FwpsInjectNetworkSendAsync returns 0xC0220035 (Invalid Param)

NTDEV
1

Hi,

I am getting an invalid Parameter error when I try to inject an IP packet (Echo reply). I have tried my best to figure it out but not able to solve it. I am hoping that OSR community will be able to help me with its issue.

Injecting code:

void Inject()

{

HANDLE WfpInjectionHandle;
UCHAR packet = { 0x45, 0x00, 0x00, 0x1f, 0x3a, 0x96, 0x00, 0x00, 0x80, 0x01, 0x0e, 0x91, 0xc0, 0xa8, 0x38, 0x65, 0xc0, 0xa8, 0x38, 0x01, 0x00, 0x00, 0x20, 0xc1, 0x00, 0x01, 0x1a, 0xdb, 0x61, 0x62, 0x63 };
UINT32 packetLength = 31;

NTSTATUS status = FwpsInjectionHandleCreate0(
AF_INET, // Address family: AF_INET for IPv4
FWPS_INJECTION_TYPE_NETWORK, // Injection type
&WfpInjectionHandle)
);

if (!NT_SUCCESS(status))
{
DbgPrint("WFP REGISTRATION FAILED FwpsInjectionHandleCreate0 ");
return status;
}

PUCHAR packetData = (PUCHAR)ExAllocatePool2(POOL_FLAG_NON_PAGED, packetLength, 'CWPT');
if (packetData == NULL)
{
DbgPrint("Allocating Memory failed");
return STATUS_SUCCESS;
}
RtlCopyMemory(packetData, packet, packetLength);

PMDL mdl = IoAllocateMdl(packetData, packetLength, FALSE, FALSE, NULL);
MmBuildMdlForNonPagedPool(mdl);

NET_BUFFER_LIST_POOL_PARAMETERS poolParams = { 0 };
poolParams.Header.Type = NDIS_OBJECT_TYPE_DEFAULT;
poolParams.Header.Revision = NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1;
poolParams.Header.Size = sizeof(NET_BUFFER_LIST_POOL_PARAMETERS);
poolParams.ProtocolId = NDIS_PROTOCOL_ID_DEFAULT;
poolParams.fAllocateNetBuffer = TRUE;
poolParams.ContextSize = 0;

NDIS_HANDLE nblPoolHandle = NdisAllocateNetBufferListPool(device, &poolParams);
PNET_BUFFER_LIST nbl = NdisAllocateNetBufferAndNetBufferList(nblPoolHandle, 0, 0, mdl, 0, packetLength);

NTSTATUS status = FwpsInjectNetworkSendAsync( WfpInjectionHandle,
NULL,
0,
UNSPECIFIED_COMPARTMENT_ID,
nbl,
injectCompletionFn,
NULL
);
if (!NT_SUCCESS(status))
{
DbgPrint("ERROR Injecting Packet 0x%08X \n", status);// Always gets 0xC0220035 error
}
}

VOID NTAPI injectCompletionFn(
VOID* context,
NET_BUFFER_LIST* netBufferList,
BOOLEAN dispatchLevel
) {

// RELEASE MEMORY
}

Thanks

  • CW
2

Changed Line

PNET_BUFFER_LIST nbl = NdisAllocateNetBufferAndNetBufferList(nblPoolHandle, 0, 0, mdl, 0, packetLength);

to

status = FwpsAllocateNetBufferAndNetBufferList(nblPoolHandle, 0, 0,mdl, 0, packet-packetLength, &nbl);

That fixed the issue.