//tdifilter.c
#include <ntddk.h>
#include <tdi.h>
#include <TdiKrnl.h>

#define TDI_TCP_DEVICE		L"\\Device\\Tcp"
#define	TDI_UDP_DEVICE		L"\\Device\\Udp"
#define TDI_RAWIP_DEVICE	L"\\Device\\RawIp"

typedef struct _DEVICE_EXTENSION
{
	PDEVICE_OBJECT DeviceObject;
	UNICODE_STRING LowerDeviceName;
	PDEVICE_OBJECT LowerDeviceObject;
}DEVICE_EXTENSION,*PDEVICE_EXTENSION;

typedef struct _COMPLETION_CREATE_CONTEXT
{
	PIRP Irp;
	PMDL Mdl;
	PVOID Buffer;
	PRKEVENT Event;
}COMPLETION_CREATE_CONTEXT,*PCOMPLETION_CREATE_CONTEXT;

NTSTATUS
  IoCompletionQuery(
    IN PDEVICE_OBJECT  fdo,
    IN PIRP  Irp,
    IN PVOID  Context
    );

VOID DriverUnload(IN PDRIVER_OBJECT  DriverObject)
{
	PDEVICE_EXTENSION pdx = NULL;
	PDEVICE_OBJECT fdo = DriverObject->DeviceObject;
	
	while(fdo != NULL)
	{
		pdx = (PDEVICE_EXTENSION) fdo->DeviceExtension;
		fdo = fdo->NextDevice;
		
		KdPrint(("tdifilter!DriverUnLoad:[%wZ] Detached.\n",&pdx->LowerDeviceName));
		IoDetachDevice(pdx->LowerDeviceObject);
		IoDeleteDevice(pdx->DeviceObject);				
	}
}

NTSTATUS 
  CreateAndAttachDevice(
	IN PDRIVER_OBJECT  DriverObject,
	IN PCWSTR DeviceName
	)
{
	NTSTATUS status;
	UNICODE_STRING devname;
	PDEVICE_OBJECT fdo;
	PDEVICE_EXTENSION pdx;
	
	RtlInitUnicodeString(&devname,DeviceName);
	
	status = IoCreateDevice(DriverObject,
				sizeof(DEVICE_EXTENSION),
				NULL,
				FILE_DEVICE_UNKNOWN,
				0,
				TRUE,
				&fdo);
	if(!NT_SUCCESS(status))
	{
		return status;
	}
	
	//设置设备IO为直接IO
	fdo->Flags |= DO_DIRECT_IO;
	
	pdx = (PDEVICE_EXTENSION)fdo->DeviceExtension;
	pdx->LowerDeviceName = devname;
	pdx->DeviceObject = fdo;
	
	status = IoAttachDevice(fdo,&devname,&pdx->LowerDeviceObject);
	if(!NT_SUCCESS(status))
	{
		IoDeleteDevice(fdo);
	}
	
	KdPrint(("tdifilter!CreateAndAttachDevice:[%wZ] Attached.\n",&pdx->LowerDeviceName));
	
	return status;
}

NTSTATUS DispatchAny(PDEVICE_OBJECT fdo, PIRP Irp)
{
	PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)fdo->DeviceExtension;
  
  	IoSkipCurrentIrpStackLocation(Irp);
  	return IoCallDriver(pdx->LowerDeviceObject, Irp);
}

//IRP_MJ_CREATE的完成例程
NTSTATUS
  IoCompletionCreate(
    IN PDEVICE_OBJECT  fdo,
    IN PIRP  Irp,
    IN PVOID  Context
    )
{
	//KEVENT event;
	PCOMPLETION_CREATE_CONTEXT ctx = (PCOMPLETION_CREATE_CONTEXT)Context;
	PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)fdo->DeviceExtension;
	PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation(Irp);
	
	if(Irp->PendingReturned)
	{
		IoMarkIrpPending(Irp);
	}	
	KdPrint(("tdifilter!IoCompletionCreate\n"));
	
	//KeInitializeEvent(&event,NotificationEvent,FALSE);
	//ctx->Event = &event;
	
	TdiBuildQueryInformation(ctx->Irp,
		pdx->LowerDeviceObject,
		IrpSp->FileObject,
		IoCompletionQuery,
		ctx,
		TDI_QUERY_ADDRESS_INFO,
		ctx->Mdl
		);
	IoCallDriver(pdx->LowerDeviceObject,ctx->Irp);
	//KeWaitForSingleObject(ctx->Event,Executive,KernelMode,TRUE,TRUE,TRUE);
	
	return STATUS_SUCCESS;
}

//查询传输地址IRP的完成例程
NTSTATUS
  IoCompletionQuery(
    IN PDEVICE_OBJECT  fdo,
    IN PIRP  Irp,
    IN PVOID  Context
    )
{
	PTDI_ADDRESS_INFO tdiAddress;
	PTA_ADDRESS taAddress;
	PTDI_ADDRESS_IP ip;
	PCOMPLETION_CREATE_CONTEXT ctx = (PCOMPLETION_CREATE_CONTEXT)Context;
	
	if(Irp->PendingReturned)
	{
		IoMarkIrpPending(Irp);
	}
	
	KdPrint(("tdifilter!IoCompletionQuery: Start.\n"));	
	
	tdiAddress = (PTDI_ADDRESS_INFO)MmGetSystemAddressForMdlSafe(Irp->MdlAddress,NormalPagePriority);	
	taAddress = tdiAddress->Address.Address;
	ip = (PTDI_ADDRESS_IP)(taAddress->Address);	
	KdPrint(("ip:%x,port:%u\n",ip->in_addr,ip->sin_port));
	
	KdPrint(("tdifilter!IoCompletionQuery: End.\n"));	
	
	//释放内存
	//IoFreeMdl(ctx->Mdl);
	//ExFreePoolWithTag(ctx->Buffer,0x12345678);
	
	KeSetEvent(ctx->Event,IO_NO_INCREMENT,FALSE);	
	return STATUS_SUCCESS;
}

NTSTATUS 
  TdiDispatchCreate(
    IN PDEVICE_OBJECT fdo,
    IN PIRP  Irp
    )
{
	//NTSTATUS status;
	KEVENT event;
	PIRP QueryIrp;
	PTDI_ADDRESS_INFO tdiAddress;
	PMDL MdlAddress;
	COMPLETION_CREATE_CONTEXT context;
	PUCHAR Ep = (PUCHAR)PsGetCurrentProcess();
	PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)fdo->DeviceExtension;
	PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation(Irp);
	PFILE_FULL_EA_INFORMATION ea = (PFILE_FULL_EA_INFORMATION)Irp->AssociatedIrp.SystemBuffer;
	
	KeInitializeEvent(&event,NotificationEvent,FALSE);	
	
	if((ea->EaNameLength == TDI_TRANSPORT_ADDRESS_LENGTH)
		&&(memcmp(ea->EaName,TdiTransportAddress,TDI_TRANSPORT_ADDRESS_LENGTH) == 0))
	{
		//生成查询的IRP,给IRP_MJ_CREATE完成例程下发查询
		QueryIrp = TdiBuildInternalDeviceControlIrp(TDI_QUERY_INFORMATION,
					pdx->LowerDeviceObject,
					IrpSp->FileObject,
					NULL,NULL);
		if(QueryIrp == NULL)
		{
			return DispatchAny(fdo,Irp);
		}
		//分配内存
		tdiAddress = (PTDI_ADDRESS_INFO)ExAllocatePoolWithTag(NonPagedPool,
						sizeof(TDI_ADDRESS_INFO)*16,0x12345678);
		MdlAddress = IoAllocateMdl(tdiAddress,
						sizeof(TDI_ADDRESS_INFO)*16,
						FALSE,FALSE,NULL);
		MmBuildMdlForNonPagedPool(MdlAddress);
		
		context.Irp = QueryIrp;
		context.Mdl = MdlAddress;
		context.Buffer = tdiAddress;
		context.Event = &event;
		
		//在这里捕获传输层地址的生成
		KdPrint(("%s:pname[%s].\n",TdiTransportAddress,(Ep + 0x174)));
		IoCopyCurrentIrpStackLocationToNext(Irp);
		//设置IRP_MJ_CREATE完成例程
		IoSetCompletionRoutine(Irp,IoCompletionCreate,&context,TRUE,TRUE,TRUE);
		IoCallDriver(pdx->LowerDeviceObject,Irp);
		
		//等待查询完毕,释放内存
		KeWaitForSingleObject(context.Event,Executive,KernelMode,FALSE,NULL);
		
		//释放内存
		IoFreeMdl(context.Mdl);
		ExFreePoolWithTag(context.Buffer,0x12345678);
		return Irp->IoStatus.Status;	
	}
	else if((ea->EaNameLength == TDI_CONNECTION_CONTEXT_LENGTH)
		 &&(memcmp(ea->EaName,TdiConnectionContext,TDI_CONNECTION_CONTEXT_LENGTH) == 0))
	{
		KdPrint(("%s:pname[%s].\n",TdiConnectionContext,(Ep + 0x174)));
	}
	
	return DispatchAny(fdo,Irp);
}

NTSTATUS 
  DriverEntry( 
    IN PDRIVER_OBJECT  DriverObject, 
    IN PUNICODE_STRING  RegistryPath 
    )
{
	NTSTATUS status;
	ULONG i;
	
	DriverObject->DriverUnload = DriverUnload;
	for(i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i ++)
	{
		DriverObject->MajorFunction[i] = DispatchAny;
	}
	DriverObject->MajorFunction[IRP_MJ_CREATE] = TdiDispatchCreate;
	
	//绑定TCP协议
	status = CreateAndAttachDevice(DriverObject,
				TDI_TCP_DEVICE);
	if(!NT_SUCCESS(status))
	{
		DriverUnload(DriverObject);
		return status;
	}
	
	//绑定UDP协议
	status = CreateAndAttachDevice(DriverObject,
				TDI_UDP_DEVICE);
	if(!NT_SUCCESS(status))
	{
		DriverUnload(DriverObject);
		return status;
	}
	
	//绑定IP协议
	status = CreateAndAttachDevice(DriverObject,
				TDI_RAWIP_DEVICE);
	if(!NT_SUCCESS(status))
	{
		DriverUnload(DriverObject);
		return status;
	}
	
	return STATUS_SUCCESS;
}

[课程]Linux pwn 探索篇！