how can NDIS filter driver inject wireless packets?

a_j · February 27, 2012, 6:55am

Hi;

I’m writng a ndis filter driver to send 802.11 packets, I have a started with the wdk lwf example, this is what I have tried so far:

configure the inf as monitoring filter driver, it can bind to 802.11 miniport, the FilterAttach is called several times, one of them is attaching to NdisMediumNative802_11, but it cannot send packet, then I read the msdn, says monitoring driver cannot originate data
so I configured the inf as modifying, the FilterAttach is called only once, and it’s binding to NdisMedium802_3, then no 802_11 OID is available, it’s even not able to switch the channel.

the environment is Win7-32bit, the card is
Intel(R) Centrino(R) Advanced-N 6205

anyone did this before?

Thanks in advance;

Pavel_A1 · February 27, 2012, 7:29am

On 27-Feb-2012 13:58, xxxxx@gmail.com wrote:

Hi;

I’m writng a ndis filter driver to send 802.11 packets, I have a started with the wdk lwf example, this is what I have tried so far:

configure the inf as monitoring filter driver, it can bind to 802.11 miniport, the FilterAttach is called several times, one of them is attaching to NdisMediumNative802_11, but it cannot send packet, then I read the msdn, says monitoring driver cannot originate data

so I configured the inf as modifying, the FilterAttach is called only once, and it’s binding to NdisMedium802_3, then no 802_11 OID is available, it’s even not able to switch the channel.

the environment is Win7-32bit, the card is
Intel(R) Centrino(R) Advanced-N 6205

anyone did this before?

Thanks in advance;

For NDIS6 drivers, use OID_DOT11_*.

(few OID_802_11_* still may remain in NDIS6 Centrino drivers, because
someone forgot to remove them. but they won’t work.)

– pa

a_j · February 27, 2012, 9:40am

when I’m trying the monitoring driver, this OID is working:

get channel number:
filterDoInternalRequest(…, NdisRequestQueryInformation, OID_DOT11_CURRENT_CHANNEL,…
set channel number:
filterDoInternalRequest(…, NdisRequestSetInformation, OID_DOT11_CURRENT_CHANNEL,…

they all works fine, but after switched to modifying filter driver, filterDoInternalRequest doesn’t work, return value is c00000bb STATUS_NOT_SUPPORTED, and it always bind to NdisMedium802_3 in FilterAttach, is this the reason that all OID_DOT11_XXX request fail?

Thomas_Divine · February 27, 2012, 9:56am

You said: “it always bind to NdisMedium802_3 in FilterAttach, is this the
reason that all OID_DOT11_XXX request fail?”

Yes it is the reason.

Your modifying filter is actually bond to the Microsoft Native WiFi Filter
driver. The Microsoft intent is that only the Microsoft Native WiFi Filter
driver can actually bind directly to the lower-level Native WiFi miniports.

Thomas F. Divine

From:
Sent: Monday, February 27, 2012 9:43 AM
To: “Windows System Software Devs Interest List”
Subject: RE:[ntdev] how can NDIS filter driver inject wireless packets?

> when I’m trying the monitoring driver, this OID is working:
>
> get channel number:
> filterDoInternalRequest(…, NdisRequestQueryInformation,
> OID_DOT11_CURRENT_CHANNEL,…
> set channel number:
> filterDoInternalRequest(…, NdisRequestSetInformation,
> OID_DOT11_CURRENT_CHANNEL,…
>
> they all works fine, but after switched to modifying filter driver,
> filterDoInternalRequest doesn’t work, return value is c00000bb
> STATUS_NOT_SUPPORTED, and it always bind to NdisMedium802_3 in
> FilterAttach, is this the reason that all OID_DOT11_XXX request fail?
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

David_R_Cattley · February 27, 2012, 9:58am

The trick to making this work is getting your filter to be bound between the
native wifi filter and the NIC. The native wifi filter is a ‘media
translation layer’ which means roughly that above it the link looks like
802.3 ethernet and below it the link is 802.11 wifi.

The other trick is not completely screwing up the Wifi client. Which is
why MSFT has gone out of their way to make this obscure at least if not
difficult.

Windows 7 introduced an inbox driver for Virtual WiFi (the VWifi Filter
Driver) which curiously exposed bare exactly how to do this. Go look in
its INF file. Note the curious FilterClass value.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Monday, February 27, 2012 6:59 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] how can NDIS filter driver inject wireless packets?

Hi;

I’m writng a ndis filter driver to send 802.11 packets, I have a started
with the wdk lwf example, this is what I have tried so far:

configure the inf as monitoring filter driver, it can bind to 802.11
miniport, the FilterAttach is called several times, one of them is attaching
to NdisMediumNative802_11, but it cannot send packet, then I read the
msdn, says monitoring driver cannot originate data
so I configured the inf as modifying, the FilterAttach is called only
once, and it’s binding to NdisMedium802_3, then no 802_11 OID is available,
it’s even not able to switch the channel.

the environment is Win7-32bit, the card is
Intel(R) Centrino(R) Advanced-N 6205

anyone did this before?

Thanks in advance;

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

a_j · February 27, 2012, 12:18pm

Thank you guys very much,

I found the c:\windows\inf\netvwififlt.inf, two differences:
HKR, Ndi,FilterClass, ms_medium_converter_128 // here
HKR, Ndi\Interfaces, FilterMediaTypes,“vwifi” // and here

after configuring my inf like this, it’s binding to 802_11 and all 802_11 OIDs are working now.
but why it’s still not sending packets

Jeffrey_Tippet_MSFT · February 27, 2012, 5:06pm

> Go look in its INF file. Note the curious FilterClass value.

Officially we don’t support filters using these FilterClasses; that’s why they’re undocumented and begin with the “ms_” prefix. There is no officially-supported way to attach a 3rd party Modifying filter driver under NWIFI.

Thomas_Divine · February 27, 2012, 5:19pm

The official Microsoft policy that blocks non-Microsoft third-party drivers
from using the actual Native WiFi miniport is understandable from the
perspective of making the typical end-user Wi-Fi (Billy Bob Bozo and Sally
Space Cadet) Wi-Fi experience consistent.

On the other hand, it is a very real roadblock to innovation (e.g., mesh
networks) and other commercial/industrial applications outside of this
limited scope. Developers have to look to alternate platforms because of
this Microsoft policy roadblock.

Thomas F. Divine
http://www.pcausa.com

From: “Jeffrey Tippet”
Sent: Monday, February 27, 2012 5:04 PM
To: “Windows System Software Devs Interest List”
Subject: RE: [ntdev] how can NDIS filter driver inject wireless packets?

>> Go look in its INF file. Note the curious FilterClass value.
>
> Officially we don’t support filters using these FilterClasses; that’s why
> they’re undocumented and begin with the “ms_” prefix. There is no
> officially-supported way to attach a 3rd party Modifying filter driver
> under NWIFI.
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

David_R_Cattley · February 27, 2012, 6:28pm

Right. Unsupported. I should have added the standard “Don’t try this at
home” disclaimer.

Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jeffrey Tippet
Sent: Monday, February 27, 2012 5:05 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] how can NDIS filter driver inject wireless packets?

Go look in its INF file. Note the curious FilterClass value.

Officially we don’t support filters using these FilterClasses; that’s why
they’re undocumented and begin with the “ms_” prefix. There is no
officially-supported way to attach a 3rd party Modifying filter driver under
NWIFI.

a_j · February 27, 2012, 6:52pm

Oh…Thanks,
so there’s no way to inject packets in win7?

David_R_Cattley · February 27, 2012, 7:33pm

The word was “Unsupported” not “Impossible”.

[Un]Supported refers to whether or not MSFT intends for ISVs to use
something and that MSFT promises to ensure it works as documented/intended
and fix bugs when it does not. It says nothing about whether or not it
works.

You take it from there and make the business and technical decisions thus
implied by doing something that is ‘unsupported’.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Monday, February 27, 2012 6:55 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] how can NDIS filter driver inject wireless packets?

Oh…Thanks,
so there’s no way to inject packets in win7?

a_j · February 27, 2012, 7:59pm

seems the only way is to figure out how to bind below the native wifi filter