Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

NDIS filter driver : Cloning and modifying NBL not worked

380nanometres380nanometres Member Posts: 9
edited September 24 in NTDEV

Thanks to you experts, I could read ethernet header and ip header through lwf.

My final goal is modifying packets' IP address so now I'm trying it.
However, the amount of data is so small that I'm having a lot of trouble.

I thought of the following methods :
1. read eth header and ip header from NB
2. using NdisAdvanceNetBufferDataStart() function, logically remove eth header + ip header from NBL
3. make clone of NBL using NdisAllocateCloneNetBufferList
4. using NdisRetreatNetBufferDataStart() function, make space for header to cloned NBL (all underneath steps are 'to cloned NBL')
5. get an starting address that eth header should be located in cloned NBL, using NdisGetDataBuffer() and add the eth header(got from 1st step)
6. using NdisAdvanceNetBufferDataStart() and NdisGetDataBuffer, get an starting address of ip header and add the ip header(got from 1st step) to the address
7. I want to modify dest ip from ip header, so get an dest ip address through using NdisAdvanceNetBufferDataStart() for sizeof(ipheader)-4 and NdisGetDataBuffer()
8. overwrite dest ip in ip header
9. in FilterSendNetBufferListsComplete, free the cloned NBL

Is the way I thought of the right way to modify the packet?

If it is, I still don't know about detail how to implement it.

Question1. I wrote code and in FilterSendNetBufferLists function, it seems destination ip changed successfully at least in the function, but how can I check that it sends properly?
Question2. Nevertheless, the code didn't work. It occured error (I think after SendNBLComplete). Why does it happen and how can I fix it?
I think there are sth wrong about handling of cloned buffer and original buffer.

These are some parts of my code.(FilterSendNetBufferLists, FilterSendNetBufferListsComplete)


... //This code starts from 6th step of above method

        struct ip_h *m_ip = NdisGetDataBuffer(Clone_NetBuffer, sizeof(buffer2), NULL, 1, 0);
        *m_ip = *ip;

        NdisAdvanceNetBufferDataStart(Clone_NetBuffer, sizeof(buffer2) - 4, FALSE, NULL);
        struct in_addr *m_dst = (struct in_addr *)NdisGetDataBuffer(Clone_NetBuffer, 4, NULL, 1, 0);
        struct in_addr m_dst_ip = {0};
        PCSTR strip = "";

        if (STATUS_SUCCESS == RtlIpv4StringToAddress(TEXT(""), TRUE, &strip, &m_dst_ip)) {
            *m_dst = m_dst_ip;
        else {
            DEBUGP(DL_TRACE, "Failed RtlIpv4StringToAddress");
        nblChecksumInfo.Value = NET_BUFFER_LIST_INFO(CurrNbl, TcpIpChecksumNetBufferListInfo);
        NET_BUFFER_LIST_INFO(CloneNbl, TcpIpChecksumNetBufferListInfo) = nblChecksumInfo.Value;

        CloneNbl->ParentNetBufferList = CurrNbl;
        CloneNbl->SourceHandle = FilterModuleContext;
        NdisRetreatNetBufferListDataStart(CloneNbl, back_size-4, FALSE, NULL, NULL);

        NdisFSendNetBufferLists(pFilter->FilterHandle, CloneNbl, PortNumber, SendFlags);
    else {
        NdisFSendNetBufferLists(pFilter->FilterHandle, NetBufferLists, PortNumber, SendFlags);


// Send complete the NBLs.  If you removed any NBLs from the chain, make
// sure the chain isn't empty (i.e., NetBufferLists!=NULL).

//---added code---
CurrNbl = NetBufferLists;
if (CurrNbl->ParentNetBufferList) {
    CurrNbl->ParentNetBufferList->Status = CurrNbl->Status;
    CurrNbl->ParentNetBufferList = NULL;
    NdisFreeCloneNetBufferList(CurrNbl, 0);

NdisFSendNetBufferListsComplete(pFilter->FilterHandle, NetBufferLists, SendCompleteFlags);

debug text


Whether wrong or right, I'm ready for your advice.
Please forgive me for my lack of english.
Thank you.


  • 380nanometres380nanometres Member Posts: 9

    I think I couldn't restore original NBL so I changed my method.
    To restore original NBL, I think it is better way making a new MDL for header and link it instead of original header MDL.
    However, there is a problem. I don't know where is the proper position to link MDL because I could not know what MDL have header and what MDL ends the header. How can I know it?
    Is this method is the better way? If not, please help me to restore original NBL on my original method.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE