filter.h

windows hook driver的范例程序。对于开发基于hook的windows平台网络驱动程序有很大借鉴作用

typedef struct IPHeader {
    UCHAR     iph_verlen;     // Version and length 
    UCHAR     iph_tos;        // Type of service 
    USHORT    iph_length;     // Total datagram length 
    USHORT    iph_id;         // Identification 
    USHORT    iph_offset;     // Flags, fragment offset 
    UCHAR     iph_ttl;        // Time to live 
    UCHAR     iph_protocol;   // Protocol 
    USHORT    iph_xsum;       // Header checksum 
    ULONG     iph_src;        // Source address 
    ULONG     iph_dest;       // Destination address 
} IPHeader; 

typedef struct _IPFILTER_INFO{
	PFILE_OBJECT ipfilter;
	PDEVICE_OBJECT filterObject;
	PF_SET_EXTENSION_HOOK_INFO callback;
} IPFILTER_INFO,*PIPFILTER_INFO;

NTSTATUS FilterUnload(PDRIVER_OBJECT DriverObject);
NTSTATUS SetFilterHook(IN PDEVICE_OBJECT DeviceObject,
					   IN PIRP Irp);
NTSTATUS CloseFilterHook(IN PDEVICE_OBJECT DeviceObject,
					   IN PIRP Irp);
PF_FORWARD_ACTION  DropTcpPackets(
        unsigned char   *PacketHeader,
        unsigned char   *Packet,
        unsigned int    PacketLength,
        unsigned int    RecvInterfaceIndex,
        unsigned int    SendInterfaceIndex,
        IPAddr          RecvLinkNextHop,
        IPAddr          SendLinkNextHop
        );