSpace

Retreat AdvanceUnusedDataSpace

TotalDataSize

UsedDataSpace UnusedDataSpace DataOffset DataLengthRetreat

Advance

4.1.1.2 NET_BUFFER_LIST

NET_BUFFER_LIST NET_BUFFER NET_BUFFER_LIST

NET_BUFFER_LIST NET_BUFFER_LIST_HEADER NetBufferListHeader

NET_BUFFER_LIST_DATA NetBufferListData NDIS

NET_BUFFER_LIST_NEXT_NBL

NET_BUFFER_LIST_FIRST_NB

NET_BUFFER_LIST_FLAGS

NET_BUFFER_LIST_MINIPORT_RESERVED

NET_BUFFER_LIST_CONTEXT_DATA_START

NET_BUFFER_LIST_CONTEXT_DATA_SIZE

NET_BUFFER_LIST_INFO

NET_BUFFER_LIST_STATUS

NET_BUFFER_LIST_PROTOCOL_RESERVED

NdisGetPoolFromNetBufferList

NET_BUFFER_LIST NDIS ParentNetBufferList

NET_BUFFER_LIST NULLNdisPoolHandle

ProtocolReserved

MiniportReserved

SourceHandle

NET_BUFFER_LIST NDIS ChildRefCount

0Flags

NET_BUFFER_LIST Status

NetBufferListInfo

NET_BUFFER_LIST NET_BUFFER Next

NET_BUFFER_LIST Next NULLFirstNetBuffer

NET_BUFFER_LIST NET_BUFFERContext NET_BUFFER_LIST_CONTEXTNDIS

NdisAllocateNetBufferListContext

NdisFreeNetBufferListContext



4.1.1.3 NET_BUFFER_LIST_CONTEXT

NDIS NET_BUFFER_LIST_CONTEXT NET_BUFFER_LIST NET_BUFFER_LIST Context NET_BUFFER_LIST_CONTEXT NDIS

ContextData NET_BUFFER_LIST NET_BUFFER_LIST_CONTEXT

NdisAllocateNetBufferListContext

NdisFreeNetBufferListContext



4.1.2 RetreatAdvanceNDIS Retreat Advance NET_BUFFERRetreat

Advance Retreat

NdisRetreatNetBufferDataStart Advance

NdisAdvanceNetBufferStart

4.1.2.1 Retreat

Retreat NET_BUFFER NET_BUFFER_LIST NET_BUFFER Retreat

NdisRetreatNetBufferDataStart

NdisRetreatNetBufferListDataStart

Retreat NET_BUFFER MDL NetAlloceMdl NULL MDL NetFreeMdl

DataLength NDIS DataOffsetDelta DataLength DataOffset DataOffsetDelta DataOffset DataLengh DataOffsetDelta DataLength

Retreat NDIS DataOffset

Retreat NDISNDIS DataOffset DataLength Retreat

Retreat DataOffset DataLength Advance Retreat

4.1.2.2 Advance

Aduvance NET_BUFFER NET_BUFFER_LIST NET_BUFFER

NdisAdvanceNetBufferDataStart

NdisAdvanceNetBufferListDataStart

Advanced NET_BUFFER NetFreeMdl NDISMDL

DataLengthNDIS DataLength DataOffsetDelta Retreat Advance NDIS DataLength DataOffset

Advance Retreat Retreat

Advance DataLength DataOffsetAdvance

4.1.3 NDIS

NdisAllocateNetBufferPool

NdisAllocateNetBufferListPool

NDIS6.0 NdisRegisterProtocolDriver NDISMiniportInitializeEx NdisRegisterProtocolDriver NDISMiniportInitializeEx (FilterDriver) NDIS FilterAttach NdisAllocateGenericObject

4.1.4 IRQL

NDIS IRQL IRQL IRQL

otherflag(otherabbritues) IRQL

NDIS_SEND_FLAGS_DISPATCH_LEVEL

NDIS_SEND_COMPLETE_FLAGS_DISPATCH_LEVEL

NDIS_RECEIVE_FLAGS_DISPATCH_LEVEL

NDIS_RETURN_FLAGS_DISPATCH_LEVEL

NDIS_RWL_AT_DISPATCH_LEVEL

IRQL IRQL IRQL

IRQL DISPATCH_LEVEL IRQL DISPATCH_LEVEL NDIS

IRQL

4.1.5 NDIS6.0 NET_BUFFER_LIST

NET_BUFFER_LIST NET_BUFFERNET_BUFFER_LIST

NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER 802.11 NET_BUFFER NET_BUFFER_LIST NDIS NET_BUFFER_LIST

NDIS5.XNDIS NDIS_PACKET NET_BUFFER NDIS NET_BUFFER NET_BUFFER_LIST NDIS

4.1.5.1

NDIS

NdisSendNetBufferLists NET_BUFFER_LIST NDISMiniportSendNetBufferLists NET_BUFFER_LIST

NET_BUFFER NdisMSendNetBufferListsComplete NET_BUFFER_LIST

NET_BUFFER_LIST NdisMSendNetBufferListsComplete NDIS ProtocolSendNetBufferListsComplete

NDIS ProtocolSendNetBufferListsComplete NET_BUFFER_LIST NET_BUFFER

NDIS NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER

NDIS NET_BUFFER NET_BUFFER_LIST NET_BUFFER MDL NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER MDL NET_BUFFER_LIST NET_BUFFER_LIST

NdisOpenAdapterEx NDIS NdisBindingHandle NET_BUFFER_LIST SourceHandle NDIS NET_BUFFER_LIST

NET_BUFFER_LIST SourceHandle NdisOpenAdapterEx NdisBindingHandle NET_BUFFER_LIST SourceHandle SourceHandle SourceHandle

4.1.5.2

NDIS_SET_NET_BUFFER_LIST_CANCEL_ID NET_BUFFER_LIST ID

ID NdisGeneratePartialCancelId ID ID DriverEntry ID ID

ID NdisCancelSendNetBufferLists NET_BUFFER_LIST ID NDIS_GET_NET_BUFFER_LIST_CANCEL_ID NET_BUFFER_LIST ID

NET_BUFFER_LIST ID NET_BUFFER_LIST ID ID

NDISMiniportCancelSend NdisMSendNetBufferListsComplete NET_BUFFER_LIST NDIS_STATUS_CANCELLED NDIS PotocolSendNetBufferListsComplete NET_BUFFER_LIST ID NULL

4.1.5.3

NDIS

NdisMIndicateReceiveNetBufferLists NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER_LIST

NET_BUFFER_LIST NdisMIndicateReceiveNetBufferLists NDIS NET_BUFFER_LIST ProtocolReceiveNetBufferLists NDIS NET_BUFFER_LIST NET_BUFFER_LIST NetBufferListFrameType NDIS

ReceiveFlag NDIS_RECEIVE_FLAGS_RESOURCES NDIS ProtocolReceiveNetBufferLists NET_BUFFER_LIST

NET_BUFFER_LIST NDIS NET_BUFFER_LIST NET_BUFFER NET_BUFFER MDL

NET_BUFFER_LIST NET_BUFFER_LIST NdisReturnNetBufferLists

NdisReturnNetBufferLists NDIS MiniportRetrunNetBufferLists

NDIS_RECEIVE_FLAGS_RESOURCES NDIS MiniportRetrunNetBufferListsNdisMIndicateReceiveNetBufferLists

NDIS NET_BUFFER_LIST NdisMIndicateReceiveNetBufferListsNDISNET_BUFFER_LIST NET_BUFFER_LIST SourceHandle NDIS MiniprotInitEx MiniprotAdapterHandleNDIS NET_BUFFER_LIST NET_BUFFER_LIST SourceHandle NDIS MiniprotInitEx MiniprotAdapterHandle SourceHandle NDIS NET_BUFFER_LIST SourceHandle NdisMReturnNetBufferLists

4.1.5.4 NDIS

NET_BUFFER_LIST NblFlags NDIS_NBL_FLAGS_IS_LOOPBACK_PACKET Filter Driver

1 NdisMedium802_3 NdisMedium802_52

a) OID OID_GEN_CURRENT_PACKET_FILTER NDIS_PACKET_TYPE_PROMISCUOUS z z FilterModule

b) OID OID_GEN_CURRENT_PACKET_FILTER NDIS_PACKET_TYPE_ALL_LOCAL z z FilterModule

c) NdisSendNetBufferLists SendFlags NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK

3 a) MACMAC

b) NDIS_PACKET_TYPE_ALL_MULTICASTNDIS_PACKET_TYPE_ALL_MULTICAST

c) NDIS_PACKET_TYPE_BROADCAST

d) NDIS_PACKET_TYPE_PROMISCUOUS NDIS_PACKET_TYPE_ALL_LOCAL

1 2 NDIS_PACKET_TYPE_NO_LOCAL

1) NDIS_PACKET_TYPE_NO_LOCAL

2) SendFlags

NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK

4.1.6

4.1.6.1

WindowsVista TCP/IP TCP/IP

1 NET_BUFFER_LIST

NET_BUFFER_LISTOOB NET_BUFFER_LIST NetBufferListInfo

2 NET_BUFFER NET_BUFFER_LIST

3 NET_BUFFER_LIST NET_BUFFER 4 NET_BUFFER_LISTNET_BUFFERMAC5 TCP UDP NET_BUFFER_LIST NET_BUFFER

TCP UDP 6 MACMDLMAC VLAN7 NET_BUFFERMDLNET_BUFFER_LISTNET_BUFFER_LIST

NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER_LIST

4.1.6.2

WindowsVista TCP/IP TCP/IP

1 NET_BUFFER_LIST NET_BUFFER_LISTOOB NET_BUFFER_LIST NetBufferListInfo

2 NET_BUFFER NET_BUFFER_LIST MDL NET_BUFFER

3 VISTAMDL

4 Windows NET_BUFFER_LIST MDL IPIPV4 IPSECIPV6 MDL NDISLOOKHEAD

5 NDIS6.0 FilterDriver NET_BUFFER_LIST MDL Windows

4.1.7 NET_BUFFER_LIST

NDIS6.0 NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER_LIST NdisAllocateCloneNetBufferList

NdisAllocateFragmentNetBufferList

NdisAllocateReassembledNetBufferList

NET_BUFFER_LIST Clone NET_BUFFER_LIST Fragrance NET_BUFFER_LIST NET_BUFFER Reassembled NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER NET_BUFFER_LIST NET_BUFFER_LIST

4.1.7.1 NET_BUFFER_LIST

1) NET_BUFFER_LIST

2)

3) NET_BUFFER_LIST

4) NDISNET_BUFFER_LIST

NET_BUFFER_LIST

5) NDIS NET_BUFFER_LIST 0NDIS

4.1.7.2

NET_BUFFER_LIST

NdisAllocateCloneNetBufferList NET_BUFFER_LIST

NET_BUFFER_LIST NET_BUFFER MDL MDL NET_BUFFER_LIST NET_BUFFER_LIST_CONTEXT NdisFreeCloneNetBufferList

4.1.7.3

NdisAllocateFragmentNetBufferList NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFERMDL NET_BUFFER_LIST_CONTEXT

NET_BUFFER

NET_BUFFER NET_BUFFER NET_BUFFER NET_BUFFER

NdisFreeFragmentNetBufferList NET_BUFFER_LIST

4.1.7.4

NdisReassemledNetBufferList NET_BUFFER_LIST

NET_BUFFER_LIST NET_BUFFER MDL NET_BUFFER_LIST_CONTEXT NdisFreeReassemledNetBufferList NET_BUFFER_LIST NET_BUFFER MDL

4.2 NDIS NDISHeaderNDIS Ndis

NDIS NDIS NDIS

4.2.1 NDIS

Header NDIS_OBJECT_HEADER

1) NDIS revision

NDIS6.1 Header

2)

3) NDIS

4) NDIS5) Header.Size Header.Revision

4.2.2 NDISNDIS Header NDIS

NDIS NDIS NDIS NDIS NDIS5.X 6.1 NDIS6.0 NDIS6.1 NDIS revision2 revision1

1 Header.revision Header.size2 Header.revision Header.size

NDIS3

4 6.1 NDIS NDIS6.1

5 NDIS OID NDIS_OID_REQUEST SupportedRevision revision

6 OID SupportedRevision

4.2.3 NDISNDIS NDIS

NDIS1 NDIS NDIS

2

NDIS6.1 XXX_REVISION_2 NDIS

4.2.4 NDIS

NDIS RtlGetVersion RtlVerifyVersionInfo NDIS NDIS NDIS NdisGetVersion

4.2.5 NDIS WMI NDIS WMI WMI

NDIS

1 NDIS Filter Drivers1.1 Filter Drivers 1.2 Filter Drivers 1.3 Filter Drivers 1.4 Mandatory Filter Drivers

2 NDIS Filter Drivers2.1 Filter Driver2.2 Filter Drivers2.3 Filter Module 2.4 Filter Module2.5 Filter Module2.6 Filter Module2.6.1 Filter Module2.6.2 Filter Module

2.7 Data Bypass Mode2.8 Filter Driver2.9 Filter Module2.9.1 Filter Driver2.9.2 Filter Driver2.9.3 Filter Driver2.9.4 Filter Driver

2.10 Filter Module OID2.10.1 Filter DriverOID2.10.2 Filter DriverOID2.10.3 Filter ModuleOIDDirect OID Request

2.11 Filter Module PnP2.12 Filter Module

3 NDIS Filter Drivers3.1 Filter Driver3.2 Filter DriverINF3.2.1 Monitoring Filter DriverINF3.2.2 Modifying Filter DriverINF

3.3 Filter Driver

4 4.1 NET_BUFFER4.1.1 4.1.1.1 NET_BUFFER4.1.1.2 NET_BUFFER_LIST4.1.1.3 NET_BUFFER_LIST_CONTEXT

4.1.2 RetreatAdvance4.1.2.1 Retreat4.1.2.2 Advance

4.1.3 4.1.4 IRQL4.1.5 4.1.5.1 4.1.5.2 4.1.5.3 4.1.5.4 NDIS

4.1.6 4.1.6.1 4.1.6.2

4.1.7 NET_BUFFER_LIST4.1.7.1 NET_BUFFER_LIST4.1.7.2 4.1.7.3 4.1.7.4

4.2 NDIS4.2.1 NDIS4.2.2 NDIS4.2.3 NDIS4.2.4 NDIS4.2.5 NDIS WMI

ndis filter drivers指南.pdf

Documents