hookndis.cpp

一些有C制作Fire Wall的代码

#include "hookndis.h"
//#include "init.h"
#include "hook.h"
#include "myfun.h"
//#include "fun.h"

PVOID m_NdisBaseAddress=NULL;
/*#pragma comment(lib,"ntoskrnl.lib")
#pragma comment(lib,"wdm.lib")
#pragma comment(lib,"libcntpr.lib")*/

BOOLEAN GetNdisModuleAddress(PVOID m_BaseAddr)
{	
	BOOLEAN bReturn = FALSE;
    ULONG nSize, i, nCount, nLength;
    PULONG pBuffer=NULL;
    PSYSTEM_MODULE_INFORMATION pModule;
//    KIRQL OldIrql;
    // 得到模块信息共需要的缓冲区大小
    ZwQuerySystemInformation(11, &nSize, 0, &nSize);
    // 申请内存空间
	pBuffer = (PULONG)ExAllocatePool(NonPagedPool, nSize);
    // 得到所有的核心模块信息
    ZwQuerySystemInformation(11, pBuffer, nSize, 0);
    // 得到模块的个数
    //
    nCount = *pBuffer;
    // 得到模块信息记录的指针
    //
    pModule = (PSYSTEM_MODULE_INFORMATION)(pBuffer + 1);
    // 循环查找 Ndis.sys 模块
    //
    for(i = 0; i < nCount; i++)
    {
        nLength = strlen(pModule[i].Name);
        if(nLength >= 8 
            && _stricmp(pModule[i].Name + (nLength - 8), "ndis.sys") == 0)//进行对比
        {
            //
            // 找到 Ndis.sys 模块，将基地址保存到m_NdisBaseAddress
            //
            m_NdisBaseAddress = pModule[i].BaseAddress;
			m_BaseAddr=m_NdisBaseAddress;
            bReturn = TRUE;
            break;
        }
    }
    // 释放内存
	ExFreePool(pBuffer);
    return bReturn;
}