破解电信、网通、铁通接入商限制共享上网三——修改TTL驱动程序

破解电信、网通、铁通接入商限制共享上网一：http://blog.csdn.net/kl222/article/details/7762340

破解电信、网通、铁通接入商限制共享上网二 —— PPPOE输入的IP数据包的TTL置0

 

接入商通过修改IP数据包的TTL为0，限制共享上网。现在我们修改流入的IP的TTL大于0。

多平台（x86、ia64、amd64），在ddk3790下编译通过：

编译好的驱动下载：http://download.csdn.net/detail/kl222/6648507

源码下载：http://download.csdn.net/detail/kl222/6650033

windows xp:

源码下载：http://download.csdn.net/detail/kl222/4449266

驱动程序下载：http://download.csdn.net/detail/kl222/4449316 

一  NDIS驱动程序分类.
    NDIS(Network Driver Interface Specification)是Windows网络驱动程序接口标准，NDIS驱动程序分为三类：
1. NDIS Miniport NIC Driver: 底层的微端口NIC驱动，这就是网络设备的物理的驱动程序了。
2. NDIS Protocol Driver: 高层的协议驱动，用来实现某个具体的协议栈，如TCP/IP协议栈，
   并向上导出TDI接口。
3. NDIS Intermediate Driver: 中间层驱动，位于Miniport Driver和Protocol Driver之间。

二  NDIS驱动结构简介.

                      TDI(Transport Driver Interface)
          _______________________________________________________
                           |                     |  
                   ________|__________    _______|_______  
                  |                   |  |               |
           _____  |  LAN Protocols    |  |               |
           |    | |___________________|  |               |
           |    |_____________________   |    Native     |
           |                          |  |    Media      |
           | N       LAN Media Type   |  |    Aware      |
           | D   _____________________|  |    Protocol   |
           | I  |   __________________   |               |
           | S  |  |                  |  |               |
           |    |  |NDIS Intermediate |  |               |
           | I  |  |__________________|  |_______________| 
           | N  |_________________________________________ 
           | T                                            |
           | E             Native Media Type              |    
           | R  __________________________________________|
           | F  |  _________________    __________________
           | A  | |                 |  |                  |
           | C  | | NDIS Miniport   |  |  NDIS Miniport   |
           | E  | |_________________|  |__________________|
           |    |_________________________________________
           |                                              |
           |                NDIS Interface                |
           |______________________________________________|
                    ________________    ______________
                   |                |  |              |
                   |    NetCard     |  |   NetCard    |
                   |________________|  |______________|
                                    图一

三 NDIS驱动程序的数据处理流程

         ________________________    _____
        |                        |  |     |
        |    Transport Driver    |  |     |
        |________________________|  |     |  
        | Protocol Xxx - Media X |  |     |
        +------------------------+  |     |
         ___________________________|     |
        |___________________________      |                        
                                    |     |           
         ________________________   |     | 
        | Miniport Xxx - Media X |  |     |
        +------------------------|  |     |
        |                        |  |     |
        |  Intermediate Driver   |  |     |
        |________________________|  |     |  
        | Protocol Xxx - Media Y |  |     |
        +------------------------+  |     |
                                    |     |
         ___________________________|     |
        |___________________________      |
                                    |     | 
         ________________________   |     | 
        | Miniport Xxx - Media Y |  |     |
        +------------------------|  |     |
        |                        |  |     |
        |      NIC Driver        |  |     |
        |________________________|  |     |  
                                    |     | 
         ___________________________|     |
        |_________________________________|  
             _________________
            |                 |
            |       NIC       |
            |_________________| 
                   图二    

 

 

程序讲解：

passthru是DDK提供的一个网络ndis中间驱动程序。

PtReceivePacket是底层接收到数据包后，就调用此函数，我们也就在此函数中修改IP的TTL值大于0。ip.c 中的 OnProcessMyPacket 就是我们修改TTL。

INT OnProcessMyPacket(PNDIS_PACKET Packet)
{
	int nRet = 0;
	UINT nPhysicalBufferCount = 0, nBufferCount = 0, nTotalPacketLength = 0;
	PNDIS_BUFFER pFirstBuffer = NULL;
	char * pBuf = NULL;
	UINT nLen = 0;
	struct ip_hdr * ipHdr = NULL;
	struct ethhdr * pEthHdr = NULL;
	struct ppp_hdr *pPppHdr = NULL;


	if(!Packet)
	{
		return 0;
	}

	NdisQueryPacket(Packet, &nPhysicalBufferCount, &nBufferCount, &pFirstBuffer, &nTotalPacketLength);
	DbgPrint("PtReceivePacket:nPhysicalBufferCount:%d;nBufferCount:%d;nTotalPacketLength:%d\n",
		nPhysicalBufferCount, nBufferCount, nTotalPacketLength);

	//判断包头是否是正常长度
	if(nTotalPacketLength < PPPOE_HEAD_LENGTH)
	{
		return 0;
	} // 结束 if(nTotalPacketLength < PPPOE_HEAD_LENGTH)

	//我机器缓存比较大，所有包都在一个BUFFER中，如果你的机器比较差，你需要遍历所有BUFFER
	NdisQueryBufferSafe(pFirstBuffer, &pBuf, &nLen, HighPagePriority);

	pEthHdr = (struct ethhdr * )pBuf;

	//是否是PPPOE荷载包
	if(pEthHdr->h_proto != htons(ETH_TYPE_PPPOE))
	{
		return nRet;
	} // 结束 if(pEthHdr->h_proto != htons(ETH_TYPE_PPPOE))

	pPppHdr = (struct ppp_hdr * )(pBuf + sizeof(struct ethhdr));
	//dump((char*)pBuf,  nLen, "pppoe");
	//是否是IP协议包
	if(htons(PPPOE_TYPE_IP) != pPppHdr->protol)
	{
		return nRet;
	} // 结束 if(htons(ETH_TYPE_IP) != pppId)

	DbgPrint("PtReceivePacket is ip over pppoe packet \n");
	ipHdr = (struct ip_hdr * )(pBuf + sizeof(struct ethhdr) + 8);

	ipHdr->ip_ttl = 30;//设置TTL

	//校验和
	ip_checksum(ipHdr);

	return nRet;
}

 

 

校验和：

/*计算校验和*/
UINT16 checksum(void *buf,int len)
{
	UINT32 sum = 0;
	UINT16 * cbuf;

	dump((char*)buf, len, NULL);
	DbgPrint("checksum:head len:%d\n", len);
	if(len < IP_HDR_LEN)
	{
		DbgPrint("ip head len < %d\n", IP_HDR_LEN);
		return 0;
	} // 结束 if(len < IP_HDR_LEN)
	
	cbuf = (UINT16 * )buf;

	while(len>1){
		sum += *cbuf++;
		len -= 2;
	}

	if(len)
		sum += *(UINT8 * )cbuf;

	while(sum >> 16)
	{
		sum = (sum & 0xffff) + (sum >> 16);
	} // 结束 while(sum >> 16)

	return ~sum;
}

void ip_checksum(struct ip_hdr * ipHdr)
{
	ipHdr->ip_sum = 0;
	DbgPrint("checksum:ip->ip_hl:%02X\n", ipHdr->ip_hl);
	ipHdr->ip_sum = checksum(ipHdr, ipHdr->ip_hl << 2);

}

 

程序编译：

本驱动用windows ddk 3790版本编译。

安装windows ddk 3790

在开始菜单中找到ddk，点击相应平台的命令菜单，出现命令行编译环境。

在命令行中切换到此驱动源码目录，运行：

build