HELP!!__BSOD_from_WskConnect()

lastime1650

This is my first posting.

****Exposes BSOD each time the Windows kernel driver tries to connect to the server via "Winsock Kernel" with WskConnect.

It runs normally before calling WskConnect, but I have no idea what the problem is.****

#include <ntifs.h>
#include <ntddk.h>
#include <ntdef.h>
#include <windef.h>
#include <ntstrsafe.h>
#include <wdm.h>
#include <ntimage.h>

#include <wsk.h> 

#pragma warning(disable: 4996)





/*구조체 정의 리스트*/

    // Context structure for each socket
    typedef struct _WSK_APP_SOCKET_CONTEXT {
        PWSK_SOCKET Socket;
        UINT64 abc;
    } WSK_APP_SOCKET_CONTEXT, * PWSK_APP_SOCKET_CONTEXT;




/*전역변수*/
    /*소켓*/
    PWSK_APP_SOCKET_CONTEXT socketContext = NULL;



NTSTATUS MyCompletionRoutine(
    PDEVICE_OBJECT DeviceObject,
    PIRP Irp,
    PVOID Context
)
{
    UNREFERENCED_PARAMETER(DeviceObject);

    PWSK_APP_SOCKET_CONTEXT SocketContext;
    SocketContext = (PWSK_APP_SOCKET_CONTEXT)Context;

    // Save the socket object for the new socket
    SocketContext->Socket =(PWSK_SOCKET)(Irp->IoStatus.Information);


    if (Irp->IoStatus.Status == STATUS_SUCCESS)
    {
        // Get the pointer to the socket context
        SocketContext = (PWSK_APP_SOCKET_CONTEXT)Context;

        // Save the socket object for the new socket
        SocketContext->Socket = (PWSK_SOCKET)(Irp->IoStatus.Information);
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "소켓 연결!");
    }
    else {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "소켓 연결???");
    }


    IoFreeIrp(Irp);


    return STATUS_MORE_PROCESSING_REQUIRED;
}

NTSTATUS ConnectComplete(
    PDEVICE_OBJECT DeviceObject,
    PIRP Irp,
    PVOID Context
)
{   


    UNREFERENCED_PARAMETER(DeviceObject);
    UNREFERENCED_PARAMETER(Context);
    //PWSK_SOCKET Socket;

    // Check the result of the connect operation
    if (Irp->IoStatus.Status == STATUS_SUCCESS)
    {
        // Get the socket object from the context
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "SUCCESS");

    }
    else {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "FAILED");
    }

    // Free the IRP
    IoFreeIrp(Irp);

    return STATUS_SUCCESS;
}

NTSTATUS Connect_(PWSK_SOCKET socket, SOCKADDR_IN serverAddress) {////////
    //UNREFERENCED_PARAMETER(socket);
    //UNREFERENCED_PARAMETER(serverAddress);
    PIRP irp;
    irp = IoAllocateIrp(1, FALSE );

    if (!irp) 
    {

        return STATUS_INSUFFICIENT_RESOURCES;
    }
    IoSetCompletionRoutine(
        irp,
        (PIO_COMPLETION_ROUTINE)ConnectComplete,
        (PVOID)socketContext,  // Use the socket object for the context
        TRUE,
        TRUE,
        TRUE
    );
    //return STATUS_SUCCESS;



    NTSTATUS status = STATUS_SUCCESS;

    if (((PWSK_PROVIDER_CONNECTION_DISPATCH)socket->Dispatch)) { // BSOD@!!!!!!!!!!!@@@@@@@@@@@@@@@@@
        status = ((PWSK_PROVIDER_CONNECTION_DISPATCH)socket->Dispatch)->WskConnect(
            (PWSK_SOCKET)socket,
            (PSOCKADDR)&serverAddress,
            0,
            irp
        );
    }
    else {
        status = STATUS_UNSUCCESSFUL;
    }


    return status;

}


PWSK_SOCKET Socket_setting() {




    WSK_CLIENT_DISPATCH WskAppDispatch = {
        MAKE_WSK_VERSION(1,0), // Use WSK version 1.0
        0,    // Reserved
        NULL  // WskClientEvent callback not required for WSK version 1.0
    };

    /*WSK REGISTRATION 오브젝트 등록*/
    WSK_REGISTRATION WskRegistration = { 0, };



    /*Wsk_Client_Npi*/
    WSK_CLIENT_NPI WskClientNpi;
    WskClientNpi.ClientContext = NULL;
    WskClientNpi.Dispatch = &WskAppDispatch;

    /*1차 -> WskRegistration 에 값 넣기*/
    NTSTATUS status = WskRegister(&WskClientNpi, &WskRegistration);
    if (!NT_SUCCESS(status)) {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "WskRegister 등록 실패");
        return NULL;
    }
    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "WskRegister 등록 성공");


    /*WSK_Provider_npi*/
    WSK_PROVIDER_NPI wskProviderNpi = { 0, };

    /*2차 -> WskRegistration으로 WSK 인터페이스를 사용하기 위한 설정 시도*/
    status = WskCaptureProviderNPI(&WskRegistration, WSK_INFINITE_WAIT, &wskProviderNpi);
    if (!NT_SUCCESS(status)) {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "WskCaptureProviderNPI 캡처 실패");
        return NULL;
    }
    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "WskCaptureProviderNPI 캡처 성공");

    socketContext = (PWSK_APP_SOCKET_CONTEXT)ExAllocatePoolWithTag(NonPagedPool, sizeof(WSK_APP_SOCKET_CONTEXT), 'tgrT');
    if (socketContext == NULL) {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "socketContext 할당 실패!");
        return NULL;
    }
    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "socketContext 할당 성공!");

    /*3차 본격 Socket 제작하기*/

    PIRP irp = NULL; // IRP [1/3]


    //PWSK_CLIENT_CONNECTION_DISPATCH client_conn_Dispatch = { 0, };

    irp = IoAllocateIrp(1, FALSE); // IRP [2/3]

    // Check result
    if (!irp)
    {
        // Return error
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "IRP 초기화 실패!");
        return NULL;
    }


    IoSetCompletionRoutine(// IRP [3/3]
        irp,
        (PIO_COMPLETION_ROUTINE)MyCompletionRoutine,
        (PVOID)socketContext,
        TRUE,
        TRUE,
        TRUE
    );

    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "IRP SUCCESS");
    //return STATUS_SUCCESS;


    status = wskProviderNpi.Dispatch->WskSocket(
        wskProviderNpi.Client,
        AF_INET,
        SOCK_STREAM,
        IPPROTO_TCP,
        WSK_FLAG_CONNECTION_SOCKET,
        socketContext,
        NULL,
        NULL,
        NULL,
        NULL,
        irp 
    );

    if (!NT_SUCCESS(status)) {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "wskProviderNpi.Dispatch->WskSocket 실패@-> %p", status);
        return NULL;
    }
    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "wskProviderNpi.Dispatch->WskSocket SUCCESS");

    if (!NT_SUCCESS(irp->IoStatus.Status)) {
        return NULL;
    }
    PWSK_SOCKET socket = (PWSK_SOCKET)irp->IoStatus.Information;

    /* [2] */
    return (PWSK_SOCKET)socket;

}




NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    UNREFERENCED_PARAMETER(RegistryPath);


    /* [2]*/
    PWSK_SOCKET socket = Socket_setting();
    if (socket == NULL) {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "FAILED");
        return STATUS_UNSUCCESSFUL;
    }
    DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "SUCCESS");





    SOCKADDR_IN serverAddress = { 0, };
    //serverAddress.sin_addr.S_un.S_addr = RtlUlongByteSwap(0x6400A8C0); // IP

    IN_ADDR aIpv4;
    PCSTR test;

    if( !NT_SUCCESS(RtlIpv4StringToAddressA("192.168.0.100", TRUE, &test, &aIpv4)) )
     {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "FAILED");
        return STATUS_UNSUCCESSFUL;
    }
    serverAddress.sin_addr = aIpv4;
    serverAddress.sin_family = AF_INET;
    serverAddress.sin_port = (USHORT)RtlUlongByteSwap(8080);


    if (!NT_SUCCESS(Connect_(socket, serverAddress))) {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "FAILED");
        return STATUS_UNSUCCESSFUL;
    }
    else {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "SUCCESS");
    }



    return STATUS_SUCCESS;


}

[Mods: Applied appropriate markdown for code... is it so hard for people to use markdown?]

Mark_Roddy

The output from windbg !analyze -v with the correct symbols might get you some useful responses.