Re: passthru help



You cannot patch the NDIS_PACKET's data. Instead, allocate your own area
for the data you want to patch, allocate NDIS_BUFFER describing it, and then
patch the NDIS_BUFFER chain of your packet to include this buffer. Then - when
the packet will return back to you in SendComplete or such - restore the
original buffer chain.
Note that all of this is about NDIS5 packet stacking only. If you do not
use packet stacking - then you will need your own NDIS_PACKET structure anyway,
even if you change nothing in the packet data.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@xxxxxxxxxxxxxxxx
http://www.storagecraft.com

"gp" <gp@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BE68744C-E3FC-40A9-8AEF-832CBDE11954@xxxxxxxxxxxxxxxx
I am trying to understan packet modification and wrote a sample
Miniportsendpacket fucntion and able to retrive payload and just try to pass
ip packet as it is and seems like function is hanging some where pl. check
and let me what i am doing wrong.


VOID

MiniportSendPackets(

IN NDIS_HANDLE hMiniportAdapterContext,

IN PPNDIS_PACKET apPacketArray,

IN UINT uiNumberOfPackets

)

/*++

Routine Description:

Send Packet Array handler. Either this or our SendPacket handler is called

based on which one is enabled in our Miniport Characteristics.

Arguments:

hMiniportAdapterContext - Pointer to our binding

paPacketArray - Set of packets to send

uiNumberOfPackets - Self-explanatory

Return Value:

None

--*/

{

BINDING* pBinding = (BINDING*)hMiniportAdapterContext;

NDIS_STATUS status;

UINT i;

PVOID pvMediaSpecificInfo;

UINT uiMediaSpecificInfoSize;

//PNDIS_PACKET pPacket, pSendPacket;

PASSTHRU_PR_SEND* pProtocolSend;

char szDebug[100]={0};

#ifdef NDIS51

PNDIS_PACKET_STACK pStack;

BOOLEAN bRemaining;

#endif

for (i = 0; i < uiNumberOfPackets; i++)

{


PNDIS_PACKET pPacket, pSendPacket;

//PNDIS_BUFFER pNewNdisBfr;

ULONG ulOrigPayload,

ulNewPayload;

PUCHAR pNewPayload = NULL;

#define szPayloadCopy ETH_MAX_PACKET_SIZE

UCHAR PayloadCopy[szPayloadCopy];

pPacket = apPacketArray[i];

if ((pPacket != NULL) && (CheckPacket(pPacket)) )

{



strcpy(szDebug,"original packet desai....\n");

Save(szDebug,strlen(szDebug));

GetPktPayload(pPacket, // Copy payload

PayloadCopy, // to area.

szPayloadCopy, // Amount of space in area.

&ulOrigPayload // Return number of bytes in packet.

);


if (1)

{

pIPHdr pIPH;

pTCPHdr pTCPH;

NDIS_STATUS lclStatus;

USHORT usIPHdr,

usTCPHdr,

usNewHdrs;

pIPH = (pIPHdr)(PayloadCopy + // Point to IP header in local copy of payload.

sizeof(EthHdr));

usIPHdr = pIPH->IPHdrLen * 4; // Get length of IP header.

pTCPH = // Point to TCP datagram (header + data) in local copy of payload.

(pTCPHdr)(PayloadCopy +

sizeof(EthHdr) +

usIPHdr);

usTCPHdr = pTCPH->DataOffset * 4; // Length of this TCP header, which will
be largely duplicated.

//usNewHdrs = // Space needed for new headers:

// usIPHdr // IP header,

// ;

//ulNewPayload = usNewHdrs + ulOrigPayload;// Figure amount of space to get.

ulNewPayload = ulOrigPayload;// Figure amount of space to get.

strcpy(szDebug,(" MPSendPackets(): Found string\n"));

Save(szDebug,strlen(szDebug));

lclStatus = // Allocate nonpaged storage for payload.

NdisAllocateMemoryWithTag(&pNewPayload,

ulNewPayload,0


);

if (NDIS_STATUS_SUCCESS!=lclStatus)

{

//DBGPRINT(("MPSendPackets() failed to allocate memory for payload, status =
0x%08x\n", lclStatus));

strcpy(szDebug,(" MPSendPackets() failed to allocate memory for payload\n"));

Save(szDebug,strlen(szDebug));

ASSERT(0);

/* Do something! Eg, set Status and exit. */

}

memcpy(pNewPayload, // Copy ethernet header, IP header and

PayloadCopy, // TCP header.

sizeof(EthHdr) +

usIPHdr);

pIPH = (pIPHdr)(pNewPayload + // Point to IP header in second copy of
payload.

sizeof(EthHdr));

pIPH->TotalLength = // Set size of IP datagram.

(USHORT)RtlUlongByteSwap((ulNewPayload - sizeof(EthHdr))<<16);

pIPH->Checksum = 0; // Clear old IP checksum value.

pIPH->Checksum = // Get new IP checksum value, which depends on new IP
header only.

GetIPChecksum((PUSHORT)pIPH, usIPHdr);

//memcpy(pNewPayload +sizeof(EthHdr)+ usIPHdr, // Copy ethernet header, IP
header and

// PayloadCopy +sizeof(EthHdr)

// , // TCP header.

// usIPHdr+usTCPHdr


// );

memcpy(pNewPayload +sizeof(EthHdr)+ usIPHdr, // Copy ethernet header, IP
header and

PayloadCopy +sizeof(EthHdr) + usIPHdr

, // TCP header.

usTCPHdr


);




if((ulOrigPayload - sizeof(EthHdr)- usIPHdr -usTCPHdr) > 0)

{

memcpy(pNewPayload +sizeof(EthHdr)+ usIPHdr + // Copy the original payload
after the ethernet, IP, TCP and encapsulation headers.

usTCPHdr ,

PayloadCopy+sizeof(EthHdr)+ usIPHdr+usTCPHdr,

ulOrigPayload - sizeof(EthHdr)- usIPHdr -usTCPHdr

);

}

// strcpy(szDebug,"we have new packet\n");

strcpy(szDebug,"we have new packet\n");

Save(szDebug,strlen(szDebug));


} // End 'if' a hit.

}




#ifdef NDIS51

//

// Use NDIS 5.1 packet stacking:

//

// Packet stacks: Check if we can use the same packet for sending down.

//

pStack = NdisIMGetCurrentPacketStack(pPacket, &bRemaining);

if (bRemaining) {

//

// We can reuse packet

//

// NOTE: if we needed to keep per-packet information in packets

// sent down, we can use pStack->IMReserved[].

//

ASSERT(pStack);

NdisSend(&status, pBinding->hPTBinding, pPacket);

if (status != NDIS_STATUS_PENDING) {

NdisMSendComplete(pBinding->hMPBinding, pPacket, status);

}

continue;

}

#endif

NdisAllocatePacket(&status, &pSendPacket, pBinding->hSendPacketPool);

if (status != NDIS_STATUS_SUCCESS) {

// We are out of packets so silently drop

if (status != NDIS_STATUS_PENDING) {

NdisMSendComplete(pBinding->hMPBinding, pPacket, status);

}

continue;

}


pProtocolSend = (PPASSTHRU_PR_SEND)(pSendPacket->ProtocolReserved);

pProtocolSend->pOriginalPacket = pPacket;

NdisSetPacketFlags(pSendPacket, NdisGetPacketFlags(pPacket));

pSendPacket->Private.Head = pPacket->Private.Head;

pSendPacket->Private.Tail = pPacket->Private.Tail;

//

// Copy the OOB data from the original packet to the new

// packet.

//

NdisMoveMemory(

NDIS_OOB_DATA_FROM_PACKET(pSendPacket),

NDIS_OOB_DATA_FROM_PACKET(pPacket), sizeof(NDIS_PACKET_OOB_DATA)

);

//

// Copy relevant parts of the per packet info into the new packet

//

NdisIMCopySendPerPacketInfo(pSendPacket, pPacket);

//

// Copy the Media specific information

//

NDIS_GET_PACKET_MEDIA_SPECIFIC_INFO(

pPacket, &pvMediaSpecificInfo, &uiMediaSpecificInfoSize

);

if (pvMediaSpecificInfo != NULL && uiMediaSpecificInfoSize > 0) {

NDIS_SET_PACKET_MEDIA_SPECIFIC_INFO(

pSendPacket, pvMediaSpecificInfo, uiMediaSpecificInfoSize

);

}

NdisSend(&status, pBinding->hPTBinding, pSendPacket);

if (status != NDIS_STATUS_PENDING) {

NdisIMCopySendCompletePerPacketInfo(pPacket, pSendPacket);

NdisFreePacket(pSendPacket);

}

}


}




.



Relevant Pages

  • RE: Transfer a sending packet to upper TCP/IP protocol layer in IM
    ... If the IPv6 address can be resolved, ... IPv4 header will be larger than the MTU. ... After prepending IPv4 header and UDP header to the original IPv6 packet, ...
    (microsoft.public.development.device.drivers)
  • Re: sendfile(2) SF_NOPUSH flag proposal
    ... limiting factor to be PCI bus bandwidth first, memory second, ... > in separate packet nevertheless the size of header and of the file. ... So when a retransmit, if any, is necessary, the packet stream ...
    (freebsd-arch)
  • RE: Transfer a sending packet to upper TCP/IP protocol layer in IM
    ... The original MAC header is INVALID because my IM driver will assign a new ... After prepending IPv4 header and UDP header to the original IPv6 packet, ...
    (microsoft.public.development.device.drivers)
  • RE: Transfer a sending packet to upper TCP/IP protocol layer in IM
    ... If the IPv6 address can be resolved, ... When I indicate the packet to upper tcpip stack, I'll prepend IPv4 header ... The proper way to do this is to add your IPv4 header, ...
    (microsoft.public.development.device.drivers)
  • [EXPL] autoRST - Automated TCP RST Exploit
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... sniff for TCP packets on a network and then sends out a forged RST packet ... * winpcap header files downloaded and paths setup. ... typedef struct mac_address { ...
    (Securiteam)