【转帖】 NDIS Hook的框架代码

Myth丶恋晨 2022-08-23 15:56 234阅读 0赞

//Protocol Wrapper Version 1.05
    //Author:  gjp
    //email:   gjpland@netease.com
    //
    
    
    #include "NdisHook.h"
    #include "HookRule.h"
    
    #pragma pack(push)
    #pragma pack(1)
    typedef struct _HOOK_CONTEXT_STRUCT
    {
       
    	//runtime code
    	ubyte    code1_0x58; //0x58 | pop  eax      | pop caller IP from stack to eax
    	ubyte    code2_0x68; //0x68 | push IMM      | push our hook context address
    	struct _HOOK_CONTEXT_STRUCT *m_pHookContext;//point this 
    	ubyte    code3_0x50; //0x50 | push eax		| push caller IP from eax to stack 
    	ubyte    code4_0xE9; //0xE9 | jmp HookProc  | jump our hook proc
    	udword   m_pHookProcOffset;
    
    	//our context data
    
    	PVOID    m_pOriginalProc;
    	PVOID    m_pHookProc;
    	PVOID    m_pBindAdaptHandle;
    	PVOID    m_pProtocolContent;
    	PVOID   *m_ppOriginPtr;
    
    	struct _HOOK_CONTEXT_STRUCT *m_pHookNext;
    	
    }HOOK_CONTEXT_STRUCT;
    #pragma pack(pop)
    
    HOOK_CONTEXT_STRUCT *m_pOurAllOfHookContext = NULL;
    
    dword		   m_IsFilterEnabled     = FALSE;
    NDIS_HANDLE    m_ourPacketPoolHandle = NULL;
    NDIS_HANDLE    m_ourBufferPoolHandle = NULL;
    PNDIS_PACKET   m_ourPacketHandle     = NULL;
    PNDIS_BUFFER   m_ourBufferHandle     = NULL;
    PVOID          m_ourBuffer		     = NULL;
    
    void      ReadPacket(PNDIS_PACKET Packet,PVOID pBuffer,udword dwBufSize);
    uword     wswap(uword value);
    
    void HookUnload(void)
    {
       
    	ReleaseHookFunc();
    
    	if( m_ourBufferHandle )
    	{
       
    		NdisFreeBuffer(m_ourBufferHandle);
    		m_ourBufferHandle = NULL;
    	}
    	if( m_ourBuffer )
    	{
       
    		NdisFreeMemory(m_ourBuffer,MAX_PACKET_SIZE,0);
    		m_ourBuffer = NULL;
    	}
    	if( m_ourPacketHandle )
    	{
       
    		NdisFreePacket(m_ourPacketHandle);
    		m_ourPacketHandle = NULL;
    	}
    	if( m_ourBufferPoolHandle )
    	{
       
    		NdisFreeBufferPool(m_ourBufferPoolHandle);
    		m_ourBufferPoolHandle = NULL;
    	}
    	if( m_ourPacketPoolHandle )
    	{
       
    		NdisFreePacketPool(m_ourPacketPoolHandle);
    		m_ourPacketPoolHandle = NULL;
    	}
    	return;
    }
    dword HookInit(void)
    {
       
    	NTSTATUS status;
    
    	m_ourPacketPoolHandle = NULL;
    	NdisAllocatePacketPool(&status,&m_ourPacketPoolHandle,0xFFF,0x10);
    	if( status != NDIS_STATUS_SUCCESS )
    		return FALSE;
    
    	m_ourBufferPoolHandle = NULL;
    	NdisAllocateBufferPool(&status,&m_ourBufferPoolHandle,0x10);
    	if( status != NDIS_STATUS_SUCCESS )
    		return FALSE;
    
    	m_ourBuffer = NULL;
    	status = NdisAllocateMemoryWithTag(&m_ourBuffer,MAX_PACKET_SIZE,'NAMW');
    	if( status != NDIS_STATUS_SUCCESS )
    		return FALSE;
    
    	m_ourBufferHandle = NULL;
    	NdisAllocateBuffer(&status,&m_ourBufferHandle,m_ourBufferPoolHandle,m_ourBuffer,MAX_PACKET_SIZE);
        if( status != NDIS_STATUS_SUCCESS )
    		return FALSE;
    
    	m_ourPacketHandle = NULL;
    	NdisAllocatePacket(&status,&m_ourPacketHandle,m_ourPacketPoolHandle);
    	if( status != NDIS_STATUS_SUCCESS )
    		return FALSE;
    
    	NdisChainBufferAtFront(m_ourPacketHandle,m_ourBufferHandle);
    	return TRUE;
    }
    
    typedef struct _NDIS41_PROTOCOL_CHARACTERISTICS
    {
       
    #ifdef __cplusplus
    	NDIS40_PROTOCOL_CHARACTERISTICS	Ndis40Chars;
    #else
    	NDIS40_PROTOCOL_CHARACTERISTICS;
    #endif
    	
    	//
    	// Start of NDIS 4.1 extensions.
    	//
    
    	CO_SEND_COMPLETE_HANDLER		CoSendCompleteHandler;
    	CO_STATUS_HANDLER				CoStatusHandler;
    	CO_RECEIVE_PACKET_HANDLER		CoReceivePacketHandler;
    	CO_REQUEST_HANDLER				CoRequestHandler;
    	CO_REQUEST_COMPLETE_HANDLER		CoRequestCompleteHandler;
    
    } NDIS41_PROTOCOL_CHARACTERISTICS;
    
    dword HookProtocol(void)
    {
       
    	//Default ndis version is 5.0
    	NDIS_PROTOCOL_CHARACTERISTICS ourNPC;
    	NDIS_STRING protoName = NDIS_STRING_CONST("HdFw_Slot");
    	NDIS_STATUS Status;
    	NDIS_HANDLE ourProtocolHandle = NULL;
    	byte  *ProtocolChain;
    	dword  offset;
    	dword  len;
    
    //	NDIS_PROTOCOL_BLOCK *pNdisBlock = NULL;
    
    //	pNdisBlock = pNdisBlock->NextProtocol;
    //	pNdisBlock->NextProtocol = NULL;
    
    	memset(&ourNPC,0,sizeof(NDIS_PROTOCOL_CHARACTERISTICS));
    
    
    	if( m_dwMajorVersion == 0x03 )
    	{
       
    		len = sizeof(NDIS30_PROTOCOL_CHARACTERISTICS);
    		//We must need at least ndis version 3.10
    		ourNPC.MajorNdisVersion = 0x03;
    		ourNPC.MinorNdisVersion = 0x0A;
    	}
    	else
    	if( m_dwMajorVersion == 0x04 )
    	{
       
    		len = sizeof(NDIS40_PROTOCOL_CHARACTERISTICS);
    
    		ourNPC.MajorNdisVersion = 0x04;
    		ourNPC.MinorNdisVersion = 0x00;
    	}
    	else
    	{	//treat as version 5.0
    		len = sizeof(NDIS50_PROTOCOL_CHARACTERISTICS);
    		
    		ourNPC.MajorNdisVersion = 0x05;
    		ourNPC.MinorNdisVersion = 0x00;
    	}
    
        ourNPC.Name                        = protoName;
        ourNPC.OpenAdapterCompleteHandler  = PtOpenAdapterComplete;
        ourNPC.CloseAdapterCompleteHandler = PtCloseAdapterComplete;
        ourNPC.SendCompleteHandler         = PtSendComplete;
        ourNPC.TransferDataCompleteHandler = PtTransferDataComplete;
        ourNPC.ResetCompleteHandler        = PtResetComplete;
        ourNPC.RequestCompleteHandler      = PtRequestComplete;
        ourNPC.ReceiveHandler              = PtReceive;
        ourNPC.ReceiveCompleteHandler      = PtReceiveComplete;
        ourNPC.StatusHandler               = PtStatus;
        ourNPC.StatusCompleteHandler       = PtStatusComplete;
        ourNPC.BindAdapterHandler          = PtBindAdapter;
        ourNPC.UnbindAdapterHandler        = PtUnbindAdapter;
        ourNPC.UnloadHandler               = PtUnload;
        ourNPC.ReceivePacketHandler        = PtReceivePacket;
        ourNPC.PnPEventHandler             = PtPNPHandler;
    
    	NdisRegisterProtocol(&Status,&ourProtocolHandle,&ourNPC,len);
    	if( !NT_SUCCESS(Status) || ourProtocolHandle == NULL )
    		return FALSE;
    
    	//NdisRegisterProtocol  return hand reference of NDIS_PROTOCOL_BLOCK;
    	ProtocolChain = (byte *)ourProtocolHandle;
    	while(1)
    	{
       
    		DebugInfoCount++;
    
    		//Obtain pointer to next protocol link.
    		if( m_dwMajorVersion == 0x03 )
    			offset = 4;
    		else
    		if( m_dwMajorVersion == 0x04 )
    		{
       
    			if( m_dwMinorVersion == 0x01 )
    				offset = 0x8C;
    			else
    				offset = 0x60;
    		}
    		else
    		if( m_dwMajorVersion == 0x05 )
    			//NDIS_PROTOCOL_BLOCK->NextProtocol
    			offset = 0x10;
    		else
    			//Error
    			break;
    
    		ProtocolChain = ((byte **)(ProtocolChain + offset))[0];
    		if( ProtocolChain == NULL )
    			break;
    
    		HookFuncBlock(ProtocolChain);
    	}
    	if( m_dwMajorVersion != 4 )
    		NdisDeregisterProtocol(&Status,ourProtocolHandle);
    	else
    	{
       
    //		((byte *)ourProtocolHandle)[0x0C] = 0x01;
    //		NdisDeregisterProtocol(&Status,ourProtocolHandle);
    	}
    	return TRUE;
    }
    // ProtocolContent
    // Version      NextChain offset    NDIS_PROTOCOL_CHARACTERISTICS offset   BindingAdaptHandle offset 
    // NDIS 3.XX	   0x04						  0x14									0x08
    // NDIS 4.XX	   0x60						  0x14									0x00
    // NDIS 4.01       0x8C						  0x14									0x00
    // NDIS 5.XX       0x10						  0x14									0x00
    
    
    //-----
    VOID HookProtocolSendPackets(
        IN  HOOK_CONTEXT_STRUCT    *pOurContext,	  	
    	IN NDIS_HANDLE				MiniportAdapterContext,
    	IN PPNDIS_PACKET			PacketArray,
    	IN UINT						NumberOfPackets
    	);
    
    NDIS_STATUS HookProtocolWanSend(
        IN  HOOK_CONTEXT_STRUCT    *pOurContext,	  	
    	IN	NDIS_HANDLE				MacBindingHandle,
    	IN	NDIS_HANDLE				LinkHandle,
    	IN	PVOID					Packet
    	);
    NDIS_STATUS HookProtocolSend(
        IN  HOOK_CONTEXT_STRUCT    *pOurContext,	  	
    	IN	NDIS_HANDLE				MacBindingHandle,
    	IN	PNDIS_PACKET			Packet
    	);
    
    NDIS_STATUS  HookProtocolReceive(
    	  IN HOOK_CONTEXT_STRUCT *pOurContext,	  	
    	  IN NDIS_HANDLE  ProtocolBindingContext,
          IN NDIS_HANDLE  MacReceiveContext,
          IN PVOID		  HeaderBuffer,
          IN UINT		  HeaderBufferSize,
          IN PVOID		  LookAheadBuffer,
          IN UINT		  LookaheadBufferSize,
          IN UINT		  PacketSize
          );
    NDIS_STATUS  HookWanReceive(
    	    IN  HOOK_CONTEXT_STRUCT	   *pOurContext,	  	
    		IN	NDIS_HANDLE				NdisLinkHandle,
    		IN	PUCHAR					Packet,
    		IN	ULONG					PacketSize
    		);
    INT	HookProtocolReceivePacket(
        IN  HOOK_CONTEXT_STRUCT    *pOurContext,	  	
    	IN	NDIS_HANDLE				ProtocolBindingContext,
    	IN	PNDIS_PACKET			Packet
    	);
    
    VOID HookBindAdapterHandler(
    						    IN  HOOK_CONTEXT_STRUCT *pOurContext,	  	
    							OUT PNDIS_STATUS	Status,
    							IN  NDIS_HANDLE		BindContext,
    							IN  PNDIS_STRING	DeviceName,
    							IN  PVOID			SystemSpecific1,
    							IN  PVOID			SystemSpecific2);
    
    VOID  HookSendComplete(
          IN  HOOK_CONTEXT_STRUCT *pOurContext,	  	
          IN NDIS_HANDLE  ProtocolBindingContext,
          IN PNDIS_PACKET  Packet,
          IN NDIS_STATUS Status
          );
    
    
    void   ReleaseHookFunc(void)
    {
       
    
    	HOOK_CONTEXT_STRUCT *pHookContext,*pNext;
    
    	pHookContext = m_pOurAllOfHookContext;
    	m_pOurAllOfHookContext = NULL;
    	while(pHookContext)
    	{
       
    		pNext = pHookContext->m_pHookNext;
    		pHookContext->m_ppOriginPtr[0] = pHookContext->m_pOriginalProc;
    		ExFreePool(pHookContext);
    		pHookContext = pNext;
    	}
    	return;
    }
    
    HOOK_CONTEXT_STRUCT *IsHookedNdisFunc(PVOID pAddr)
    {
       
    
    	HOOK_CONTEXT_STRUCT *pHookContext;
    
    	pHookContext = m_pOurAllOfHookContext;
    	while(pHookContext)
    	{
       
    		if( pHookContext == pAddr )
    			break;
    		pHookContext = pHookContext->m_pHookNext;
    	}
    	return pHookContext;
    }
    HOOK_CONTEXT_STRUCT *IsHookedNdisFuncEx(PVOID *pAddr)
    {
       
    
    	HOOK_CONTEXT_STRUCT *pHookContext;
    
    	pHookContext = m_pOurAllOfHookContext;
    	while(pHookContext)
    	{
       
    		if( pHookContext->m_ppOriginPtr == pAddr )
    			break;
    		pHookContext = pHookContext->m_pHookNext;
    	}
    	return pHookContext;
    }
    
    HOOK_CONTEXT_STRUCT *HookNdisFunc(PVOID pHookProc,PVOID *ppOrigProc,PVOID pBindAdaptHandle,PVOID pProtocolContent)
    {
       
    
    	HOOK_CONTEXT_STRUCT *pHookContext;
    	PVOID OrgFunc;
    
    	pHookContext = IsHookedNdisFunc(ppOrigProc[0]);
    	if( pHookContext )
    		OrgFunc = pHookContext->m_pOriginalProc;
    	else
    		OrgFunc = ppOrigProc[0];
    	if( OrgFunc == NULL )
    		return NULL;
    
    	pHookContext = IsHookedNdisFuncEx(ppOrigProc);
    	if( pHookContext )
    		return pHookContext;
    	pHookContext = ExAllocatePoolWithTag(NonPagedPool,sizeof(HOOK_CONTEXT_STRUCT),'HCSP');
    	if( pHookContext == NULL )
    		return NULL;
    	memset(pHookContext,0,sizeof(HOOK_CONTEXT_STRUCT));
    
    	pHookContext->code1_0x58 = 0x58;
    	pHookContext->code2_0x68 = 0x68;
    	pHookContext->code3_0x50 = 0x50;
    	pHookContext->code4_0xE9 = 0xE9;
    
    	pHookContext->m_pHookContext     = pHookContext;
    	pHookContext->m_pHookProcOffset	 = ((udword)pHookProc) - (((udword)&pHookContext->m_pHookProcOffset) + sizeof(udword));
    	pHookContext->m_pBindAdaptHandle = pBindAdaptHandle;
    	pHookContext->m_pProtocolContent = pProtocolContent;
    	pHookContext->m_pOriginalProc    = OrgFunc;//ppOrigProc[0];
    	pHookContext->m_ppOriginPtr      = ppOrigProc;
    	pHookContext->m_pHookProc        = pHookProc;
    	pHookContext->m_pHookNext        = m_pOurAllOfHookContext;
    	m_pOurAllOfHookContext			 = pHookContext;
    
    	ppOrigProc[0] = pHookContext;
    	return pHookContext;
    }
    
    typedef 
    struct _NDIS40_OPEN_BLOCK
    {
       
    	PNDIS_MAC_BLOCK				MacHandle;			// pointer to our MAC
    	NDIS_HANDLE					MacBindingHandle;	// context when calling MacXX funcs
    	PNDIS_ADAPTER_BLOCK			AdapterHandle;		// pointer to our adapter
    	PNDIS_PROTOCOL_BLOCK		ProtocolHandle;		// pointer to our protocol
    	NDIS_HANDLE					ProtocolBindingContext;// context when calling ProtXX funcs
    	PNDIS_OPEN_BLOCK			AdapterNextOpen;	// used by adapter's OpenQueue
    	PNDIS_OPEN_BLOCK			ProtocolNextOpen;	// used by protocol's OpenQueue
    	PFILE_OBJECT				FileObject;			// created by operating system
    	BOOLEAN						Closing;			// TRUE when removing this struct
    	BOOLEAN						Unloading;			// TRUE when processing unload
    	NDIS_HANDLE					CloseRequestHandle;	// 0 indicates an internal close
    	KSPIN_LOCK					SpinLock;			// guards Closing
    	PNDIS_OPEN_BLOCK			NextGlobalOpen;
    
    	//
    	// These are optimizations for getting to MAC routines.	They are not
    	// necessary, but are here to save a dereference through the MAC block.
    	//
    
    	SEND_HANDLER				SendHandler;
    	TRANSFER_DATA_HANDLER		TransferDataHandler;
    
    	//
    	// These are optimizations for getting to PROTOCOL routines.  They are not
    	// necessary, but are here to save a dereference through the PROTOCOL block.
    	//
    
    	SEND_COMPLETE_HANDLER		SendCompleteHandler;
    	TRANSFER_DATA_COMPLETE_HANDLER TransferDataCompleteHandler;
    	RECEIVE_HANDLER				ReceiveHandler;
    	RECEIVE_COMPLETE_HANDLER	ReceiveCompleteHandler;
    
    	//
    	// Extentions to the OPEN_BLOCK since Product 1.
    	//
    	RECEIVE_HANDLER				PostNt31ReceiveHandler;
    	RECEIVE_COMPLETE_HANDLER	PostNt31ReceiveCompleteHandler;
    
    	//
    	// NDIS 4.0 extensions
    	//
    	RECEIVE_PACKET_HANDLER		ReceivePacketHandler;
    	SEND_PACKETS_HANDLER		SendPacketsHandler;
    
    	//
    	// Needed for PnP
    	//
    	UNICODE_STRING				AdapterName;		// Upcased name of the adapter we are bound to
    }NDIS40_OPEN_BLOCK,*PNDIS40_OPEN_BLOCK;
    
    void HookFuncBlock(byte *ProtocolContent)
    {
       
    
    	PNDIS_PROTOCOL_CHARACTERISTICS pProChar;
    	dword IsWan;
    	NDIS_STRING WanString       = NDIS_STRING_CONST("NDISWAN");
    	NDIS_STRING DeviceWanString = NDIS_STRING_CONST("//DEVICE//NDISWAN");
    
    	NDIS_STRING TcpipString     = NDIS_STRING_CONST("Tcpip");
    	NDIS_STRING TcpArpString    = NDIS_STRING_CONST("TCPIP_WANARP");
    	NDIS_STRING RasArpString    = NDIS_STRING_CONST("RASARP");
    
    	if( ProtocolContent == NULL )
    		return;
    	//Get pointer to NDIS_PROTOCOL_CHARACTERISTICS from protocol content
    	pProChar = (PNDIS_PROTOCOL_CHARACTERISTICS)(ProtocolContent + 0x14);
    
    	if( KeGetCurrentIrql() == PASSIVE_LEVEL )
    	{
       
    		//Check protocol name whether is Wan Lan protocol so that we can correctly hook our function
    		if( !RtlCompareUnicodeString(&pProChar->Name,&WanString,TRUE) ||
    			!RtlCompareUnicodeString(&pProChar->Name,&DeviceWanString,TRUE) )
    		{ 
    			IsWan = 1;
    		}
    		else
    			IsWan = 0;
    
    		//We r only interest in following protocol 
    		if( !(!RtlCompareUnicodeString(&pProChar->Name,&TcpipString,TRUE) ||
    			!RtlCompareUnicodeString(&pProChar->Name,&TcpArpString,TRUE) ||
    			!RtlCompareUnicodeString(&pProChar->Name,&RasArpString,TRUE)) )
    		{ 
    			return;
    		}
    	}
    	else
    		IsWan = 0;
    
    	//
    	if( !IsWan )
    	{
       
    		HookNdisFunc(HookProtocolReceive,(PVOID *)&pProChar->ReceiveHandler,NULL,ProtocolContent);
    
    		//{
       {added by gjp 6.24
    //		__asm int 3;
    //		HookNdisFunc(HookSendComplete,(PVOID *)&pProChar->SendCompleteHandler,NULL,ProtocolContent);
    		//}}
    	}
    	else
    		HookNdisFunc(HookWanReceive,(PVOID *)&pProChar->WanReceiveHandler,NULL,ProtocolContent);
    	
    	if(pProChar->MajorNdisVersion > 0x03 )
    	{
       
    		HookNdisFunc(HookProtocolReceivePacket,(PVOID *)&pProChar->ReceivePacketHandler,NULL,ProtocolContent);
    		HookNdisFunc(HookBindAdapterHandler,(PVOID *)&pProChar->BindAdapterHandler,NULL,ProtocolContent);
    		
    	}
    
    	//pProChar->Name;
    	//We should obtain and save BindAdaptHandle in order to pass it to NdisTransferData
    	//BindAdaptHandle is pNdisOpenBlock
    	if( m_dwMajorVersion == 0x05 )
    	{
       
    		PNDIS_OPEN_BLOCK pNdisOpenBlock;
    
    		pNdisOpenBlock = ((PNDIS_OPEN_BLOCK *)ProtocolContent)[0];
    		while(pNdisOpenBlock)
    		{
       
    			//__asm int 3;
    			if( !IsWan )
    			{
       
    				HookNdisFunc(HookProtocolSend,(PVOID *)&pNdisOpenBlock->SendHandler,pNdisOpenBlock,ProtocolContent);
    				HookNdisFunc(HookProtocolReceive,(PVOID *)&pNdisOpenBlock->PostNt31ReceiveHandler,pNdisOpenBlock,ProtocolContent);
    				//{
       {added by gjp 6.24
    //				__asm int 3;
    //				HookNdisFunc(HookSendComplete,(PVOID *)&pNdisOpenBlock->SendCompleteHandler,pNdisOpenBlock,ProtocolContent);
    				//}}
    			}
    			else
    			{
       
    				HookNdisFunc(HookProtocolWanSend,(PVOID *)&pNdisOpenBlock->WanSendHandler,pNdisOpenBlock,ProtocolContent);
    				HookNdisFunc(HookWanReceive,(PVOID *)&pNdisOpenBlock->WanReceiveHandler,pNdisOpenBlock,ProtocolContent);
    			}
    			HookNdisFunc(HookProtocolReceive,(PVOID *)&pNdisOpenBlock->ReceiveHandler,pNdisOpenBlock,ProtocolContent);
    			HookNdisFunc(HookProtocolReceivePacket,(PVOID *)&pNdisOpenBlock->ReceivePacketHandler,pNdisOpenBlock,ProtocolContent);
    			HookNdisFunc(HookProtocolSendPackets,(PVOID *)&pNdisOpenBlock->SendPacketsHandler,pNdisOpenBlock,ProtocolContent);
    			pNdisOpenBlock = pNdisOpenBlock->ProtocolNextOpen;
    		}
    	}
    	else
    	if( m_dwMajorVersion == 0x04 )
    	{
       
    		PNDIS40_OPEN_BLOCK pNdisOpenBlock;
    		pNdisOpenBlock = ((PNDIS40_OPEN_BLOCK *)ProtocolContent)[0];
    
    		while(pNdisOpenBlock)
    		{
       
    			if( !IsWan )
    			{
       
    				HookNdisFunc(HookProtocolSend,(PVOID *)&pNdisOpenBlock->SendHandler,pNdisOpenBlock,ProtocolContent);
    				HookNdisFunc(HookProtocolReceive,(PVOID *)&pNdisOpenBlock->PostNt31ReceiveHandler,pNdisOpenBlock,ProtocolContent);
    			}
    			else
    			{
       
    				HookNdisFunc(HookProtocolWanSend,(PVOID *)&pNdisOpenBlock->SendHandler,pNdisOpenBlock,ProtocolContent);
    				HookNdisFunc(HookWanReceive,(PVOID *)&pNdisOpenBlock->PostNt31ReceiveHandler,pNdisOpenBlock,ProtocolContent);
    			}
    
    			HookNdisFunc(HookProtocolReceive,(PVOID *)&pNdisOpenBlock->ReceiveHandler,pNdisOpenBlock,ProtocolContent);
    			HookNdisFunc(HookProtocolReceivePacket,(PVOID *)&pNdisOpenBlock->ReceivePacketHandler,pNdisOpenBlock,ProtocolContent);
    			HookNdisFunc(HookProtocolSendPackets,(PVOID *)&pNdisOpenBlock->SendPacketsHandler,pNdisOpenBlock,ProtocolContent);
    			pNdisOpenBlock = (PNDIS40_OPEN_BLOCK)pNdisOpenBlock->ProtocolNextOpen;
    		}
    //		HookNdisFunc(HookProtocolReceivePacket,(PVOID *)&pNdisOpenBlock->ReceivePacketHandler,pNdisOpenBlock,ProtocolContent);
    		
    	}
    	else
    	if( m_dwMajorVersion == 0x03 )
    	{//Unknown information of ndis3.0 NDIS_OPEN_BLOCK struct
    
    	}
    	return;
    }
    void CheckSendHandle(HOOK_CONTEXT_STRUCT *pOurContext)
    {
       
    	HOOK_CONTEXT_STRUCT *pHookContext;
    
    	if( pOurContext == NULL ||
    		pOurContext->m_pBindAdaptHandle == NULL )
    		return;
    
    	if( m_dwMajorVersion == 5 )
    	{
       
    		PNDIS_OPEN_BLOCK pNdisOpenBlock;
    
    		pNdisOpenBlock = (PNDIS_OPEN_BLOCK)pOurContext->m_pBindAdaptHandle;
    
    		pHookContext = (HOOK_CONTEXT_STRUCT *)pNdisOpenBlock->SendHandler;
    		if( pHookContext )
    		{
       
    			if( !(pHookContext->m_ppOriginPtr == (PVOID *)&pNdisOpenBlock->SendHandler 
    			 && pHookContext->m_pHookProc   == (PVOID)HookProtocolSend) )
    			{
       
    
    				pHookContext = IsHookedNdisFuncEx((PVOID *)&pNdisOpenBlock->SendHandler);
    				if( pHookContext )
    				{
       
    					if( pHookContext->m_pOriginalProc == (PVOID)pNdisOpenBlock->SendHandler)
    					{
       
    						pNdisOpenBlock->SendHandler = (SEND_HANDLER)pHookContext;
    					}
    				}
    			}
    		}
    
    		pHookContext = (HOOK_CONTEXT_STRUCT *)pNdisOpenBlock->SendPacketsHandler;
    		if( pHookContext )
    		{
       
    			if( !(pHookContext->m_ppOriginPtr == (PVOID *)&pNdisOpenBlock->SendPacketsHandler
    			 && pHookContext->m_pHookProc   == (PVOID)HookProtocolSendPackets) )
    			{
       
    
    				pHookContext = IsHookedNdisFuncEx((PVOID *)&pNdisOpenBlock->SendPacketsHandler);
    				if( pHookContext )
    				{
       
    					if( pHookContext->m_pOriginalProc == (PVOID)pNdisOpenBlock->SendPacketsHandler)
    					{
       
    						pNdisOpenBlock->SendPacketsHandler = (SEND_PACKETS_HANDLER)pHookContext;
    					}
    				}
    			}
    		}
    	}
    	else
    	if( m_dwMajorVersion == 4 )
    	{
       
    		PNDIS40_OPEN_BLOCK pNdisOpenBlock;
    		pNdisOpenBlock = (PNDIS40_OPEN_BLOCK)pOurContext->m_pBindAdaptHandle;
    
    		pHookContext = (HOOK_CONTEXT_STRUCT *)pNdisOpenBlock->SendHandler;
    		if( pHookContext )
    		{
       
    			if( !(pHookContext->m_ppOriginPtr == (PVOID *)&pNdisOpenBlock->SendHandler 
    			 && pHookContext->m_pHookProc   == (PVOID)HookProtocolSend) )
    			{
       
    
    				pHookContext = IsHookedNdisFuncEx((PVOID *)&pNdisOpenBlock->SendHandler);
    				if( pHookContext )
    				{
       
    					if( pHookContext->m_pOriginalProc == (PVOID)pNdisOpenBlock->SendHandler)
    					{
       
    						pNdisOpenBlock->SendHandler = (SEND_HANDLER)pHookContext;
    					}
    				}
    			}
    		}
    
    		pHookContext = (HOOK_CONTEXT_STRUCT *)pNdisOpenBlock->SendPacketsHandler;
    		if( pHookContext )
    		{
       
    			if( !(pHookContext->m_ppOriginPtr == (PVOID *)&pNdisOpenBlock->SendPacketsHandler
    			 && pHookContext->m_pHookProc   == (PVOID)HookProtocolSendPackets) )
    			{
       
    
    				pHookContext = IsHookedNdisFuncEx((PVOID *)&pNdisOpenBlock->SendPacketsHandler);
    				if( pHookContext )
    				{
       
    					if( pHookContext->m_pOriginalProc == (PVOID)pNdisOpenBlock->SendPacketsHandler)
    					{
       
    						pNdisOpenBlock->SendPacketsHandler = (SEND_PACKETS_HANDLER)pHookContext;
    					}
    				}
    			}
    		}
    	}
    	return;
    }
    
    dword HookFilterBuffer(HOOK_CONTEXT_STRUCT *pOurContext,PVOID pBuffer,udword PacketSize,dword isOutgoing)
    {
       
    	NTSTATUS status;
    	dword result = TRUE;
    
    	switch(wswap(((PETHHDR)pBuffer)->h_proto))
    	{
       
    		case ETH_P_IP:
    		{
       
    			if( isOutgoing )
    				TotalSendBytes	  += PacketSize;
    			else
    				TotalReceiveBytes += PacketSize;
    			TotalIPPackets++;
    			result = AnalyzeIP( (PIPHdr)(&((byte *)pBuffer)[sizeof(ETHHDR)]),PacketSize - sizeof(ETHHDR), isOutgoing);
    			break;
    		}
    		case ETH_P_ARP:
    			TotalARPPackets++;
    			break;
    		case ETH_P_RARP:
    			break;
    		default:
    			TotalOtherPackets++;
    			break;
    	}
    	return result;
    }
    
    dword HookFilterReceivePacket(HOOK_CONTEXT_STRUCT *pOurContext,udword TotalPacketSize,PVOID pHeadBuffer,udword dwHeadSize,PNDIS_PACKET pPacket,dword isOutgoing)
    {
       
    	dword PacketSize;
    	PVOID pBuffer = NULL;
    	NTSTATUS status;
    	PNDIS_BUFFER firstBuffer,nextBuffer;
    	dword result = TRUE;
    	byte *pBuf;
    
        NdisQueryPacket(pPacket,NULL,NULL,NULL,&PacketSize);
    	if( /*!PacketSize ||*/ PacketSize + dwHeadSize < sizeof(ETHHDR) )
    		return TRUE;
    
    
    	status = NdisAllocateMemoryWithTag(&pBuffer,PacketSize + dwHeadSize,'NAMW');
    	if( status != NDIS_STATUS_SUCCESS || pBuffer == NULL )
    		return TRUE;//FALSE;
    //obtain content from the packet 
    
    	pBuf = (byte *)pBuffer;
    	NdisMoveMemory(pBuf,pHeadBuffer,dwHeadSize);
    	ReadPacket(pPacket,&pBuf[dwHeadSize],PacketSize);
    
    	result = HookFilterBuffer(pOurContext,pBuffer,TotalPacketSize + dwHeadSize,isOutgoing);
    	NdisFreeMemory(pBuffer,PacketSize + dwHeadSize,0);
    	return result;
    }
    
    // Filter Packet
    // return 0 = block this packet
    
    dword HookFilterPacket(HOOK_CONTEXT_STRUCT *pOurContext,PNDIS_PACKET pPacket,dword isOutgoing)
    {
       
    	dword PacketSize;
    	PVOID pBuffer = NULL;
    	NTSTATUS status;
    	PNDIS_BUFFER firstBuffer,nextBuffer;
    	dword result = TRUE;
    
        NdisQueryPacket(pPacket,NULL,NULL,NULL,&PacketSize);
    	if( /*!PacketSize ||*/ PacketSize < sizeof(ETHHDR) )
    		return TRUE;
    
    
    	status = NdisAllocateMemoryWithTag(&pBuffer,PacketSize,'NAMW');
    	if( status != NDIS_STATUS_SUCCESS || pBuffer == NULL )
    		return TRUE;//FALSE;
    //obtain content from the packet 
    	ReadPacket(pPacket,pBuffer,PacketSize);
    
    	result = HookFilterBuffer(pOurContext,pBuffer,PacketSize,isOutgoing);
    	NdisFreeMemory(pBuffer,PacketSize,0);
    	return result;
    }
    
    __declspec( naked ) 
    uword wswap(uword value)
    {
       
    	__asm
    	{
       
    		movzx eax,byte ptr [esp + 5];
    		mov   ah ,byte ptr [esp + 4];
    		ret	  4
    	}
    }
    
    void ReadPacket(PNDIS_PACKET Packet,PVOID pBuffer,udword dwBufSize)
    {
       
    	PVOID           virtualAddress;
    	PNDIS_BUFFER    firstBuffer, nextBuffer;
    	ULONG           totalLength;
    	UINT			len;
    	PVOID           pBuf = NULL;
    	dword           count = 0;
    
    	NdisQueryPacket(Packet, NULL, NULL, &firstBuffer, NULL);
    	while( firstBuffer != NULL)
    	{
       
    //NdisQueryBufferSafe can't use in wdm1.0
    //		NdisQueryBufferSafe(firstBuffer, &virtualAddress, 
    //								&len, 16 );
    		NdisQueryBuffer(firstBuffer, &virtualAddress, 
    							&len);
    		if(!virtualAddress) 
    		{
       
    			//
    			// System is running low on memory resources. 
    			// So fail the read.
    			// 
    			break;
    		}
    		if( count + len > dwBufSize )
    			break;
    		NdisMoveMemory(&((byte *)pBuffer)[count],virtualAddress,len);
    		count += len;
    		NdisGetNextBuffer(firstBuffer,  &nextBuffer);
    		firstBuffer = nextBuffer;
    	}
    	return;
    }
    
    //----
    VOID HookProtocolSendPackets(
        IN HOOK_CONTEXT_STRUCT     *pOurContext,	  	
    	IN NDIS_HANDLE				MiniportAdapterContext,
    	IN PPNDIS_PACKET			PacketArray,
    	IN UINT						NumberOfPackets
    	)
    {
       
    	udword x;
    
    	PPNDIS_PACKET FilterPacketArray;
    	UINT          NumberOfFilterPackets;
    	
    	if( pOurContext )
    	{
       
    
    		if( NumberOfPackets == 0 )
    		{
       
    			((SEND_PACKETS_HANDLER)pOurContext->m_pOriginalProc)(
    				MiniportAdapterContext,
    				PacketArray,
    				NumberOfPackets);
    			return;
    		}
    
    		FilterPacketArray = ExAllocatePoolWithTag(NonPagedPool,sizeof(PNDIS_PACKET) * NumberOfPackets,'HFPA');
    		if( FilterPacketArray == NULL )
    		{
       
    			((SEND_PACKETS_HANDLER)pOurContext->m_pOriginalProc)(
    				MiniportAdapterContext,
    				PacketArray,
    				NumberOfPackets);
    			return;
    		}
    
    		for(NumberOfFilterPackets = 0,x = 0; x < NumberOfPackets; x++ )
    		{
       
    
    			if( HookFilterPacket(pOurContext,PacketArray[x],TRUE) )
    			{
       
    				FilterPacketArray[NumberOfFilterPackets++] = PacketArray[x];
    			}
    		}
    		if( NumberOfFilterPackets )
    		{
       
    			((SEND_PACKETS_HANDLER)pOurContext->m_pOriginalProc)(
    				MiniportAdapterContext,
    				FilterPacketArray,
    				NumberOfFilterPackets);
    		}
    		ExFreePool(FilterPacketArray);
    	}
    	return;
    }
    
    NDIS_STATUS HookProtocolWanSend(
        IN  HOOK_CONTEXT_STRUCT    *pOurContext,	  	
    	IN	NDIS_HANDLE				MacBindingHandle,
    	IN	NDIS_HANDLE				LinkHandle,
    	IN	PVOID					Packet
    	)
    {
       
    	if( pOurContext )
    	{
       
    		return ((WAN_SEND_HANDLER)pOurContext->m_pOriginalProc)(
    			MacBindingHandle,
    			LinkHandle,
    			Packet);
    	}
    	return NDIS_STATUS_SUCCESS;
    }
    
    NDIS_STATUS HookProtocolSend(
        IN  HOOK_CONTEXT_STRUCT    *pOurContext,	  	
    	IN	NDIS_HANDLE				MacBindingHandle,
    	IN	PNDIS_PACKET			Packet
    	)
    {
       
    //	udword PacketSize;
    	NTSTATUS status = NDIS_STATUS_SUCCESS;
    
    	if( pOurContext )
    	{
       
    		if( HookFilterPacket(pOurContext,Packet,TRUE) )
    		{
       
    			status = ((SEND_HANDLER)pOurContext->m_pOriginalProc)(
    				MacBindingHandle,
    				Packet);
    		}
    		else
    			status = NDIS_STATUS_NOT_ACCEPTED;
    	}
    	return status;
    }
    
    INT	HookProtocolReceivePacket(
        IN  HOOK_CONTEXT_STRUCT    *pOurContext,	  	
    	IN	NDIS_HANDLE				ProtocolBindingContext,
    	IN	PNDIS_PACKET			Packet
    	)
    {
       
    	NTSTATUS status = NDIS_STATUS_SUCCESS;
    
    	if( pOurContext )
    	{
       
    		CheckSendHandle(pOurContext);
    
    		if( HookFilterPacket(pOurContext,Packet,FALSE) )
    		{
       
    			status = ((RECEIVE_PACKET_HANDLER)pOurContext->m_pOriginalProc)(
    					ProtocolBindingContext,
    					Packet);
    		}
    		else
    			status = NDIS_STATUS_NOT_ACCEPTED;
    	}
    	return status;
    }
    
    NDIS_STATUS  HookWanReceive(
    	    IN  HOOK_CONTEXT_STRUCT    *pOurContext,	  	
    		IN	NDIS_HANDLE				NdisLinkHandle,
    		IN	PUCHAR					Packet,
    		IN	ULONG					PacketSize
    		)
    {
       
    
    	if( pOurContext )
    	{
       
    		return ((WAN_RECEIVE_HANDLER)pOurContext->m_pOriginalProc)(
    					NdisLinkHandle,
    					Packet,
    					PacketSize);
    	}
    	return NDIS_STATUS_SUCCESS;
    }
    
    NDIS_STATUS  HookProtocolReceive(
    	  IN HOOK_CONTEXT_STRUCT *pOurContext,	  	
    	  IN NDIS_HANDLE  ProtocolBindingContext,
          IN NDIS_HANDLE  MacReceiveContext,
          IN PVOID		  HeaderBuffer,
          IN UINT		  HeaderBufferSize,
          IN PVOID		  LookAheadBuffer,
          IN UINT		  LookAheadBufferSize,
          IN UINT		  PacketSize
          )
    {
       
    	NTSTATUS status = NDIS_STATUS_SUCCESS;
    
    	if( pOurContext )
    	{
       
    
    		CheckSendHandle(pOurContext);
    //		TotalReceiveBytes += PacketSize;
    
    		if( pOurContext->m_pBindAdaptHandle )
    		{
       
    			udword len = 0;
    
    			if( PacketSize > LookAheadBufferSize )
    			{
       
    				NdisTransferData(&status,pOurContext->m_pBindAdaptHandle,MacReceiveContext,0,PacketSize,m_ourPacketHandle,&len);
    			}
    			else
    			{
       
    				NdisMoveMemory(m_ourBuffer,LookAheadBuffer,PacketSize);
    			}
    				
    			if( status == NDIS_STATUS_SUCCESS )
    			{
       
    				TotalTransferPackets++;
    
    				if( !HookFilterReceivePacket(pOurContext,PacketSize,HeaderBuffer,HeaderBufferSize,m_ourPacketHandle,FALSE) )
    				//if( !HookFilterPacket(pOurContext,m_ourPacketHandle,FALSE) )
    					return NDIS_STATUS_NOT_ACCEPTED;
    			}
    			else
    			if( status == NDIS_STATUS_PENDING )
    				//Warning: Here An Error will be occured.
    				TotalTransferPendingPackets++;
    			else
    				TotalTransferErrorPackets++;
    			
    		}
    		else
    		{
       
    			TotalUnbindTransferPackets++;
    		}
    		status = ((RECEIVE_HANDLER)pOurContext->m_pOriginalProc)(
    					ProtocolBindingContext,
    					MacReceiveContext,
    					HeaderBuffer,
    					HeaderBufferSize,
    					LookAheadBuffer,
    					LookAheadBufferSize,
    					PacketSize);
    	}
    	return status;
    }
    VOID HookBindAdapterHandler(
    						    IN  HOOK_CONTEXT_STRUCT *pOurContext,	  	
    							OUT PNDIS_STATUS	Status,
    							IN  NDIS_HANDLE		BindContext,
    							IN  PNDIS_STRING	DeviceName,
    							IN  PVOID			SystemSpecific1,
    							IN  PVOID			SystemSpecific2)
    {
       
    
    	if( pOurContext )
    	{
       
    		((BIND_HANDLER)pOurContext->m_pOriginalProc)(Status,BindContext,
    								DeviceName,
    								SystemSpecific1,
    								SystemSpecific2);
    
    		HookFuncBlock(pOurContext->m_pProtocolContent);
    		TotalTransferErrorPackets++;
    	}
    	return;
    }
    
    VOID  HookSendComplete(
          IN  HOOK_CONTEXT_STRUCT *pOurContext,	  	
          IN NDIS_HANDLE  ProtocolBindingContext,
          IN PNDIS_PACKET  Packet,
          IN NDIS_STATUS Status
          )
    {
       
    
    	__asm int 3;
    	((SEND_COMPLETE_HANDLER)pOurContext->m_pOriginalProc)(
    		ProtocolBindingContext,
    		Packet,
    		Status
    		);
    	return;
    }