TDIfw在windows 10 1903的测试

最近看了一下TDI的网络过滤驱动，在Vista之后就不支持了，但是据说windows7还是能用，于是想试试在win10上还能不能玩。需要注意的是在win10上的TCP和UDP设备对象的驱动对象变成了tdx，于是有了下面的代码。

#include <Ntifs.h>
#include <ntimage.h>
#include <ntstrsafe.h>
#include <Tdikrnl.h>
#define MEM_TAG		'YCAI'
#define malloc_np(size)	ExAllocatePoolWithTag(NonPagedPool, (size), MEM_TAG)
#define free(ptr)		ExFreePool(ptr)
#define TDI_ADDRESS_MAX_LENGTH	TDI_ADDRESS_LENGTH_OSI_TSAP
#define TA_ADDRESS_MAX			(sizeof(TA_ADDRESS) - 1 + TDI_ADDRESS_MAX_LENGTH)
#define TDI_ADDRESS_INFO_MAX	(sizeof(TDI_ADDRESS_INFO) - 1 + TDI_ADDRESS_MAX_LENGTH)
/* filter result */
enum {
	FILTER_ALLOW = 1,
	FILTER_DENY,
	FILTER_PACKET_LOG,
	FILTER_PACKET_BAD,
	FILTER_DISCONNECT
};
typedef struct {
	PIO_COMPLETION_ROUTINE	old_cr;			/* old (original) completion routine */
	PVOID					old_context;	/* old (original) parameter for old_cr */
	PIO_COMPLETION_ROUTINE	new_cr;			/* new (replaced) completion routine */
	PVOID					new_context;	/* new (replaced) parameter for new_cr */
	PFILE_OBJECT			fileobj;		/* FileObject from IO_STACK_LOCATION */
	PDEVICE_OBJECT			new_devobj;		/* filter device object */
	UCHAR					old_control;	/* old (original) irps->Control */
} TDI_SKIP_CTX;
struct completion {
	PIO_COMPLETION_ROUTINE	routine;
	PVOID					context;
};
typedef struct {
	TDI_ADDRESS_INFO	*tai;		/* address info -- result of TDI_QUERY_ADDRESS_INFO */
	PFILE_OBJECT		fileobj;	/* FileObject from IO_STACK_LOCATION */
} TDI_CREATE_ADDROBJ2_CTX;
struct tdi_obj {
	PFILE_OBJECT fileobj, associate_obj;
	UCHAR   local_addr[TA_ADDRESS_MAX];
};

NTKERNELAPI NTSTATUS ObReferenceObjectByName(IN PUNICODE_STRING ObjectName, IN ULONG Attributes, IN PACCESS_STATE	PassedAccessState OPTIONAL, IN ACCESS_MASK DesiredAccess OPTIONAL, IN POBJECT_TYPE ObjectType OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, OUT	PVOID *Object);
extern PVOID *IoDriverObjectType;
PDEVICE_OBJECT g_tcpfltobj = NULL;
PDEVICE_OBJECT g_udpfltobj = NULL;
PDEVICE_OBJECT g_tcpfltobj6 = NULL;
PDEVICE_OBJECT g_udpfltobj6 = NULL;
DRIVER_OBJECT g_old_DriverObject;
PDRIVER_OBJECT new_DriverObject;
unsigned long ntohl(unsigned long netlong)
{
	unsigned long result = 0;
	((char *)&result)[0] = ((char *)&netlong)[3];
	((char *)&result)[1] = ((char *)&netlong)[2];
	((char *)&result)[2] = ((char *)&netlong)[1];
	((char *)&result)[3] = ((char *)&netlong)[0];
	return result;
}

unsigned short ntohs(unsigned short netshort)
{
	unsigned short result = 0;
	((char *)&result)[0] = ((char *)&netshort)[1];
	((char *)&result)[1] = ((char *)&netshort)[0];
	return result;
}


NTSTATUS get_device_object(wchar_t *name, PDEVICE_OBJECT *devobj) {
	UNICODE_STRING str;
	NTSTATUS status;
	PFILE_OBJECT fileobj;

	RtlInitUnicodeString(&str, name);

	status = IoGetDeviceObjectPointer(&str, FILE_ALL_ACCESS, &fileobj, devobj);
	if (status == STATUS_SUCCESS)
		ObDereferenceObject(fileobj);

	return status;
}


NTSTATUS tdi_skip_complete(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context) {
	TDI_SKIP_CTX *ctx = (TDI_SKIP_CTX *)Context;
	NTSTATUS status = STATUS_SUCCESS;
	PIO_STACK_LOCATION irps;

	if (Irp->IoStatus.Status != STATUS_SUCCESS)
		DbgPrint("tdi_skip_complete: status 0x%x\n", Irp->IoStatus.Status);


	//这里是回到之前的那一层
	Irp->CurrentLocation--;
	Irp->Tail.Overlay.CurrentStackLocation--;


	irps = IoGetCurrentIrpStackLocation(Irp);

	DeviceObject = irps->DeviceObject;//保存一下当前的设备对象

	if (ctx->new_cr != NULL) {
		// restore fileobject (it's NULL)
		irps->FileObject = ctx->fileobj;
		// set new device object in irps
		irps->DeviceObject = ctx->new_devobj;

		// call new completion 
		status = ctx->new_cr(ctx->new_devobj, Irp, ctx->new_context);//这里是到tdi_create_addrobj_complete 去执行

	}
	else
		status = STATUS_SUCCESS;


	// restore routine and context (and even control!)
	irps->CompletionRoutine = ctx->old_cr;
	irps->Context = ctx->old_context;
	irps->Control = ctx->old_control;

	// restore device object
	irps->DeviceObject = DeviceObject;

	Irp->CurrentLocation++;
	Irp->Tail.Overlay.CurrentStackLocation++;


	if (ctx->old_cr != NULL) {
		if (status != STATUS_MORE_PROCESSING_REQUIRED) {
			BOOLEAN b_call = FALSE;
			if (Irp->Cancel) {
				// cancel
				if (ctx->old_control & SL_INVOKE_ON_CANCEL)
					b_call = TRUE;
			}
			else {
				if (Irp->IoStatus.Status >= STATUS_SUCCESS) {
					// success
					if (ctx->old_control & SL_INVOKE_ON_SUCCESS)
						b_call = TRUE;
				}
				else {
					// error
					if (ctx->old_control & SL_INVOKE_ON_ERROR)
						b_call = TRUE;
				}
			}
			if (b_call)
				status = ctx->old_cr(DeviceObject, Irp, ctx->old_context);//之前老的complete如果有的话
		}
		else {
			irps->Control = ctx->old_control;
		}
	}

	free(ctx);

	return status;
}



NTSTATUS tdi_dispatch_complete(PDEVICE_OBJECT devobj, PIRP irp, int filter, PIO_COMPLETION_ROUTINE cr, PVOID context) {
	PIO_STACK_LOCATION irps = IoGetCurrentIrpStackLocation(irp);
	NTSTATUS status;

	if (filter == FILTER_DENY) {
		if (irp->IoStatus.Status == STATUS_SUCCESS) {
			// change status
			status = irp->IoStatus.Status = STATUS_ACCESS_DENIED;
		}
		else {
			// set IRP status unchanged
			status = irp->IoStatus.Status;
		}

		IoCompleteRequest(irp, IO_NO_INCREMENT);
	}
	else if (filter == FILTER_ALLOW) {

		if (cr != NULL) {
			// save old completion routine and context
			TDI_SKIP_CTX *ctx = (TDI_SKIP_CTX *)malloc_np(sizeof(*ctx));
			if (ctx == NULL) {
				DbgPrint("tdi_send_irp_to_old_driver: malloc_np\n");

				status = irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
				IoCompleteRequest(irp, IO_NO_INCREMENT);

				return status;
			}

			ctx->old_cr = irps->CompletionRoutine;
			ctx->old_context = irps->Context;
			ctx->new_cr = cr;
			ctx->new_context = context;
			ctx->fileobj = irps->FileObject;
			ctx->new_devobj = devobj;

			ctx->old_control = irps->Control;

			//手动模拟setcomplete
			irps->Context = ctx;
			irps->CompletionRoutine = (PIO_COMPLETION_ROUTINE)tdi_skip_complete;
			irps->Control = SL_INVOKE_ON_ERROR | SL_INVOKE_ON_SUCCESS | SL_INVOKE_ON_CANCEL;
			//IoSetCompletionRoutine(irp, tdi_skip_complete, ctx, TRUE, TRUE, TRUE);
		}
		/* call original driver */
		status = g_old_DriverObject.MajorFunction[irps->MajorFunction](devobj, irp);
	}
	else {	/* FILTER_UNKNOWN */
		status = irp->IoStatus.Status = STATUS_SUCCESS;	// ???
		IoCompleteRequest(irp, IO_NO_INCREMENT);
	}

	return status;
}


NTSTATUS tdi_create_addrobj_complete2(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context) {
	NTSTATUS status;
	TDI_CREATE_ADDROBJ2_CTX *ctx = (TDI_CREATE_ADDROBJ2_CTX *)Context;
	TA_ADDRESS *addr = ctx->tai->Address.Address;
	struct tdi_obj* obj_item = NULL;
	unsigned long  Ip= ntohl(((TDI_ADDRESS_IP *)(addr->Address))->in_addr);//得到地址
	unsigned long * IpAddress =&Ip;
	//打印一下ip地址和端口
	DbgPrint("tdi_create_addrobj_complete2: IPaddress : %d.%d.%d.%d:%u fileobj0x%llX\n",((UCHAR *)IpAddress)[3], ((UCHAR *)IpAddress)[2], ((UCHAR *)IpAddress)[1], ((UCHAR *)IpAddress)[0], ntohs(((TDI_ADDRESS_IP *)(addr->Address))->sin_port), ctx->fileobj);

	status = STATUS_SUCCESS;
	if (Irp->MdlAddress != NULL) {
		IoFreeMdl(Irp->MdlAddress);
		Irp->MdlAddress = NULL;
	}

	free(ctx->tai);
	free(ctx);

	return STATUS_SUCCESS;
}

NTSTATUS tdi_generic_complete(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context) {

	if (Irp->PendingReturned) {
		DbgPrint("tdi_generic_complete: PENDING\n");
		IoMarkIrpPending(Irp);
	}

	return STATUS_SUCCESS;
}

NTSTATUS tdi_create_addrobj_complete(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context) {
	NTSTATUS status = STATUS_SUCCESS;
	PIO_STACK_LOCATION irps = IoGetCurrentIrpStackLocation(Irp);
	PIRP query_irp = (PIRP)Context;
	PDEVICE_OBJECT devobj;
	TDI_CREATE_ADDROBJ2_CTX *ctx = NULL;
	PMDL mdl = NULL;

	if (Irp->IoStatus.Status != STATUS_SUCCESS) {
		DbgPrint("tdi_create_addrobj_complete: status 0x%x\n", Irp->IoStatus.Status);
		status = Irp->IoStatus.Status;
		goto done;
	}

	// query addrobj address:port

	ctx = (TDI_CREATE_ADDROBJ2_CTX *)malloc_np(sizeof(TDI_CREATE_ADDROBJ2_CTX));
	if (ctx == NULL) {
		DbgPrint("tdi_create_addrobj_complete: malloc_np\n");
		status = STATUS_INSUFFICIENT_RESOURCES;
		goto done;
	}

	ctx->fileobj = irps->FileObject;

	ctx->tai = (TDI_ADDRESS_INFO *)malloc_np(TDI_ADDRESS_INFO_MAX);
	if (ctx->tai == NULL) {
		DbgPrint("tdi_create_addrobj_complete: malloc_np!\n");
		status = STATUS_INSUFFICIENT_RESOURCES;
		goto done;
	}

	mdl = IoAllocateMdl(ctx->tai, TDI_ADDRESS_INFO_MAX, FALSE, FALSE, NULL);
	if (mdl == NULL) {
		DbgPrint("tdi_create_addrobj_complete: IoAllocateMdl!\n");
		status = STATUS_INSUFFICIENT_RESOURCES;
		goto done;
	}
	MmBuildMdlForNonPagedPool(mdl);

	devobj = DeviceObject;
	if (devobj == NULL) {
		DbgPrint("tdi_create_addrobj_complete: get_original_devobj!\n");

		status = STATUS_INVALID_PARAMETER;
		goto done;
	}

	TdiBuildQueryInformation(query_irp, devobj, irps->FileObject, tdi_create_addrobj_complete2, ctx, TDI_QUERY_ADDRESS_INFO, mdl);

	status = IoCallDriver(devobj, query_irp);//这里需要继续往下传
	query_irp = NULL;
	mdl = NULL;
	ctx = NULL;

	if (status != STATUS_SUCCESS) {//STATUS_PENDING
		DbgPrint("tdi_create_addrobj_complete: IoCallDriver: 0x%x   STATUS_PENDING==0x103\n", status);
		goto done;
	}

	status = STATUS_SUCCESS;

done:
	// cleanup
	if (mdl != NULL)
		IoFreeMdl(mdl);

	if (ctx != NULL) {
		if (ctx->tai != NULL)
			free(ctx->tai);
		free(ctx);
	}

	if (query_irp != NULL)
		IoCompleteRequest(query_irp, IO_NO_INCREMENT);

	Irp->IoStatus.Status = status;

	return tdi_generic_complete(DeviceObject, Irp, Context);
}




int tdi_create(PIRP irp, PIO_STACK_LOCATION irps, struct completion *completion) {
	FILE_FULL_EA_INFORMATION *ea = (FILE_FULL_EA_INFORMATION *)irp->AssociatedIrp.SystemBuffer;

	if (ea != NULL) {
		PDEVICE_OBJECT devobj;

		devobj = irps->DeviceObject;
		if (devobj == NULL) {
			DbgPrint("tdi_create: unknown device object 0x%llX!\n", irps->DeviceObject);
			return FILTER_DENY;
		}

		if (ea->EaNameLength == TDI_TRANSPORT_ADDRESS_LENGTH && memcmp(ea->EaName, TdiTransportAddress, TDI_TRANSPORT_ADDRESS_LENGTH) == 0) {//传输
			PIRP query_irp;
			//搞一个空的irp
			query_irp = TdiBuildInternalDeviceControlIrp(TDI_QUERY_INFORMATION, devobj, irps->FileObject, NULL, NULL);
			if (query_irp == NULL) {
				DbgPrint("tdi_create: TdiBuildInternalDeviceControlIrp\n");
				return FILTER_DENY;
			}

			completion->routine = tdi_create_addrobj_complete;//这里是设置完成的回调
			completion->context = query_irp;

		}
		else if (ea->EaNameLength == TDI_CONNECTION_CONTEXT_LENGTH && memcmp(ea->EaName, TdiConnectionContext, TDI_CONNECTION_CONTEXT_LENGTH) == 0) {//连接

			CONNECTION_CONTEXT conn_ctx = *(CONNECTION_CONTEXT *)(ea->EaName + ea->EaNameLength + 1);//这个是链接上下文
		}

	}

	return FILTER_ALLOW;
}

int tdi_connect(PIRP irp, PIO_STACK_LOCATION irps, struct completion *completion){
	PTDI_REQUEST_KERNEL_CONNECT param = (PTDI_REQUEST_KERNEL_CONNECT)(&irps->Parameters);
	TA_ADDRESS *remote_addr = ((TRANSPORT_ADDRESS *)(param->RequestConnectionInformation->RemoteAddress))->Address;
	unsigned long  Ip = ntohl(((TDI_ADDRESS_IP *)(remote_addr->Address))->in_addr);//得到地址
	unsigned long * IpAddress = &Ip;

	// 监控TCP外连参数 ---在这里处理
	DbgPrint("pid:%d tdi_connect: connobj 0x%llX, remote:%d.%d.%d.%d:%u\n",
		PsGetCurrentProcessId(),
		irps->FileObject,
		((UCHAR *)IpAddress)[3], ((UCHAR *)IpAddress)[2], ((UCHAR *)IpAddress)[1], ((UCHAR *)IpAddress)[0],
		ntohs(((TDI_ADDRESS_IP *)(remote_addr->Address))->sin_port));


	return FILTER_ALLOW;
}
int tdi_associate_address(PIRP irp, PIO_STACK_LOCATION irps, struct completion *completion){
	HANDLE addr_handle = ((TDI_REQUEST_KERNEL_ASSOCIATE *)(&irps->Parameters))->AddressHandle;
	PFILE_OBJECT addrobj = NULL;
	NTSTATUS status;
	int result = FILTER_DENY;

	status = ObReferenceObjectByHandle(addr_handle, GENERIC_READ, NULL, KernelMode, &addrobj, NULL);
	if (status != STATUS_SUCCESS) {
		DbgPrint("[tdi_fw] tdi_associate_address: ObReferenceObjectByHandle: 0x%x\n", status);
	}

	DbgPrint("tdi_associate_address: connobj = 0x%llX ---> addrobj = 0x%llX\n",irps->FileObject, addrobj);//这里是绑定本地的transport,只打印不记录

	result = FILTER_ALLOW;
	if (addrobj != NULL)
		ObDereferenceObject(addrobj);

	return result;
}

NTSTATUS TdiHookDeviceDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP irp) {
	PIO_STACK_LOCATION irps;
	NTSTATUS status;
	int result;
	struct completion completion = { 0 };
	//假装检查一下
	if (irp == NULL)
		return STATUS_SUCCESS;

	irps = IoGetCurrentIrpStackLocation(irp);


	if (DeviceObject == g_tcpfltobj || DeviceObject == g_udpfltobj) {//这里过滤TCP和UDP
		switch (irps->MajorFunction) {
		case IRP_MJ_CREATE:
			result = tdi_create(irp, irps, &completion);
			status = tdi_dispatch_complete(DeviceObject, irp, result, completion.routine, completion.context);
			//DbgPrint("IRP_MJ_CREATE \n");
			break;
		/*case IRP_MJ_DEVICE_CONTROL:
			if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
				status = TdiMapUserRequest(DeviceObject, irp, irps);
			}else
				status = STATUS_NOT_IMPLEMENTED; // set fake status

			if (status != STATUS_SUCCESS) {
				void *buf = (irps->Parameters.DeviceIoControl.IoControlCode == IOCTL_TDI_QUERY_DIRECT_SEND_HANDLER) ?irps->Parameters.DeviceIoControl.Type3InputBuffer : NULL;
				//这里的buf是send的指针，目前不用
				// send IRP to original driver
				status = tdi_dispatch_complete(DeviceObject, irp, FILTER_ALLOW, NULL, NULL);
				break;
			}*/
		case IRP_MJ_INTERNAL_DEVICE_CONTROL:
			/* 根据irps->MinorFunction类型进行处理 */
			if (irps->MinorFunction == TDI_CONNECT) {
				tdi_connect(irp, irps, &completion);
			}
			else if (irps->MinorFunction == TDI_ASSOCIATE_ADDRESS) {
				tdi_associate_address(irp, irps, &completion);
			}

			status = tdi_dispatch_complete(DeviceObject, irp, FILTER_ALLOW,completion.routine, completion.context);
			break;
		default:
			DbgPrint("default \n");
			status = tdi_dispatch_complete(DeviceObject, irp, FILTER_ALLOW, NULL, NULL);
			return status;
		}




	}
	else
		status = g_old_DriverObject.MajorFunction[irps->MajorFunction](DeviceObject, irp);//避免二次完成


	return status;
}

void HookTcpIp() {

	UNICODE_STRING drv_name;
	NTSTATUS status;
	int i;

	//之后用来做过滤的
	status = get_device_object(L"\\Device\\Tcp", &g_tcpfltobj);
	status = get_device_object(L"\\Device\\Udp", &g_udpfltobj);
	//status = get_device_object(L"\\Device\\Tcp6", &g_tcpfltobj6);
	//status = get_device_object(L"\\Device\\Udp6", &g_udpfltobj6);
	//DbgPrint("Tcp  %llX  Udp  %llX  Tcp6  %llX  Udp6  %llX \n", g_tcpfltobj, g_udpfltobj, g_tcpfltobj6, g_udpfltobj6);
	RtlInitUnicodeString(&drv_name, L"\\Driver\\tdx");//tdx 

	status = ObReferenceObjectByName(&drv_name, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &new_DriverObject);
	if (status != STATUS_SUCCESS) {
		DbgPrint("ObReferenceObjectByName failed \n");
		return;
	}
	ObDereferenceObject(new_DriverObject);//解引用

	for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) {
		g_old_DriverObject.MajorFunction[i] = new_DriverObject->MajorFunction[i];
		new_DriverObject->MajorFunction[i] = TdiHookDeviceDispatch;//替换方法
	}
}





VOID DriverUnload(PDRIVER_OBJECT DriverObject) {
	int i;
	for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
		new_DriverObject->MajorFunction[i] = g_old_DriverObject.MajorFunction[i];//还原
	DbgPrint("See You !\n");
}


NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegPath) {

	DriverObject->DriverUnload = DriverUnload;
	HookTcpIp();
	return STATUS_SUCCESS;
}

经过测试无法在打开ie的时候无法拦截到connect请求，但是如果关闭网卡之后在打开，可以看到IRP_MJ_CREATE和IRP_MJ_INTERNAL_DEVICE_CONTROL（TDI_ASSOCIATE_ADDRESS）的消息，由于技术有限也不知道是不是姿势不对还是说windows真的改了。