[原创]sys里https(只支持tls1.2 tls1.3)通讯的bin-编程技术-看雪安全社区

[原创]sys里https(只支持tls1.2 tls1.3)通讯的bin

发表于: 2026-6-15 09:32 1290

[原创]sys里https(只支持tls1.2 tls1.3)通讯的bin

correy

2026-6-15 09:32

1290

例子代码：

```
#include "DriverEntry.h"
#include "..\libssl\libssl.h"

_Function_class_(DRIVER_UNLOAD)
_IRQL_requires_(PASSIVE_LEVEL)
_IRQL_requires_same_
VOID Unload(_In_ struct _DRIVER_OBJECT * DriverObject)
{
    UNREFERENCED_PARAMETER(DriverObject);

PAGED_CODE();
}

NTSTATUS TestGetHttps()
/*
在 HTTP/1.1 中 Host 是必须的，否则服务器通常会返回 400 Bad Request。
添加 Connection: close 以便在接收完数据后服务器主动断开连接，避免 Recv 超时阻塞。

针对 0xC000042A (STATUS_REQUEST_OUT_OF_SEQUENCE) 错误，这通常表示 TLS 协议状态机在处理接收数据时遇到了意外的报文序列。
在 HTTPS 通信中，这最常见的原因是接收缓冲区过小，无法容纳完整的 TLS 记录（TLS Record）。
TLS 记录最大可达 16KB 加上少量头部开销。如果缓冲区不足以存放一个完整的记录，底层解密函数（如 DecryptMessage）可能会返回SEC_E_INCOMPLETE_MESSAGE，
而驱动层并未正确处理分片读取，导致状态错误或直接返回序列错误。
*/
{
    NTSTATUS Status = STATUS_UNSUCCESSFUL;
    KPH_TLS_HANDLE Tls = nullptr;
    PADDRINFOEXW AddressInfo{};
    KPH_SOCKET_HANDLE Socket{};
    PCHAR Buffer{};
    const ULONG BufferSize = 0x5000; // 20KB

Status = KphInitializeSocket();
    if (!NT_SUCCESS(Status)) {
        Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
        return Status;
    }

__try {
        Status = KphSocketTlsCreate(&Tls);
        if (!NT_SUCCESS(Status)) {
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
            __leave;
        }
        ASSERT(Tls);

UNICODE_STRING NodeName = RTL_CONSTANT_STRING(L"www.microsoft.com"); // IP变化很频繁，且还有可能是IPv6.
        LARGE_INTEGER Timeout = {.QuadPart = -90000000ll};                   // 9 seconds
        Status = KphGetAddressInfo(&NodeName, NULL, NULL, &Timeout, &AddressInfo);
        if (!NT_SUCCESS(Status)) {
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
            __leave;
        }

if (!AddressInfo || !AddressInfo->ai_addr) {
            Status = STATUS_INVALID_NETWORK_RESPONSE;
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
            __leave;
        }

PSOCKADDR LocalAddress{};
        SOCKADDR_IN LocalAddressV4 = {0};
        SOCKADDR_IN6 LocalAddressV6 = {0};

switch (AddressInfo->ai_family) {
        case AF_INET:
        {
            IN4ADDR_SETANY(&LocalAddressV4);
            LocalAddress = (PSOCKADDR)&LocalAddressV4;

PSOCKADDR_IN RemoteAddress = (PSOCKADDR_IN)AddressInfo->ai_addr;
            RemoteAddress->sin_port = RtlUshortByteSwap(IPPORT_HTTPS);

CHAR RemoteIPv4[17]{};
            RtlIpv4AddressToStringA(&RemoteAddress->sin_addr, RemoteIPv4);
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "RemoteIPv4:%s", RemoteIPv4);

break;
        }
        case AF_INET6:
        {
            IN6ADDR_SETANY(&LocalAddressV6);
            LocalAddress = (PSOCKADDR)&LocalAddressV6;

PSOCKADDR_IN6 RemoteAddress = (PSOCKADDR_IN6)AddressInfo->ai_addr;
            RemoteAddress->sin6_port = RtlUshortByteSwap(IPPORT_HTTPS);

CHAR RemoteIPv6[65]{};
            RtlIpv6AddressToStringA(&RemoteAddress->sin6_addr, RemoteIPv6);
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "RemoteIPv6:%s", RemoteIPv6);

break;
        }
        default:
            Status = STATUS_INVALID_PARAMETER; // 不支持的协议族
            __leave;
        }

USHORT SocketType{SOCK_STREAM};
        ULONG Protocol{IPPROTO_TCP};
        Status = KphSocketConnect(SocketType, Protocol, LocalAddress, AddressInfo->ai_addr, &Timeout, &Socket);
        if (!NT_SUCCESS(Status)) {
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
            __leave;
        }

Status = KphSocketTlsHandshake(Socket, &Timeout, Tls, &NodeName);
        if (!NT_SUCCESS(Status)) {
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
            __leave;
        }

static const char Message[] = "GET / HTTP/1.1\r\nHost: www.microsoft.com\r\nConnection: close\r\n\r\n";
        ULONG Length = sizeof(Message) - 1;
        Status = KphSocketTlsSend(Socket, &Timeout, Tls, (PVOID)Message, Length);
        if (!NT_SUCCESS(Status)) {
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
            __leave;
        }

// 关键修复：TLS 记录最大可达 16KB + overhead。
        // 使用 20KB (0x5000) 缓冲区以确保可以容纳任何单个 TLS 状态记录。
        // 任何小于 16KB 的缓冲区都可能导致 SCHANNEL 返回 BUFFER_TOO_SMALL 或 REQUEST_OUT_OF_SEQUENCE。
        Buffer = (PCHAR)ExAllocatePool2(POOL_FLAG_NON_PAGED, BufferSize, TAG);
        if (!Buffer) {
            Status = STATUS_INSUFFICIENT_RESOURCES;
            Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
            __leave;
        }

for (;;) {
            Length = BufferSize - 1; // 空一个字节，用于打印。
            Status = KphSocketTlsRecv(Socket, &Timeout, Tls, Buffer, &Length);
            if (!NT_SUCCESS(Status)) {
                if (Status == STATUS_END_OF_FILE || Status == STATUS_CONNECTION_RESET) {
                    Status = STATUS_SUCCESS; // 对端关闭连接属于正常结束。
                } else {
                    Print(DPFLTR_DEFAULT_ID, DPFLTR_INFO_LEVEL, "Status:%#x", Status);
                }
                break;
            }

if (!Length) { // 接收完毕的标志。
                break;
            }

Buffer[Length] = '\0';
            Print(DPFLTR_DEFAULT_ID, DPFLTR_WARNING_LEVEL, "%s", Buffer);
        }
    } __finally {
        if (Buffer) {
            ExFreePoolWithTag(Buffer, TAG);
        }

if (AddressInfo) {
            KphFreeAddressInfo(AddressInfo);
        }

if (Socket) {
            if (Tls) {
                KphSocketTlsShutdown(Socket, Tls); // 如果已连接，尝试发送关闭通知
            }

KphSocketClose(Socket);
        }

if (Tls) {
            KphSocketTlsClose(Tls);
        }

KphCleanupSocket();
    }

return Status;
}

EXTERN_C
DRIVER_INITIALIZE DriverEntry;
// #pragma INITCODE
// #pragma alloc_text(INIT, DriverEntry)
_Function_class_(DRIVER_INITIALIZE)
_IRQL_requires_same_
_IRQL_requires_(PASSIVE_LEVEL)
EXTERN_C
NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
{
    NTSTATUS Status = STATUS_UNSUCCESSFUL;

UNREFERENCED_PARAMETER(RegistryPath);

//if (!KD_DEBUGGER_NOT_PRESENT) {
    //    KdBreakPoint(); //__debugbreak();
    //}

// if (*InitSafeBootMode) {
    //     return STATUS_ACCESS_DENIED;
    // }

PAGED_CODE();

ExInitializeDriverRuntime(DrvRtPoolNxOptIn);

DriverObject->DriverUnload = Unload;

Status = TestGetHttps();

return Status;
}

```

核心代码的目录结构：
```
PS D:\git\libssl\src\libssl> dir

Directory: D:\git\libssl\src\libssl

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a---           2025/7/22    10:48           5326 libssl.h
-a---           2026/1/18    21:08          10008 libssl.vcxproj
-a---           2025/7/22    10:48           1433 libssl.vcxproj.filters
-a---           2025/7/22    10:48           3437 pch.cpp
-a---           2025/7/22    10:48           6320 pch.h
-a---            2026/5/3     9:30          11939 socket.cpp
-a---           2025/7/22    10:48           1945 socket.h
-a---            2026/5/3     9:47          43543 tls.cpp
-a---            2026/4/1     9:28          13910 tls.h

PS D:\git\libssl\src\libssl>
```

测试验证：dbgview.exe或wireshark.exe.

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

上传的附件：

test.sys （28.50kb，9次下载）

收藏・2

点赞・2

打赏

最新回复 (1)
correy 雪币： 1641 活跃值： (4391) 能力值： ( LV12，RANK：415 ) 在线值：发帖 69 回帖 150 粉丝 21 关注私信	correy 4 2 楼 libssl.h和libssl.lib暂不公开。 2026-6-15 09:37 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

correy

发帖

150

回帖

415

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号