group__npf__code.html

winpcap文档

          <td class="paramname"> <em>mem</em></td><td>&nbsp;</td>
        </tr>
        <tr>
          <td></td>
          <td>)</td>
          <td></td><td></td><td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
Translates a set of BPF instructions in a set of x86 ones. 
<p>
<dl compact><dt><b>Parameters:</b></dt><dd>
  <table border="0" cellspacing="2" cellpadding="0">
    <tr><td valign="top"></td><td valign="top"><em>ins</em>&nbsp;</td><td>Pointer to the BPF instructions that will be translated into x86 code. </td></tr>
    <tr><td valign="top"></td><td valign="top"><em>nins</em>&nbsp;</td><td>Number of instructions to translate. </td></tr>
    <tr><td valign="top"></td><td valign="top"><em>mem</em>&nbsp;</td><td>Memory used by the x86 function to emulate the RAM of the BPF pseudo processor. </td></tr>
  </table>
</dl>
<dl class="return" compact><dt><b>Returns:</b></dt><dd>The x86 filtering function.</dd></dl>
This function does the hard work for the JIT compilation. It takes a group of BPF pseudo instructions and through the instruction macros defined in <a class="el" href="jitter_8h.html">jitter.h</a> it is able to create an function directly executable by NPF. 
</div>
</div><p>
<a class="anchor" name="g8b4f23818c00c1186aa0bc59b57ff6c6"></a><!-- doxytag: member="Packet.h::createDevice" ref="g8b4f23818c00c1186aa0bc59b57ff6c6" args="(IN OUT PDRIVER_OBJECT adriverObjectP, IN PUNICODE_STRING amacNameP, NDIS_HANDLE aProtoHandle)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">BOOLEAN createDevice           </td>
          <td>(</td>
          <td class="paramtype">IN OUT PDRIVER_OBJECT&nbsp;</td>
          <td class="paramname"> <em>adriverObjectP</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">IN PUNICODE_STRING&nbsp;</td>
          <td class="paramname"> <em>amacNameP</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">NDIS_HANDLE&nbsp;</td>
          <td class="paramname"> <em>aProtoHandle</em></td><td>&nbsp;</td>
        </tr>
        <tr>
          <td></td>
          <td>)</td>
          <td></td><td></td><td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
Creates a device for a given MAC. 
<p>
<dl compact><dt><b>Parameters:</b></dt><dd>
  <table border="0" cellspacing="2" cellpadding="0">
    <tr><td valign="top"></td><td valign="top"><em>adriverObjectP</em>&nbsp;</td><td>The driver object that will be associated with the device, i.e. the one of NPF. </td></tr>
    <tr><td valign="top"></td><td valign="top"><em>amacNameP</em>&nbsp;</td><td>The name of the network interface that the device will point. </td></tr>
    <tr><td valign="top"></td><td valign="top"><em>aProtoHandle</em>&nbsp;</td><td>NDIS protocol handle of NPF. </td></tr>
  </table>
</dl>
<dl class="return" compact><dt><b>Returns:</b></dt><dd>If the function succeeds, the return value is nonzero.</dd></dl>
NPF creates a device for every valid network adapter. The new device points to the NPF driver, but contains information about the original device. In this way, when the user opens the new device, NPF will be able to determine the correct adapter to use. 
</div>
</div><p>
<a class="anchor" name="g6502d781bd20234a06710b92d540baba"></a><!-- doxytag: member="Packet.h::DriverEntry" ref="g6502d781bd20234a06710b92d540baba" args="(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">NTSTATUS DriverEntry           </td>
          <td>(</td>
          <td class="paramtype">IN PDRIVER_OBJECT&nbsp;</td>
          <td class="paramname"> <em>DriverObject</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">IN PUNICODE_STRING&nbsp;</td>
          <td class="paramname"> <em>RegistryPath</em></td><td>&nbsp;</td>
        </tr>
        <tr>
          <td></td>
          <td>)</td>
          <td></td><td></td><td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
The initialization routine of the driver. 
<p>
<dl compact><dt><b>Parameters:</b></dt><dd>
  <table border="0" cellspacing="2" cellpadding="0">
    <tr><td valign="top"></td><td valign="top"><em>DriverObject</em>&nbsp;</td><td>The driver object of NPF created by the system. </td></tr>
    <tr><td valign="top"></td><td valign="top"><em>RegistryPath</em>&nbsp;</td><td>The registry path containing the keys related to the driver. </td></tr>
  </table>
</dl>
<dl class="return" compact><dt><b>Returns:</b></dt><dd>A string containing a list of network adapters.</dd></dl>
DriverEntry is a mandatory function in a device driver. Like the main() of a user level program, it is called by the system when the driver is loaded in memory and started. Its purpose is to initialize the driver, performing all the allocations and the setup. In particular, DriverEntry registers all the driver's I/O callbacks, creates the devices, defines NPF as a protocol inside NDIS. 
</div>
</div><p>
<a class="anchor" name="gfc395636686df00f554efbd2010f73cb"></a><!-- doxytag: member="Packet.h::getAdaptersList" ref="gfc395636686df00f554efbd2010f73cb" args="(VOID)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">PWCHAR getAdaptersList           </td>
          <td>(</td>
          <td class="paramtype">VOID&nbsp;</td>
          <td class="paramname">          </td>
          <td>&nbsp;)&nbsp;</td>
          <td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
Returns the list of the MACs available on the system. 
<p>
<dl class="return" compact><dt><b>Returns:</b></dt><dd>A string containing a list of network adapters.</dd></dl>
The list of adapters is retrieved from the SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318} registry key. NPF tries to create its bindings from this list. In this way it is possible to be loaded and unloaded dynamically without passing from the control panel. 
</div>
</div><p>
<a class="anchor" name="gdd6737f745e21b37b8613b489a96687d"></a><!-- doxytag: member="Packet.h::GetBuffOccupation" ref="gdd6737f745e21b37b8613b489a96687d" args="(POPEN_INSTANCE Open)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">UINT GetBuffOccupation           </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="struct__OPEN__INSTANCE.html">POPEN_INSTANCE</a>&nbsp;</td>
          <td class="paramname"> <em>Open</em>          </td>
          <td>&nbsp;)&nbsp;</td>
          <td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
Returns the amount of bytes present in the packet buffer. 
<p>
<dl compact><dt><b>Parameters:</b></dt><dd>
  <table border="0" cellspacing="2" cellpadding="0">
    <tr><td valign="top"></td><td valign="top"><em>Open</em>&nbsp;</td><td>The NPF instance that closes the file. </td></tr>
  </table>
</dl>

</div>
</div><p>
<a class="anchor" name="gcf0e32b371eb9283e5cf1de0dfb15629"></a><!-- doxytag: member="Packet.h::getTcpBindings" ref="gcf0e32b371eb9283e5cf1de0dfb15629" args="(VOID)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">PKEY_VALUE_PARTIAL_INFORMATION getTcpBindings           </td>
          <td>(</td>
          <td class="paramtype">VOID&nbsp;</td>
          <td class="paramname">          </td>
          <td>&nbsp;)&nbsp;</td>
          <td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
Returns the MACs that bind to TCP/IP. 
<p>
<dl class="return" compact><dt><b>Returns:</b></dt><dd>Pointer to the registry key containing the list of adapters on which TCP/IP is bound.</dd></dl>
If <a class="el" href="group__NPF__code.html#gfc395636686df00f554efbd2010f73cb">getAdaptersList()</a> fails, NPF tries to obtain the TCP/IP bindings through this function. 
</div>
</div><p>
<a class="anchor" name="g9a78f9937b2d7d00250f49dcaeb5bab0"></a><!-- doxytag: member="Packet.h::NPF_BindAdapter" ref="g9a78f9937b2d7d00250f49dcaeb5bab0" args="(OUT PNDIS_STATUS Status, IN NDIS_HANDLE BindContext, IN PNDIS_STRING DeviceName, IN PVOID SystemSpecific1, IN PVOID SystemSpecific2)" -->
<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname">VOID NPF_BindAdapter           </td>
          <td>(</td>
          <td class="paramtype">OUT PNDIS_STATUS&nbsp;</td>
          <td class="paramname"> <em>Status</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">IN NDIS_HANDLE&nbsp;</td>
          <td class="paramname"> <em>BindContext</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">IN PNDIS_STRING&nbsp;</td>
          <td class="paramname"> <em>DeviceName</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">IN PVOID&nbsp;</td>
          <td class="paramname"> <em>SystemSpecific1</em>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">IN PVOID&nbsp;</td>
          <td class="paramname"> <em>SystemSpecific2</em></td><td>&nbsp;</td>
        </tr>
        <tr>
          <td></td>
          <td>)</td>
          <td></td><td></td><td width="100%"></td>
        </tr>
      </table>
</div>
<div class="memdoc">

<p>
Callback for NDIS BindAdapterHandler. Not used by NPF. 
<p>
Function called by NDIS when a new adapter is installed on the machine With Plug and Play.