最近我编译了DDK 中ndisprot 协议驱动修改了NDIS_PROTOCOL_CHARACTERISTICS 的代码。
用WDk编译成2003 环境成功,但在用ndisprot.inf 安装到虚拟机上以后没任何提示,只是本地连接属性里多了个 Sample NDIS Protocol Driver 。
我用windug在虚拟机上调试发现 NDIS_PROTOCOL_CHARACTERISTICS 里注册的一些函数都没有调用(如 ProtocolBindAdapter) 而我自己定义的回调函数没问题(如 DispatchIoctl)。
我的入口点代码是
// 初始化协议特征结构
NDIS_PROTOCOL_CHARACTERISTICS protocolChar;
NdisZeroMemory(&protocolChar, sizeof(NDIS_PROTOCOL_CHARACTERISTICS));
//protocolChar
protocolChar.Ndis40Chars.MajorNdisVersion =5;
protocolChar.Ndis40Chars.MinorNdisVersion = 0;
protocolChar.Ndis40Chars.Name = protoName;
protocolChar.Ndis40Chars.BindAdapterHandler = ProtocolBindAdapter;
protocolChar.Ndis40Chars.UnbindAdapterHandler = ProtocolUnbindAdapter;
protocolChar.Ndis40Chars.OpenAdapterCompleteHandler = ProtocolOpenAdapterComplete;
protocolChar.Ndis40Chars.CloseAdapterCompleteHandler = ProtocolCloseAdapterComplete;
protocolChar.Ndis40Chars.ReceiveHandler = ProtocolReceive;
protocolChar.Ndis40Chars.TransferDataCompleteHandler = ProtocolTransferDataComplete;
protocolChar.Ndis40Chars.SendCompleteHandler = ProtocolSendComplete;
protocolChar.Ndis40Chars.ResetCompleteHandler = ProtocolResetComplete;
protocolChar.Ndis40Chars.RequestCompleteHandler = ProtocolRequestComplete;
protocolChar.Ndis40Chars.ReceiveCompleteHandler = ProtocolReceiveComplete;
protocolChar.Ndis40Chars.StatusHandler = ProtocolStatus;
protocolChar.Ndis40Chars.StatusCompleteHandler = ProtocolStatusComplete;
protocolChar.Ndis40Chars.PnPEventHandler = ProtocolPNPHandler;
// 注册为协议驱动
NdisRegisterProtocol((PNDIS_STATUS)&status,
&g_data.hNdisProtocol, &protocolChar, sizeof(protocolChar));
if(status != NDIS_STATUS_SUCCESS)
{
status = STATUS_UNSUCCESSFUL;
break;
}
DbgPrint(" Protocol: NdisRegisterProtocol success \n");
// 现在,设置我们要处理的派遣例程
pDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
pDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
pDriverObj->MajorFunction[IRP_MJ_READ] = DispatchRead;
pDriverObj->MajorFunction[IRP_MJ_WRITE] = DispatchWrite;
pDriverObj->MajorFunction[IRP_MJ_CLEANUP] = DispatchCleanup;
pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;
pDriverObj->DriverUnload = DriverUnload;
不知道是什么原因...请高手指教........
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)