Re: NDIS_MINIPORT_CHARACTERISTICS

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Alireza Dabagh [MS] (alid_at_online.microsoft.com)
Date: 05/25/04


Date: Mon, 24 May 2004 19:16:13 -0700

I am not sure what you mean by "patching NDIS routine". Could you please
elaborate?

I strongly advise against making any assumption about what miniport block
has or hijacking another driver's entry point (-if- by any chance this is
what you are trying to do).
-Many- (and I really mean "many") of our OCA crashes have to do with drivers
that -hijack- either NDIS or tcp/ip or a miniport driver's entry points. If
you need to intercept something, bite to bullet and write an IM driver no
matter how hard it is or how trivial you think it is to intercept a couple
of calls that NDIS makes to a miniport. We are addressing the issue of by
providing lightweight filters for Longhorn. Until then, please stick to
documented APIs.

If I misunderstood your intentions, I apologize.

>patching NDIS routines does
> worry me somewhat.
It should..and more than somewhat!

>I'd much rather do it a cleaner way.
Then please write an IM driver.

-Thanks, ali

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
"Brad Miller" <nospam@nospam.net> wrote in message
news:ubn4b0th4sgal8udiabpammjehkopmr44j@4ax.com...
> Hmm, sounds like hard work then.  Either you're involved in the call
> or you're not.  If you're not you're going to have a hard time
> reconstructing it after it has taken place.
>
> I've written a little patch for NDIS and it seems to be working well
> enough, its giving me the addresses I need at least.  Its just that
> I'd much rather do it a cleaner way.  patching NDIS routines does
> worry me somewhat.
>
>
> If anyone can point me towards this miniport context block or pehaps a
> resource explaining its structure I'd really appreciate as google has
> come up with nothing.  Failing that I guess I'll have to stay with my
> messy approach and wait for Win2k to go open-source ;P
>
> Thanks Pavel,
>
>
> Brad
>
> On Mon, 24 May 2004 17:33:56 +0300, "Pavel A." <pavel_a@geeklife.com>
> wrote:
>
> >Yes. The handlers are copied into your miniport context ("adapter")
block.
> >This struct is defined in ndis.h - however normally it is opaque for you.
> >Being binary compatible, you aren't sure that ndis library
> >uses exactly same definitions, for 100%... maybe, only 95% ;)
> >
> >--PA
> >
> >"Brad Miller" <nospam@nospam.net> wrote in message
news:mva3b09r9305bsvrun4h8h2cv2qd66psqu@4ax.com...
> >> ok, so during its DriverEntry a miniport driver fills an
> >> NDIS_MINIPORT_CHARACTERISTICS structure and calls
> >> NdisMRegisterMiniport.  Later it discards DriverEntry.
> >>
> >> How would one then recover or otherwise ascertain the handler
> >> addresses that were passed during driver registration ?
> >>
> >> Can NDIS be queried for them ?  Is there a table somewhere ?  Can I
> >> sleuth them through some contrived process that would make sherlock
> >> proud ?  Yes, I know this sounds like a really dumb thing to need to
> >> know but please, just humor me a little.
> >>
> >> Tell me that it is somehow possible : )
> >>
> >> Please!
> >>
> >>
> >> Brad
> >
>


Relevant Pages

  • Re: NDIS_MINIPORT_CHARACTERISTICS
    ... > this is by being there at the time it registers with NDIS. ... To show that it is possible that a backdoor comms ... >>of calls that NDIS makes to a miniport. ... > driver on the filesystem due to IDS/AV worries. ...
    (microsoft.public.development.device.drivers)
  • Re:NDIS Irda protocol driver
    ... in between miniport driver's indication of packets to NDIS library and NDIS ... library's notification of your driver about incoming packets. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: NDIS Intermediate (passthru) communicates with second driver
    ... already occupied by NDIS. ... Now PASSTHRU is an NDIS intermediate driver, ... implements both an NDIS miniport and an NDIS protocol. ... device object via IoCreateDevicein the standard way in your IM. ...
    (microsoft.public.development.device.drivers)
  • Re: Tcpip.sys bug: FTP Upload. MiniportHalt isnt called untill it has
    ... cancel packets on the miniport driver. ... driver, this bug would have been discovered long, long ago. ... handler and that does return all unsent packets to Ndis. ... hanging the PnP manager with device ...
    (microsoft.public.development.device.drivers)
  • Re: Incorrect server name
    ... There is no primary WINS server defined for this adapter. ... Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client) ... Network Monitor Driver ...
    (microsoft.public.windows.server.general)