如何使用 NDIS 筛选器驱动程序发送任意数据包？

Question

我目前正在尝试使用Windows 驱动程序示例中的 NDIS 筛选器驱动程序发送我自己的数据包。

我认为我必须使用该功能发送数据包FilterSendNetBufferLists。但我不知道如何创建这些数据包，也不知道是否应该将它们添加到现有的 NetBufferList 中或创建自己的数据包。

我还需要修改功能吗FilterSendNetBufferListsComplete？

Answer 1

1. 当您的驱动程序启动 (DriverEntry) 或当您的筛选器连接到微型端口 (FilterAttach) 时，请使用NdisAllocateNetBufferListPool. 对于典型用法，您需要为每个 NBL 自动获取一个 NET_BUFFER (NB)，因此设置fAllocateNetBuffer=TRUE。如果您希望 NDIS 为您分配数据有效负载缓冲区，请同时指定一个非零的 DataSize。如果您已经在其他缓冲区中拥有数据包有效负载，则可以通过将 NB 指向现有的 MDL 来更快地传输，但这也使编码更加复杂。
2. 要发送数据包，请从 分配一个新的 NBL NdisAllocateNetBufferAndNetBufferList。将 FilterModuleHandle 放入 NBL->SourceHandle 中。分配 NB->DataLength 并复制数据。在新 NBL 上调用 NdisFSendNetBufferLists。在将 NBL 返还给您之前，请勿触摸它。
3. Eventually, NDIS will return the NBL back to you via FilterSendNetBufferListsComplete. Note that all NBLs come through there in one jumbled linked list -- both your own NBLs, as well as any NBLs you just passed through from above. So you have to slice the linked list based on NBL->SourceHandle: if the SourceHandle is yours, take the NBL out of the stream and free it via NdisFreeNetBufferList. Otherwise, if the NBL is not yours, continue propagating it along by calling NdisFSendNetBufferListsComplete.
4. Do not allow FilterPause to complete until all the NBLs you originated have been returned to you. You can do this any way you want, but the usual approach is to add some refcounting to the send and sendcomplete paths. You are not required to worry about any NBLs that you didn't create.

When you're creating NBLs, you can use !ndiskd.nbl to double-check your work. It can detect a variety of errors. There's a likely problem with the NBL if ndiskd reports any field in red text.