creating and sending NDIS_BUFFER_LISTS in an NDIS 6 filter driver

NTDEV
1

Hi.

I’ m trying to send NET_BUFFER_LISTS , originated in my NDIS
6 filter driver (modified Ndislwf).

I want to build a new NET_BUFFER_LIST, according to data arriving from a METHOD_BUFFERED IOCTL.

How should this be done?

Is there some convenient way of copying the data from the input buffer to the NET_BUFFER data section? should I also use an MDL and if so, how do I map the addresses?

Thanks.

2

Use METHOD_OUT_DIRECT and Irp->MdlAddress for a NET_BUFFER

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntdev…
> Hi.
>
> I’ m trying to send NET_BUFFER_LISTS , originated in my NDIS
> 6 filter driver (modified Ndislwf).
>
> I want to build a new NET_BUFFER_LIST, according to data arriving from a
METHOD_BUFFERED IOCTL.
>
> How should this be done?
>
> Is there some convenient way of copying the data from the input buffer to the
NET_BUFFER data section? should I also use an MDL and if so, how do I map the
addresses?
>
> Thanks.
>
>
>

3

See the NDISPROT 60 sample for an illustration of how to send a MDL.

Good luck,

Thomas F. Divine
http://www.pcausa.com

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-324973-
xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Thursday, May 22, 2008 7:18 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] creating and sending NDIS_BUFFER_LISTS in an NDIS 6
filter driver

Hi.

I’ m trying to send NET_BUFFER_LISTS , originated in my NDIS
6 filter driver (modified Ndislwf).

I want to build a new NET_BUFFER_LIST, according to data arriving from
a METHOD_BUFFERED IOCTL.

How should this be done?

Is there some convenient way of copying the data from the input buffer
to the NET_BUFFER data section? should I also use an MDL and if so, how
do I map the addresses?

Thanks.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Hi.
I can’t control the IOCTL’s memory managemnet…so it must be buffered…

Here’s a psuedo-code of what I tried:

//1.created local buffer
buffer = NDISAllocateMemoryWithTagPriority(…);
//2.copied memory from the IOCTL’s buffer:
RtlCopyMemory(buffer,inputBuffer,bufferLength);
//3.created an MDL for my buffer:
PMDL mdl = NDISAllocateMDL(myFilter,buffer,bufferLength);
//4.initialized a NET_BUFFER_LIST_POOL_PARAMETERS struct
NET_BUFFER_LIST_POOL_PARAMETERS NBLPoolParams;
NdisZeroMemory (&NBLPoolParams, sizeof (NBLPoolParams));
NBLPoolParams.Header.Type = NDIS_OBJECT_TYPE_DEFAULT;
NBLPoolParams.Header.Revision=
NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1;
NBLPoolParams.Header.Size = sizeof(NET_BUFFER_LIST_POOL_PARAMETERS);
NBLPoolParams.ProtocolId = NDIS_PROTOCOL_ID_DEFAULT;
NBLPoolParams.fAllocateNetBuffer = TRUE;
NBLPoolParams.ContextSize = 0;
NBLPoolParams.PoolTag = ‘lptS’;
NBLPoolParams.DataSize = 0;

//5.created a pool
pool = NdisAllocateNetBufferListPool (myFilter,
&NBLPoolParams );
//6.allocated the NET buffer and NET BUFFER list
ndisBufferList = NdisAllocateNetBufferAndNetBufferList(pool,0,0,mdl,0 bufferLength);
//7.tried to send the NET_BUFFER_LIST
NdisFSendNetBufferLists(myFilter, ndisBufferList, 33000,0);

and I get a strange exception…not a bug check per say…
Any ideas why?

thanks again.

5

I found out the error code was STATUS_ACCESS_VIOLATION.

Thomas - I’ll look at it, thanks.

6

Don’t forget that you must be using DIRECT I/O. If you are using IRP_MJ_WRITE, insure that DeviceObject Flags field is set correctly. If using IOCTL, insure that the CTRL_CODE is defined correctly.

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-324992-
xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Thursday, May 22, 2008 9:47 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] creating and sending NDIS_BUFFER_LISTS in an NDIS 6
filter driver

I found out the error code was STATUS_ACCESS_VIOLATION.

Thomas - I’ll look at it, thanks.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

Thomas - if the the IOCTL is defined as buffer, why is it wrong to build an MDL from a local virtual address?

Another thing - I changed the port number in my send method to 0 (should be the default port)

8

The pools should have been created much earlier, of course. Don’t want to allocate the pools as part of each send.

Memory passed to any asynchronous routine must be page locked somehow.

Of course, knowing what the “strange exception” is might help you.

Thomas F. Divine
http://www.pcausa.com

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-324991-
xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Thursday, May 22, 2008 9:44 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] creating and sending NDIS_BUFFER_LISTS in an NDIS 6
filter driver

Hi.
I can’t control the IOCTL’s memory managemnet…so it must be
buffered…

Here’s a psuedo-code of what I tried:

//1.created local buffer
buffer = NDISAllocateMemoryWithTagPriority(…);
//2.copied memory from the IOCTL’s buffer:
RtlCopyMemory(buffer,inputBuffer,bufferLength);
//3.created an MDL for my buffer:
PMDL mdl = NDISAllocateMDL(myFilter,buffer,bufferLength);
//4.initialized a NET_BUFFER_LIST_POOL_PARAMETERS struct
NET_BUFFER_LIST_POOL_PARAMETERS NBLPoolParams;
NdisZeroMemory (&NBLPoolParams, sizeof (NBLPoolParams));
NBLPoolParams.Header.Type = NDIS_OBJECT_TYPE_DEFAULT;
NBLPoolParams.Header.Revision=
NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1;
NBLPoolParams.Header.Size = sizeof(NET_BUFFER_LIST_POOL_PARAMETERS);
NBLPoolParams.ProtocolId = NDIS_PROTOCOL_ID_DEFAULT;
NBLPoolParams.fAllocateNetBuffer = TRUE;
NBLPoolParams.ContextSize = 0;
NBLPoolParams.PoolTag = ‘lptS’;
NBLPoolParams.DataSize = 0;

//5.created a pool
pool = NdisAllocateNetBufferListPool (myFilter,
&NBLPoolParams );
//6.allocated the NET buffer and NET BUFFER list
ndisBufferList = NdisAllocateNetBufferAndNetBufferList(pool,0,0,mdl,0
bufferLength);
//7.tried to send the NET_BUFFER_LIST
NdisFSendNetBufferLists(myFilter, ndisBufferList, 33000,0);

and I get a strange exception…not a bug check per say…
Any ideas why?

thanks again.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

9

Other than just bad practice, which I’ll clean up as soon as I get it to work,
I got C0000005 (STATUS_ACCESS_VIOLATION) when the port number was 33000 (just a made up number) and C000001D (STATUS_ILLEGAL_INSTRUCTION)

Any idea why the send fails?

10

Don’t know. Sorry. Where did the IRPs originate. Are they user-mode? That exception code is related to ProbeForRead. Might check that.

Good luck,

Thomas

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-324999-
xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Thursday, May 22, 2008 11:05 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] creating and sending NDIS_BUFFER_LISTS in an NDIS 6
filter driver

Other than just bad practice, which I’ll clean up as soon as I get it
to work,
I got C0000005 (STATUS_ACCESS_VIOLATION) when the port number was 33000
(just a made up number) and C000001D (STATUS_ILLEGAL_INSTRUCTION)

Any idea why the send fails?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

11

The IRP did originate from user space, but I’m working on a copy, so I don’t see any problem with that.
Thank you very much anyway…

Ariel

12

xxxxx@hotmail.com wrote:

Other than just bad practice, which I’ll clean up as soon as I get it to work,
I got C0000005 (STATUS_ACCESS_VIOLATION) when the port number was 33000 (just a made up number)

Remember that STATUS_ACCESS_VIOLATION is not talking about permissions.
That’s the catch-all exception for what Intel calls a “general
protection fault.” This usually means using an invalid address. It’s a
processor fault, not a permissions fault.

and C000001D (STATUS_ILLEGAL_INSTRUCTION)

Any idea why the send fails?

Both of these suggest that you are overwriting code somewhere, or
perhaps overwriting the stack so that you return into garbage memory.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

13

Hey everyone.

I got it to work.
turned up, the I tried sending an illegal packet.
As soon as I used a real UDP packet, it worked.

Thanks