Hello,
I wonder if anybody watching this list can give me some hint about the
following problem :
I write NDIS hooking driver which modifies export table of NDIS.sys for
NdisDe/RegisterProtocol, NdisOpen/CloseAdapter functions. The driver loads
between ndis.sys and tcpip.sys.
In NdisOpenAdapter handler, after calling original handler and getting
NDIS_STATUS_SUCCESS(In case of pending I do handle the case exectly the same
in completion routine), I get pointer to NDIS_OPEN_BLOCK structure modify
SendHandler,SendPacketsHandler, and TransferDataHandler addresses with my
own equivalents.
----------------------------Version 1(NdisOpenAdapter
Hook)------------------
NDIS_OPEN_BLOCK pOpenBlock;
…
pOpenBlock = *NdisBindingHandle;
…
InterlockedExchangePointer(&pOpenBlock->SendPacketsHandler,
(SEND_PACKETS_HANDLER)pAdapterCtx->OSSendPacketsHandler);
InterlockedExchangePointer(&pOpenBlock->SendHandler,
(SEND_HANDLER)pAdapterCtx->OSSendHandler);
…
In the first version of my code, I hook handlers without copying original
NDIS_OPEN_BLOCK(i.e *NdisBindingHandle) into my own m_OpenBlock structure.
Now 1st problem : This hooking works most of the time. Namely I can see
sending attempts. But sometimes, it is not called even the original handler
adresses are modified. For example, When I enable a network connection for
the first time, SendHandlers are not called. When I disble and re-enable it,
they are called properly. On a connection using a wireless LAN card,
SendHandlers are never called.
Later I modified the code to keep my own NDIS_OPEN_BLOCK structure ,
m_OpenBlock and copied original open block into this and modified it. Then I
modified NdisBindingHandle to point to it.
-------------------------Version 2(NdisOpenAdapter
Hook)---------------------
…
NDIS_OPEN_BLOCK pOpenBlock;
…
NdisMoveMemory(&pAdapterCtx->m_OpenBlock,*NdisBindingHandle
sizeof(NDIS_OPEN_BLOCK));
InterlockedExchangePointer(NdisBindingHandle ,&pAdapterCtx->m_OpenBlock);
pOpenBlock = *NdisBindingHandle;
…
InterlockedExchangePointer(&pOpenBlock->SendPacketsHandler,
(SEND_PACKETS_HANDLER)pAdapterCtx->OSSendPacketsHandler);
InterlockedExchangePointer(&pOpenBlock->SendHandler,
(SEND_HANDLER)pAdapterCtx->OSSendHandler);
…
This time, the hook never works! For example, when I try to enable a network
connection network cable unplugged is reported.
Is there any point I am missing? Are there some possible race conditions
between hooked calls which may cause this error so that I should
handle?Should I also hook BindAdapter routines?(BindAdapterHandler and
NdisCompleteBindAdapter)
I use Windows XP SP1 DDK on Windows XP SP2.
If somebody could comment on this, I would appreciate.
Thanks in advance,
Egemen Tas
Note : I know Ndis intermediate drivers are clean solutions but this topic has been discussed many times.