防火墙与安全工具

开发平台：
Asm

drvZtsFw.bat：源码内容
							;@echo off
;goto make
.386
.model flat, stdcall
option casemap:none
include c:masm32includew2kntstatus.inc
include c:masm32includew2kntddk.inc
include c:masm32includew2kntoskrnl.inc
include c:masm32includew2kipfirewall.inc
includelib c:masm32libw2kntoskrnl.lib
include c:masm32MacrosStrings.mac
include ..common.inc
_DispatchCreateClose proto :PDEVICE_OBJECT,:PIRP
_DriverUnload proto :PDRIVER_OBJECT
_DispatchControl proto :PDEVICE_OBJECT,:PIRP
_SetFilterFunction proto :DWORD,:DWORD
_IpFilterProc proto :DWORD,:DWORD,:DWORD,:DWORD,:DWORD,:DWORD,:DWORD
DEVICE_EXTENSION struct
	protocol	db  ?
	srcIp		dd  ?
	srcPort		dw  ?
	dstIp		dd  ?
	dstPort		dw  ?
	bIn		dd  ?
	
	handle		dd  ?
	event		PKEVENT <>
DEVICE_EXTENSION ends
.const
CCOUNTED_UNICODE_STRING	"\Device\devZtsFw", g_usDeviceName, 4
CCOUNTED_UNICODE_STRING	"\??\slZtsFw", g_usSymbolicLinkName, 4
CCOUNTED_UNICODE_STRING	"\BaseNamedObjects\FwHook_Event", g_usFwHookEvent, 4
CCOUNTED_UNICODE_STRING	"\Device\Ip", g_usIpFilterName, 4
.data
	g_lpExtension	dd  0
	g_bLoaded	dd  0
.data?
	g_Ports		dw  MAX_PORTS+1 dup (?)
.code
DriverEntry proc uses esi, pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
	LOCAL	status : NTSTATUS
	LOCAL	pDeviceObject : PDEVICE_OBJECT
	
;	int	3
	mov	status, STATUS_DEVICE_CONFIGURATION_ERROR
	invoke	IoCreateDevice, pDriverObject, sizeof DEVICE_EXTENSION, addr g_usDeviceName, 
			FILE_DEVICE_UNKNOWN, 0, FALSE, addr pDeviceObject
	.if eax==STATUS_SUCCESS
		mov	esi, pDeviceObject
		assume	esi : ptr DEVICE_OBJECT
		mov	esi, [esi].DeviceExtension
		mov	g_lpExtension, esi
		invoke	IoCreateSymbolicLink, addr g_usSymbolicLinkName, addr g_usDeviceName
		.if eax==STATUS_SUCCESS
			mov	eax, pDriverObject
			assume	eax:ptr DRIVER_OBJECT
			mov	[eax].DriverUnload,					   offset _DriverUnload
			mov	[eax].MajorFunction[IRP_MJ_CREATE*(sizeof PVOID)],	   offset _DispatchCreateClose
			mov	[eax].MajorFunction[IRP_MJ_CLOSE*(sizeof PVOID)],	   offset _DispatchCreateClose
			mov	[eax].MajorFunction[IRP_MJ_DEVICE_CONTROL*(sizeof PVOID)], offset _DispatchControl
			assume	eax:nothing
			
			assume	esi : ptr DEVICE_EXTENSION
			lea	eax, [esi].handle
			invoke	IoCreateNotificationEvent, addr g_usFwHookEvent, eax
			mov	[esi].event, eax
			
			invoke	KeClearEvent, [esi].event
			
			mov	status, STATUS_SUCCESS
		.else
			invoke	IoDeleteDevice, pDeviceObject
		.endif
	.endif
	mov eax, status
	ret
DriverEntry endp
_DispatchControl proc uses esi edi ebx,pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
	LOCAL	status : NTSTATUS
	LOCAL	dwBytesReturned
;	int	3
	
	and	dwBytesReturned, 0
	mov	status, STATUS_UNSUCCESSFUL
	mov	esi, pIrp
	assume	esi : ptr _IRP
	
	IoGetCurrentIrpStackLocation esi
	mov	edi, eax
	assume	edi : ptr IO_STACK_LOCATION
	
	mov	eax, [edi].Parameters.DeviceIoControl.IoControlCode
	push	edi
	.if eax==IOCTL_START_IP_HOOK
		.if g_bLoaded==0
			invoke	_SetFilterFunction, offset _IpFilterProc, 1
			mov	g_bLoaded, 1
		.endif
		mov	status, eax
		
	.elseif eax==IOCTL_STOP_IP_HOOK
		.if g_bLoaded==1
			invoke	_SetFilterFunction, offset _IpFilterProc, 0
			mov	g_bLoaded, 0
		.endif
		mov	status, eax
		
	.elseif eax==IOCTL_ADD_FILTER
		assume	esi : ptr _IRP
		assume	edi : ptr IO_STACK_LOCATION
		mov	eax, MAX_PORTS
		imul	eax, sizeof word
		mov	ebx, [edi].Parameters.DeviceIoControl.InputBufferLength
		.if ebx <= eax
			mov	edi, [esi].AssociatedIrp.SystemBuffer
			invoke	memcpy, addr g_Ports, edi, ebx
			
			mov	status, STATUS_SUCCESS
		.endif
		
	.elseif eax==IOCTL_GET_IP_INFO
		assume	esi : ptr _IRP
		assume	edi : ptr IO_STACK_LOCATION
		.if [edi].Parameters.DeviceIoControl.OutputBufferLength >= sizeof CALLBACK_IP_INFO
			mov	edi, [esi].AssociatedIrp.SystemBuffer
			assume	edi : ptr CALLBACK_IP_INFO
			mov	esi, g_lpExtension
			assume	esi : ptr DEVICE_EXTENSION
			
			mov	al, [esi].protocol
			mov	[edi].protocol , al
			mov	eax, [esi].srcIp
			mov	[edi].srcIp, eax
			mov	ax, [esi].srcPort
			mov	[edi].srcPort, ax
			mov	eax, [esi].dstIp
			mov	[edi].dstIp, eax
			mov	ax, [esi].dstPort
			mov	[edi].dstPort, ax
			mov	eax, [esi].bIn
			mov	[edi].bIn, eax
			
			mov	status, STATUS_SUCCESS
		.else
			mov	status, STATUS_BUFFER_TOO_SMALL
		.endif
		
	.endif
	pop	edi
	assume	edi : ptr IO_STACK_LOCATION
	mov	esi, pIrp
	assume	esi : ptr _IRP
	
	push	status
	pop	[esi].IoStatus.Status
	
	xor	eax, eax
	.if status==STATUS_SUCCESS
		mov	eax, [edi].Parameters.DeviceIoControl.OutputBufferLength
	.endif
	mov	[esi].IoStatus.Information, eax
	assume	esi : nothing
	assume	edi : nothing
	invoke	IoCompleteRequest, pIrp, IO_NO_INCREMENT
	mov eax, status
	ret
_DispatchControl endp
_DispatchCreateClose proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
	mov	eax, pIrp
	assume	eax:ptr _IRP
	mov	[eax].IoStatus.Status, STATUS_SUCCESS
	and	[eax].IoStatus.Information, 0
	assume	eax:nothing
	invoke	IoCompleteRequest, pIrp, IO_NO_INCREMENT
	mov	eax, STATUS_SUCCESS
	ret
_DispatchCreateClose endp
_DriverUnload proc pDriverObject:PDRIVER_OBJECT
	.if g_bLoaded==1
		invoke	_SetFilterFunction, offset _IpFilterProc, 0
		mov	g_bLoaded, 0
	.endif
	
	invoke	IoDeleteSymbolicLink, addr g_usSymbolicLinkName
	mov	eax, pDriverObject
	invoke	IoDeleteDevice, (DRIVER_OBJECT PTR [eax]).DeviceObject
	ret
_DriverUnload endp
_SetFilterFunction proc uses ebx esi edi, lpFunc:DWORD, bFlags:DWORD
	LOCAL	status : NTSTATUS
	LOCAL	ipFileObject : PFILE_OBJECT
	LOCAL	ipDeviceObject : PDEVICE_OBJECT
	LOCAL	fhi : IP_SET_FIREWALL_HOOK_INFO
	LOCAL	ioStatus : IO_STATUS_BLOCK
	
;	int	3
	invoke	IoGetDeviceObjectPointer, addr g_usIpFilterName, STANDARD_RIGHTS_ALL, addr ipFileObject, addr ipDeviceObject
	.if eax==STATUS_SUCCESS
		mov	eax, lpFunc
		mov	fhi.FirewallPtr, eax
		mov	fhi.Priority, 1
		mov	eax, bFlags
		mov	fhi._Add, al
		
		invoke	IoBuildDeviceIoControlRequest, IOCTL_IP_SET_FIREWALL_HOOK,
							ipDeviceObject,
							addr fhi,
							sizeof IP_SET_FIREWALL_HOOK_INFO,
							0, 0, 0, 0,
							addr ioStatus
		
		.if eax!=0
			invoke	IoCallDriver, ipDeviceObject, eax
		.endif
		
		.if ipFileObject
			invoke	ObDereferenceObject, ipFileObject
		.endif
	.endif
	
	ret
_SetFilterFunction endp
_IpFilterProc proc uses ebx esi edi, pData:DWORD, RecvInterfaceIndex:DWORD, pSendInterfaceIndex:DWORD, pDestinationType:DWORD, pContext:DWORD, ContextLength:DWORD, pRcvBuf:DWORD
	LOCAL	dwSize
	LOCAL	lpMem
	
;	int	3
	mov	dwSize, 0
	mov	lpMem, 0
	
	mov	esi, pData
	mov	esi, dword ptr [esi]
	mov	edi, esi
	assume	esi : ptr IPRcvBuf
	
	mov	eax, [esi].ipr_size
	mov	dwSize, eax
	.while [esi].ipr_next
		mov	esi, [esi].ipr_next
		mov	eax, [esi].ipr_size
		add	dwSize, eax
	.endw
	
	invoke	ExAllocatePool, NonPagedPool, dwSize
	test	eax, eax
	jz	exit_0
	mov	lpMem, eax
	
	mov	esi, edi
	mov	edi, lpMem
	mov	ebx, [esi].ipr_size
	mov	ecx, [esi].ipr_buffer
	invoke	memcpy, edi, ecx, ebx
	add	edi, ebx
	
	.while [esi].ipr_next
		mov	esi, [esi].ipr_next
		mov	ebx, [esi].ipr_size
		mov	ecx, [esi].ipr_buffer
		invoke	memcpy, edi, ecx, ebx
		add	edi, ebx
	.endw
	
	mov	esi, lpMem
	assume	esi : ptr IPHeader
	mov	al, [esi].protocol
	.if al==IPPROTO_TCP
		movzx	eax, [esi].headerLength
		shl	al, 2
		add	esi, eax
		
		assume	esi : ptr TCPHeader
		movzx	ebx, [esi].sourcePort
		movzx	ecx, [esi].destinationPort
		
		xor	eax, eax
		mov	edi, offset g_Ports
		mov	ax, word ptr [edi]
		add	edi, 2
		.while eax
			.if eax==ebx || eax==ecx
				
				mov	edi, g_lpExtension
				assume	edi : ptr DEVICE_EXTENSION
				
				mov	ax, [esi].sourcePort
				mov	[edi].srcPort, ax
				mov	ax, [esi].destinationPort
				mov	[edi].dstPort, ax
				
				xor	eax, eax
				mov	esi, pContext
				assume	esi : ptr FIREWALL_CONTEXT_T
				.if esi
					mov	eax, [esi].Direction
				.endif
				mov	[edi].bIn, eax
				
				mov	esi, lpMem
				assume	esi : ptr IPHeader
				mov	eax, [esi].source
				mov	[edi].srcIp, eax
				mov	eax, [esi].destination
				mov	[edi].dstIp, eax
				mov	al, [esi].protocol
				mov	[edi].protocol, al
				
				invoke	KeSetEvent, [edi].event, 0, FALSE
				invoke	KeClearEvent, [edi].event
				
				mov	eax, DROP
				ret
			.endif
			mov	ax, word ptr [edi]
			add	edi, 2
		.endw
	.endif
	
	.if lpMem
		invoke	ExFreePool, lpMem
	.endif
exit_0:	
	mov	eax, FORWARD
	ret
_IpFilterProc endp
end DriverEntry
:make
set path=%path%;c:masm32bin;D:Program FilesCompuwareDriverStudioSoftICE
set drv=drvZtsFw
ml /nologo /c /coff %drv%.bat
link /nologo /driver /base:0x10000 /align:32 /out:%drv%.sys /subsystem:native %drv%.obj
del %drv%.obj
nmsym /translate:source,package,always %drv%.sys
echo.
pause

						