写一个WFP驱动,拦截网络的代码
时间: 2023-02-12 13:37:44 浏览: 206
WFP (Windows Filtering Platform) 是 Windows 操作系统的一个高级网络过滤系统。以下是一段示例代码,用于拦截网络:
```
#include <Windows.h>
#include <fltuser.h>
#pragma comment(lib, "Fltlib.lib")
void DriverUnload(PDRIVER_OBJECT DriverObject)
{
UNREFERENCED_PARAMETER(DriverObject);
}
NTSTATUS FilterConnect(PFLT_PORT ClientPort, PVOID ServerPortCookie, PVOID ConnectionContext, ULONG SizeOfContext, PVOID *ConnectionCookie)
{
UNREFERENCED_PARAMETER(ClientPort);
UNREFERENCED_PARAMETER(ServerPortCookie);
UNREFERENCED_PARAMETER(ConnectionContext);
UNREFERENCED_PARAMETER(SizeOfContext);
UNREFERENCED_PARAMETER(ConnectionCookie);
return STATUS_SUCCESS;
}
NTSTATUS FilterDisconnect(PVOID ConnectionCookie)
{
UNREFERENCED_PARAMETER(ConnectionCookie);
return STATUS_SUCCESS;
}
NTSTATUS FilterMessage(PVOID ConnectionCookie, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, PULONG ReturnOutputBufferLength)
{
UNREFERENCED_PARAMETER(ConnectionCookie);
UNREFERENCED_PARAMETER(InputBuffer);
UNREFERENCED_PARAMETER(InputBufferLength);
UNREFERENCED_PARAMETER(OutputBuffer);
UNREFERENCED_PARAMETER(OutputBufferLength);
UNREFERENCED_PARAMETER(ReturnOutputBufferLength);
return STATUS_SUCCESS;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING PortName = RTL_CONSTANT_STRING(L"\\MyFilterPort");
PFLT_PORT ServerPort = NULL;
PFLT_FILTER Filter = NULL;
DriverObject->DriverUnload = DriverUnload;
status = FltRegisterFilter(DriverObject, &FilterRegistration, &Filter);
if (!NT_SUCCESS(status))
{
goto Cleanup;
}
status = FltBuildDefaultSecurityDescriptor(&Filter->SecurityDescriptor, FLT_PORT_ALL_ACCESS);
if (!NT_SUCCESS(status))
{
goto Cleanup;
}
status = FltCreateCommunicationPort(Filter, &ServerPort, &PortCommunication, FilterConnect, FilterDisconnect, FilterMessage, 1);
if (!NT_SUCCESS(status))
阅读全文