NDIS Filter Drivers

SamllBug
2010/10/18

NDISFilterDrivers ..................................................................................................... 4
1.1

FilterDrivers ..................................................................................................... 4

1.2

FilterDrivers ..................................................................................................... 5

1.3

FilterDrivers ..................................................................................................... 5

1.4

MandatoryFilterDrivers ............................................................................................ 6

NDISFilterDrivers ..................................................................................................... 7
2.1

FilterDriver..................................................................................................... 7

2.2

FilterDrivers ..................................................................................................... 11

2.3

FilterModule ...................................................................................... 12

2.4

FilterModule.................................................................................................... 14

2.5

FilterModule.................................................................................................... 18

2.6

FilterModule ........................................................................................ 20

2.6.1

FilterModule ............................................................................................ 20

2.6.2

FilterModule ............................................................................................ 24

2.7

DataBypassMode.................................................................................................... 26

2.8

FilterDriver........................................................................................... 26

2.9

FilterModule........................................................................................ 27

2.9.1

FilterDriver ............................................................................... 27

2.9.2

FilterDriver ............................................................................... 28

2.9.3

FilterDriver ............................................................... 30

2.9.4

FilterDriver ............................................................................... 31

2.10

FilterModuleOID............................................................................................. 33

2.10.1

FilterDriverOID ..................................................................... 33

2.10.2

FilterDriverOID ......................................................................... 34

2.10.3

FilterModuleOIDDirectOIDRequest ................................... 35

2.11

FilterModulePnP..................................................................................... 36

2.12

FilterModule .......................................................................................... 37

NDISFilterDrivers ................................................................................................... 37

3.1

FilterDriver................................................................................... 38

3.2

FilterDriverINF ..................................................................................... 39

3.2.1

MonitoringFilterDriverINF .......................................................... 39

3.2.2

ModifyingFilterDriverINF ............................................................ 42

3.3
4

................................................................................................................................. 46
4.1

NET_BUFFER............................................................................................. 46

4.1.1

.................................................................................................. 46

4.1.2

RetreatAdvance .................................................................................... 52

4.1.3

...................................................................................................... 54

4.1.4

IRQL................................................................................................... 54

4.1.5

.............................................................................................. 55

4.1.6

.................................................................................. 61

4.1.7

NET_BUFFER_LIST............................................................................. 62

4.2

FilterDriver....................................................................................... 45

NDIS .................................................................................................. 66

4.2.1

NDIS ...................................................................................... 66

4.2.2

NDIS ...................................................................... 66

4.2.3

NDIS ...................................................................................... 67

4.2.4

NDIS .................................................................................................. 67

4.2.5

NDIS WMI ............................................................................ 67


DDK
LZIOG@163.com

1 NDISFilterDrivers
FilterDriversMiniportDriversfilteringservice
NDISMiniportDriversProtocolDrivers
Filter Drivers NDIS DDK MSDN Driver Stack
Management

FilterDrivers
1)
2)
FilterDrivers

1.1 FilterDrivers
FilterDrivers :
1) FilterDrivers FilterModuleFilterModule

2)
3)

4)
5)
6)
7)

8)

9)

FilterDrivers FilterModule
FilterModule

FilterModule intermediatedriver
(miniportadapter) FilterModule
(miniportadapter)
Becausefilterdrivers
do not implement virtual miniports like an intermediate driver, filter drivers are not
associatedwithadeviceobject.Aminiportadapterwithoverlyingfiltermodulesfunctionsas
amodifiedversionoftheminiportadapter.
NDIS FilterModule
NDIS FilterModule

NDIS FilterModule
FilterDrivers FilterModule
(Filter modules are not associated with any particular binding between overlying
protocoldriversandtheminiportadapter.)
Filter Drivers
Filterdriverscanselecttheservicesthatarefilteredandcanbebypassedfor
the services that are not filtered. The selection of the services that are bypassed and the
servicesthatarefilteredcanbereconfigureddynamically.
NDIS FilterDrivers COPY

1.2 FilterDrivers
FilterDrivers
1)
2)
3)
4) OID
5) OID
6) OID
7)
8)
9)

1.3 FilterDrivers
FilterDrivers
1) Monitoring

MonitoringFilterDrivers
2) Modifying

The type of
modificationisdriverspecific
INF FilterType 0x00000001 monitoringfilter
0x00000002 modifyingfilter
mandatory( INF )
modifyingfilter mandatory Filter

1.4 MandatoryFilterDrivers
Mandatory Filter Drivers
MandatoryFilterModule Modifying Monitoring
FilterDrivers Mandatory filterintermediate
drivers Mandatory
MandatoryFilterDrivers NDIS
FilterModule FilterDrivers

MandatoryFilterDrivers NDIS
FilterModule optionalFilterDrivers FilterDrivers
Mandatory FilterDrivers NDIS

Mandatory Filter Drivers

miniportadapter NDIS
INF Mandatory Optional INF
FilterRunType 0x00000001 Mandatory 0x00000002 Optional
DDK filter INF
;
;Ndiinstallationsupport
;
[Inst_Ndi]
HKR,Ndi,Service,,"NdisMon"
HKR,Ndi,CoServices,0x00010000,"NdisMon"
HKR,Ndi,HelpText,,%NdisMon_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000001
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
Modifying filter
MandatoryFilterDrivers INF DDK

2 NDISFilterDrivers
Filter MiniportDrivers ProtocolDrivers
DDK FilterDrivers

2.1 FilterDriver
Filter Driver Filter Dreivers
Filter Drivers Miniport Drivers
miniportadatpter FilterDrivers FilterDrivers
NDIS FilterModule
FilterDrivers
DDK StartingaDriverStack
FilterDrivers DriverEntry DriverEntry
NdisFRegisterFilterDriver FilterXXX NdisFRegisterFilterDriver
STATUS_SUCCESS
DriverEntry
1 I/O
2
Filter Drivers DriverEntry DriverObject NdisFRegisterFilterDriver NDIS
NDISFilterDriverFilterDrivers
Filter Drivers DriverEntry NdisFRegisterFilterDriver
FilterXXX NDIS_FILTER_DRIVER_CHARACTERISTICS
NdisFRegisterFilterDriver FilterCharacteristics NDIS_FILTER_DRIVER_CHARACTERISTICS
Mandatory Optional FilterXXX Optional BYPASS
NdisFRegisterFilterDriver :
NDIS_STATUS
NdisFRegisterFilterDriver(
IN PDRIVER_OBJECT DriverObject,
IN NDIS_HANDLE FilterDriverContext,
IN PNDIS_FILTER_DRIVER_CHARACTERISTICS FilterCharacteristics,
OUT PNDIS_HANDLE NdisFilterDriverHandle
);

NDIS_FILTER_DRIVER_CHARACTERISTICS
typedef struct _NDIS_FILTER_DRIVER_CHARACTERISTICS {
NDIS_OBJECT_HEADER

Header;

UCHAR

MajorNdisVersion;

UCHAR

MinorNdisVersion;

UCHAR

MajorDriverVersion;

UCHAR

MinorDriverVersion;

ULONG

Flags;

NDIS_STRING

FriendlyName;

NDIS_STRING

UniqueName;

NDIS_STRING

ServiceName;

SET_OPTIONS_HANDLER

SetOptionsHandler;

FILTER_SET_FILTER_MODULE_OPTIONS_HANDLER
FILTER_ATTACH_HANDLER

AttachHandler;

FILTER_DETACH_HANDLER

DetachHandler;

FILTER_RESTART_HANDLER
FILTER_PAUSE_HANDLER

SetFilterModuleOptionsHandler;

RestartHandler;
PauseHandler;

FILTER_SEND_NET_BUFFER_LISTS_HANDLER

SendNetBufferListsHandler;

FILTER_SEND_NET_BUFFER_LISTS_COMPLETE_HANDLER

SendNetBufferListsCompleteHandle

r;
FILTER_CANCEL_SEND_HANDLER

CancelSendNetBufferListsHandler;

FILTER_RECEIVE_NET_BUFFER_LISTS_HANDLER
FILTER_RETURN_NET_BUFFER_LISTS_HANDLER
FILTER_OID_REQUEST_HANDLER

FILTER_CANCEL_OID_REQUEST_HANDLER

OidRequestCompleteHandler;
CancelOidRequestHandler;

FILTER_DEVICE_PNP_EVENT_NOTIFY_HANDLER

FILTER_STATUS_HANDLER

ReturnNetBufferListsHandler;

OidRequestHandler;

FILTER_OID_REQUEST_COMPLETE_HANDLER

FILTER_NET_PNP_EVENT_HANDLER

ReceiveNetBufferListsHandler;

DevicePnPEventNotifyHandler;

NetPnPEventHandler;

StatusHandler;

FILTER_DIRECT_OID_REQUEST_HANDLER

DirectOidRequestHandler;

FILTER_DIRECT_OID_REQUEST_COMPLETE_HANDLER
FILTER_CANCEL_DIRECT_OID_REQUEST_HANDLER

DirectOidRequestCompleteHandler;
CancelDirectOidRequestHandler;

} NDIS_FILTER_DRIVER_CHARACTERISTICS, *PNDIS_FILTER_DRIVER_CHARACTERISTICS;

NDIS_FILTER_DRIVER_CHARACTERISTICS Mandatory
FilterAttach
FilterDetach
FilterRestart
FilterPause
NDIS_FILTER_DRIVER_CHARACTERISTICS Optional
FilterSetOptions
FilterSetModuleOptions
FilterOidRequest
FilterOidRequestComplete

FilterStatus
FilterNetPnPEvent
FilterDevicePnPEventNotify
FilterCancelSendNetBufferLists
NDIS_FILTER_DRIVER_CHARACTERISTICS Optional
FilterSendNetBufferLists
FilterSendNetBufferListsComplete
FilterReturnNetBufferLists
FilterReceiveNetBufferLists
NDIS_FILTER_PARTIAL_CHARACTERISTICS
FilterSetModuleOptions NdisSetOptionalHandles
FilterDrivers FilterSetModuleOpitons
FilterModule
NdisFRegisterFilterDriver NDIS NdisFilterDriverHandle
Filter Driver Filter Driver NDIS
NdisFDeregisterFilterDriver
NdisFDeregisterFilterDriver

FilterSetOptions FilterMoudle Detached NDIS FilterSetPtions

FilterAttach Filter Module FilterAttach

Filter Drivers DriverEntry

FilterDriverUnload DDK
DriverEntry
NDIS_STATUS
DriverEntry(
IN PDRIVER_OBJECT
DriverObject,
IN PUNICODE_STRING
RegistryPath
)
{
NDIS_STATUS
Status;
NDIS_FILTER_DRIVER_CHARACTERISTICS
FChars;
NDIS_STRING
ServiceName;
NDIS_STRING
UniqueName;
NDIS_STRING
FriendlyName;
DEBUGP(DL_TRACE,("===>DriverEntry...\n"));
RtlInitUnicodeString(&ServiceName, FILTER_SERVICE_NAME);
RtlInitUnicodeString(&FriendlyName, FILTER_FRIENDLY_NAME);

RtlInitUnicodeString(&UniqueName, FILTER_UNIQUE_NAME);
FilterDriverObject = DriverObject;
do
{
NdisZeroMemory(&FChars, sizeof(NDIS_FILTER_DRIVER_CHARACTERISTICS));
FChars.Header.Type = NDIS_OBJECT_TYPE_FILTER_DRIVER_CHARACTERISTICS;
FChars.Header.Size = sizeof(NDIS_FILTER_DRIVER_CHARACTERISTICS);
FChars.Header.Revision = NDIS_FILTER_CHARACTERISTICS_REVISION_1;
FChars.MajorNdisVersion = FILTER_MAJOR_NDIS_VERSION;
FChars.MinorNdisVersion = FILTER_MINOR_NDIS_VERSION;
FChars.MajorDriverVersion = 1;
FChars.MinorDriverVersion = 0;
FChars.Flags = 0;
FChars.FriendlyName = FriendlyName;
FChars.UniqueName = UniqueName;
FChars.ServiceName = ServiceName;
//
// for the time being, there is no additional options to register
// but let's have this handler anyway
//
FChars.SetOptionsHandler = FilterRegisterOptions;
FChars.AttachHandler = FilterAttach;
FChars.DetachHandler = FilterDetach;
FChars.RestartHandler = FilterRestart;
FChars.PauseHandler = FilterPause;
FChars.SetFilterModuleOptionsHandler = FilterSetModuleOptions;
FChars.OidRequestHandler = FilterOidRequest;
FChars.OidRequestCompleteHandler = FilterOidRequestComplete;
FChars.CancelOidRequestHandler = FilterCancelOidRequest;
FChars.SendNetBufferListsHandler = FilterSendNetBufferLists;
FChars.ReturnNetBufferListsHandler = FilterReturnNetBufferLists;
FChars.SendNetBufferListsCompleteHandler =
FilterSendNetBufferListsComplete;
FChars.ReceiveNetBufferListsHandler = FilterReceiveNetBufferLists;
FChars.DevicePnPEventNotifyHandler = FilterDevicePnPEventNotify;
FChars.NetPnPEventHandler = FilterNetPnPEvent;
FChars.StatusHandler = FilterStatus;
FChars.CancelSendNetBufferListsHandler = FilterCancelSendNetBufferLists;
DriverObject->DriverUnload = FilterUnload;

FilterDriverHandle = NULL;
FILTER_INIT_LOCK(&FilterListLock);
InitializeListHead(&FilterModuleList);
Status = NdisFRegisterFilterDriver(DriverObject,
(NDIS_HANDLE)FilterDriverObject,
&FChars,
&FilterDriverHandle);
if (Status != NDIS_STATUS_SUCCESS)
{
DEBUGP(DL_WARN, ("MSFilter: Register filter driver failed.\n"));
break;
}
//
// Initilize spin locks
//
Status = FilterRegisterDevice();
if (Status != NDIS_STATUS_SUCCESS)
{
NdisFDeregisterFilterDriver(FilterDriverHandle);
FILTER_FREE_LOCK(&FilterListLock);
DEBUGP(DL_WARN, ("MSFilter: Register device for the filter driver
failed.\n"));
break;
}

}
while(FALSE);

DEBUGP(DL_TRACE, ("<===DriverEntry, Status = %8x\n", Status));

return Status;
}

2.2 FilterDrivers
FilterDrivers Unload FilterDriver

MiniportAdapter Unload Filter

Drivers Unload FilterDriverUnload
FilterDriverUnload Filter Driver
FilterDriverUnload FilterDriver

Filter Driver FilterDriverUnload

NdisFDeregisterFilterDriver NdisFRegisterFilterDriver
FilterDetach FilterDriver FilterModule
FilterDriverUnload DDK filter FilterDriverUnload
VOID
FilterUnload(
IN PDRIVER_OBJECT
DriverObject
)
{
DEBUGP(DL_TRACE, ("===>FilterUnload\n"));
//
// Should free the filter context list
//
FilterDeregisterDevice();
NdisFDeregisterFilterDriver(FilterDriverHandle);
#if DBG
FILTER_ACQUIRE_LOCK(&FilterListLock, FALSE);
ASSERT(IsListEmpty(&FilterModuleList));
FILTER_RELEASE_LOCK(&FilterListLock, FALSE);
#endif
FILTER_FREE_LOCK(&FilterListLock);
DEBUGP(DL_TRACE, ("<===FilterUnload\n"));
return;
}

2.3 FilterModule
FilterDriver FilterModuleFilterDriver
1 Detached
Detached Filter Module Filter Driver
FilterModule
2 Attaching

 FilterDriver FilterModule
3 Paused
FilterDriver
4 Restarting
Filter Driver Filter Module

5 Running
FilterDriver FilterModule
6 Pauseing
Filter Driver Filter Module

FilterModule
/
Event/State

Detached

Attaching

Paused

Restarting

Running

Pausing

FilterAttach

Attaching

Attachis
complete

Paused

FilterDetach

Detached

FilterRestart

Restarting

Restartis
complete

Running

FilterPause

Pausing

Pauseis
complete

Paused

Attachfailed

Detached

Restart
failed

Paused

Sendand
Receive

Running

Pausing

OID

Paused

Restarting

Running

Pausing

Requests

1 FilterAttach
NDIS FilterAttach FilterModule
2 Attachiscomplete
FilterModule Attaching FilterDriver FilterModule
FilterModule Paused
3 FilterDetach
NDIS Filter Driver FilterDetach Filter Module

4 FilterRestart
NDIS FilterDriver FilterRestart FilterModue

5 Restartiscomplete
FilterModule Restarting Filter
Moduel Running
6 FilterPause
NDIS FilterDriver FilterPause FilterModule
7 Pauseiscomplete
Filter Driver Filter Module
Paused
8 Attachfail
NDIS FilterAttach Filter Module
Detached
9 Restartfail
NDIS FilterRestart FilterModule Paused
10
SendandReceiveOperations
FilterModule Pauseing Running
11
OIDRequests
FilterModule Runnig Restarting Paused Pauseing OID

2.4 FilterModule
FilterModule NDIS FilterDriver FilterAttach
FilterAttach FilterModule Attaching FilterAttach
DDK
NDIS_STATUS
FilterAttach(
IN NDIS_HANDLE
IN NDIS_HANDLE

NdisFilterHandle,
FilterDriverContext,

IN PNDIS_FILTER_ATTACH_PARAMETERS
);

AttachParameters

NDIS NdisFilterHandle Filter Driver

NdisXXX Filter Module
OID FilterModule Attaching
1 FilterModule
2 NDIS FilterAttach NdisFilterHandle NdisFSetAttributes
NdisFSetAttributes FilterModuleContext FilterModule
NdisFRegisterFilterDriver FilterDriverContext
NDIS Filter Drivers FilterXXX
FilterAttach FilterDriverContext NdisFRegisterFilterDriver FilterDriverContext
NdisFSetAttributes DDK
NDIS_STATUS
NdisFSetAttributes(
IN NDIS_HANDLE NdisFilterHandle,
IN NDIS_HANDLE FilterModuleContext,
IN PNDIS_FILTER_ATTRIBUTES FilterAttributes
);
3 FilterModule
4 FilterModule Paused
5 Detached
6 NDIS_STATUS_SUCCESS NDIS

FilterModule FilterDriver
Optional Mandatory FilterAtt ch NDIS

Filter Driver Attaching OID

Running Pauseing OID
PausedRestartingRunning Pauseing NDIS FilterDetach
FilterAttach Filter Module Filter Module
DDK filter FilterAttach
NDIS_STATUS
FilterAttach(
IN NDIS_HANDLE
NdisFilterHandle,
IN NDIS_HANDLE
FilterDriverContext,
IN PNDIS_FILTER_ATTACH_PARAMETERS AttachParameters
)
{
PMS_FILTER
pFilter = NULL;
NDIS_STATUS
Status = NDIS_STATUS_SUCCESS;
PFL_NDIS_FILTER_LIST
FilterHandleEntry;
NDIS_FILTER_ATTRIBUTES FilterAttributes;
ULONG
Size;

DEBUGP(DL_TRACE, ("===>FilterAttach: NdisFilterHandle %p\n",

NdisFilterHandle));
do
{
ASSERT(FilterDriverContext == (NDIS_HANDLE)FilterDriverObject);
if (FilterDriverContext != (NDIS_HANDLE)FilterDriverObject)
{
Status = NDIS_STATUS_INVALID_PARAMETER;
break;
}
if (AttachParameters->MiniportMediaType != NdisMedium802_3)
{
DEBUGP(DL_ERROR, ("MSFilter: Doesn't support media type other than
NdisMedium802_3.\n"));
Status = NDIS_STATUS_INVALID_PARAMETER;
break;
}
Size = sizeof(MS_FILTER) +
AttachParameters->FilterModuleGuidName->Length +
AttachParameters->BaseMiniportInstanceName->Length +
AttachParameters->BaseMiniportName->Length;
pFilter = (PMS_FILTER)FILTER_ALLOC_MEM(NdisFilterHandle, Size);
if (pFilter == NULL)
{
DEBUGP(DL_WARN, ("MSFilter: Failed to allocate context
structure.\n"));
Status = NDIS_STATUS_RESOURCES;
break;
}
NdisZeroMemory(pFilter, sizeof(MS_FILTER));
pFilter->FilterModuleName.Length =
pFilter->FilterModuleName.MaximumLength =
AttachParameters->FilterModuleGuidName->Length;
pFilter->FilterModuleName.Buffer = (PWSTR)((PUCHAR)pFilter +
sizeof(MS_FILTER));
NdisMoveMemory(pFilter->FilterModuleName.Buffer,
AttachParameters->FilterModuleGuidName->Buffer,

pFilter->FilterModuleName.Length);

pFilter->MiniportFriendlyName.Length =
pFilter->MiniportFriendlyName.MaximumLength =
AttachParameters->BaseMiniportInstanceName->Length;
pFilter->MiniportFriendlyName.Buffer =
(PWSTR)((PUCHAR)pFilter->FilterModuleName.Buffer +
pFilter->FilterModuleName.Length);
NdisMoveMemory(pFilter->MiniportFriendlyName.Buffer,
AttachParameters->BaseMiniportInstanceName->Buffer,
pFilter->MiniportFriendlyName.Length);

pFilter->MiniportName.Length = pFilter->MiniportName.MaximumLength =
AttachParameters->BaseMiniportName->Length;
pFilter->MiniportName.Buffer =
(PWSTR)((PUCHAR)pFilter->MiniportFriendlyName.Buffer +
pFilter->MiniportFriendlyName.Length);
NdisMoveMemory(pFilter->MiniportName.Buffer,
AttachParameters->BaseMiniportName->Buffer,
pFilter->MiniportName.Length);
pFilter->MiniportIfIndex = AttachParameters->BaseMiniportIfIndex;
//
// The filter should intialize NoTrackReceives and NoTrackSends properly,
for this
// driver, since its default characteristic has both send and receive
handler, they
// are initiazed to FALSE.
//
pFilter->TrackReceives = TRUE;
pFilter->TrackSends = TRUE;
pFilter->FilterHandle = NdisFilterHandle;

NdisZeroMemory(&FilterAttributes, sizeof(NDIS_FILTER_ATTRIBUTES));
FilterAttributes.Header.Revision = NDIS_FILTER_ATTRIBUTES_REVISION_1;
FilterAttributes.Header.Size = sizeof(NDIS_FILTER_ATTRIBUTES);
FilterAttributes.Header.Type = NDIS_OBJECT_TYPE_FILTER_ATTRIBUTES;
FilterAttributes.Flags = 0;

Status = NdisFSetAttributes(NdisFilterHandle,
pFilter,
&FilterAttributes);
if (Status != NDIS_STATUS_SUCCESS)
{
DEBUGP(DL_WARN, ("MSFilter: Failed to set attributes.\n"));
break;
}
pFilter->State = FilterPaused;
FILTER_ACQUIRE_LOCK(&FilterListLock, FALSE);
InsertHeadList(&FilterModuleList, &pFilter->FilterModuleLink);
FILTER_RELEASE_LOCK(&FilterListLock, FALSE);
}
while (FALSE);
if (Status != NDIS_STATUS_SUCCESS)
{
if (pFilter != NULL)
{
FILTER_FREE_MEM(pFilter);
}
}
DEBUGP(DL_TRACE, ("<===FilterAttach:
return Status;

Status %x\n", Status));

2.5 FilterModule
NDIS Filter Driver FilterDetach Filter Module
FilterDetach FilterModule Detached
Filter Module NDIS FilterDetach NDIS
FilterModule Paused
FilterModule

FilterDettach NDIS DDK filter FilterDetach

VOID
FilterDetach(
IN NDIS_HANDLE
FilterModuleContext
)

{
PMS_FILTER
PFL_NDIS_FILTER_LIST
PLIST_ENTRY

pFilter = (PMS_FILTER)FilterModuleContext;
pEntry;
pLink;

DEBUGP(DL_TRACE, ("===>FilterDetach:
FilterModuleContext));

FilterInstance %p\n",

//
// Filter must be in paused state
//
FILTER_ASSERT(pFilter->State == FilterPaused);

//
// Don't come up anything that would prevent the filter from detaching
//
//
// Free filter instance name if allocated.
//
if (pFilter->FilterName.Buffer != NULL)
{
FILTER_FREE_MEM(pFilter->FilterName.Buffer);
}

FILTER_ACQUIRE_LOCK(&FilterListLock, FALSE);
RemoveEntryList(&pFilter->FilterModuleLink);
FILTER_RELEASE_LOCK(&FilterListLock, FALSE);

//
// Free the memory allocated
FILTER_FREE_MEM(pFilter);
//
// Alway return success
//
DEBUGP(DL_TRACE, ("<===FilterDetach Successfully\n"));
return;

2.6 FilterModule
NDIS Filter Module Filter Module
NDIS Paused FilterModule Running
Filter Module Paused
FilterModule

2.6.1 FilterModule
Paused FilterModule FilterSetModuleOptions
FilterRestart Filter Module FilterRestart Restarting
FilterDriver FilterSetModuleOptions
FilterModule DataBypassModel
Filter Driver FilterRestart NDIS FilterRestartParameters
RestartAttributes NDIS_RESTART_ATTRIBUTES FilterDrivers
DDK FilterRestart

Filter Module FilterRestart

FilterSetModuleOptions .
NDIS Filter Module Filter
Module Restarting
1
2 FilterModule
3
4
5 NdisFSendNetBufferListsComplete FilterSendNetBufferLists
NET_BUFFER_LIST NDIS_STATUS_PAUSED
6 NdisFIndicateStatus
7 OID
8
9 NdisFReturnNetBufferLists

10
OID
11
FilterStatus
12
NDIS_STATUS_SUCCESS FilterModule
Mandatory FilterDriver NDIS
FilterDriver FilterDriver
NDIS_STATUS_SUCCESS
NDIS_STATUS_PENDING NDIS_STATUS_PENDING
NdisFRestartComplete
NdisFRestartComplete ()

 FilterModule Running
Filter Driver FilterRestart NDIS
Ndis FilterModule Running
DDK Filter FilterRestart
NDIS_STATUS
FilterRestart(
IN NDIS_HANDLE
FilterModuleContext,
IN PNDIS_FILTER_RESTART_PARAMETERS RestartParameters
)
{
NDIS_STATUS
Status;
PMS_FILTER
pFilter = (PMS_FILTER)FilterModuleContext; // BUGBUG, the cast
may be wrong
NDIS_HANDLE
ConfigurationHandle = NULL;

PNDIS_RESTART_GENERAL_ATTRIBUTES NdisGeneralAttributes;
PNDIS_RESTART_ATTRIBUTES
NdisRestartAttributes;
NDIS_CONFIGURATION_OBJECT
ConfigObject;
DEBUGP(DL_TRACE, ("===>FilterRestart:
FilterModuleContext));

FilterModuleContext %p\n",

FILTER_ASSERT(pFilter->State == FilterPaused);
ConfigObject.Header.Type = NDIS_OBJECT_TYPE_CONFIGURATION_OBJECT;
ConfigObject.Header.Revision = NDIS_CONFIGURATION_OBJECT_REVISION_1;
ConfigObject.Header.Size = sizeof(NDIS_CONFIGURATION_OBJECT);
ConfigObject.NdisHandle = FilterDriverHandle;
ConfigObject.Flags = 0;
Status = NdisOpenConfigurationEx(&ConfigObject, &ConfigurationHandle);
if (Status != NDIS_STATUS_SUCCESS)
{
//
// Filter driver can choose to fail the restart if it cannot open the
configuration
//
#if 0
//
// The code is here just to demonstrate how to call NDIS to write an eventlog.
If drivers need to write
// an event log.

//
PWCHAR

ErrorString = L"NdisMon";

DEBUGP(DL_WARN, ("FilterRestart: Cannot open configuration.\n"));

NdisWriteEventLogEntry(FilterDriverObject,
EVENT_NDIS_DRIVER_FAILURE,
0,
1,
&ErrorString,
sizeof(Status),
&Status);
#endif
}

if (Status == NDIS_STATUS_SUCCESS)
{
NdisCloseConfiguration(ConfigurationHandle);
}
NdisRestartAttributes = RestartParameters->RestartAttributes;
//
// If NdisRestartAttributes is not NULL, then miniport can modify generic
attributes and add
// new media specific info attributes at the end. Otherwise, NDIS restarts the
miniport because
// of other reason, miniport should not try to modify/add attributes
//
if (NdisRestartAttributes != NULL)
{
PNDIS_RESTART_ATTRIBUTES NextAttributes;
ASSERT(NdisRestartAttributes->Oid ==
OID_GEN_MINIPORT_RESTART_ATTRIBUTES);
NdisGeneralAttributes =
(PNDIS_RESTART_GENERAL_ATTRIBUTES)NdisRestartAttributes->Data;
//
// Check to see if we need to change any attributes, for example, the driver
can change the current
// MAC address here. Or the driver can add media specific info attributes.

//
NdisGeneralAttributes->LookaheadSize = 128;
//
// Check the next attributes to see whether the filter need to modify
//
NextAttributes = NdisRestartAttributes->Next;
while (NextAttributes != NULL)
{
//
// If somehow the filter needs to change a attributes which requires
more space then
// the current attributes:
// 1. Remove the attribute from the Attributes list:
//
TempAttributes = NextAttributes;
//
NextAttributes = NextAttributes->Next;
// 2. Free the memory for the current attributes:
NdisFreeMemory(TempAttributes, 0 , 0);
// 3. Dynamically allocate the memory for the new attributes by calling
//
NdisAllocateMemoryWithTagPriority:
//
NewAttributes = NdisAllocateMemoryWithTagPriority(Handle, size,
Priority);
// 4. Fill in the new attribute
// 5. NewAttributes->Next = NextAttributes;
// 6. NextAttributes = NewAttributes; // Just to make the next statement
works.
//
NextAttributes = NextAttributes->Next;
}
//
//
//
//
//
//
//

}
//

Add a new attributes at the end

1. Dynamically allocate the memory for the new attributes by calling
NdisAllocateMemoryWithTagPriority.
2. Fill in the new attribute
3. NextAttributes->Next = NewAttributes;
4. NewAttributes->Next = NULL;

// If everything is OK, set the filter in running state

// If it get preempted, it doesn't matter
//
pFilter->State = FilterRunning; // when successful

Status = NDIS_STATUS_SUCCESS;
if (Status != NDIS_STATUS_SUCCESS)
{
pFilter->State = FilterPaused;
}

DEBUGP(DL_TRACE, ("<===FilterRestart: FilterModuleContext %p, Status %x\n",

FilterModuleContext, Status));
return Status;
}

2.6.2 FilterModule
RunningFilterModuleNDISFilterDriverFIlterPauseFilter
DriverFilterPausePauseingNDISFilter Module
DDKPausingaDriver Stack
PauseingFilterDriver
1) FilterModule
2) FilterModule
FilterReturnNetBufferLists
3) NDIS
NdisFReturnNetBufferLists

4) NdisFReturnNetBufferLists

5)
6) FilterDriver NDIS
7) FilterSendNetBufferLists NdisFSendNetBufferListsComplete
NET_BUFFER_LIST NDIS_STATUS_PAUSED

8) NdisFIndicateStatus
9) FilterStatus
10) FIlterOidRequest OID
11) OID
12) FilterModule FilterDetach
13)


FilterPaused NDIS_STATUS_SUCCUSS NDIS_STATUS_PENDING
NDIS_STATUS_PENDING NdisFPauseComplete
Filter Module Paused

1
2 NdisFReturnNetBufferLists NDIS

3
4 NdisFSendNetBufferListsComplete FilterSendNetBufferLists
NET_BUFFER_LIST NDIS_STATUS_PAUSED
5 NdisFIndicateStatus
6 FilterStatus
7 FIlterOidRequest OID
8 OID
Filter Module Pauseing NDIS PnP
FilterModule Paused NDIS
DDK Filter FilterPause
NDIS_STATUS
FilterPause(
IN NDIS_HANDLE
FilterModuleContext,
IN PNDIS_FILTER_PAUSE_PARAMETERS PauseParameters
)
{
PMS_FILTER
pFilter = (PMS_FILTER)(FilterModuleContext);
NDIS_STATUS
Status;
UNREFERENCED_PARAMETER(PauseParameters);
DEBUGP(DL_TRACE, ("===>NDISMON FilterPause: FilterInstance %p\n",
FilterModuleContext));
//
// Set the flag that the filter is going to pause
//
FILTER_ASSERT(pFilter->State == FilterRunning);
FILTER_ACQUIRE_LOCK(&pFilter->Lock, FALSE);
pFilter->State = FilterPausing;
FILTER_RELEASE_LOCK(&pFilter->Lock, FALSE);

Status = NDIS_STATUS_SUCCESS;

pFilter->State = FilterPaused;
DEBUGP(DL_TRACE, ("<===FilterPause: Status %x\n", Status));
return Status;
}

2.7 DataBypassMode
Filter Driver Data Bypass Mode Data Bypass Mode
NDIS FilterXXX FilterDriver
Bypass Bypass
NdisFRegisterFilterDriver DDK
NdisFRegisterFilterDriver Bypass
Bypass Bypass
FilterSetModuleOptions
NDIS_FILTER_PARTIAL_CHARACTERISTICS NdisSetOptionalHandlers
Filter Driver FilterRestart
NDIS_FILTER_PARTIAL_CHARACTERISTICS Bypass

FilterSendNetBufferLists
FilterSendNetBufferListsComplete
FilterCancelSendNetBufferLists
FilterReturnNetBufferLists
FilterReceiveNetBufferLists
Bypass NULL
FilterXXX NDIS
NdisFIndicateNetBufferLists FilterReturnNetBufferLists
FilterSendNetBufferLists
FilterCancelSendNetBufferLists FilterReceiveNetBufferLists
FilterReturnNetBufferLists FilterStatus
Bypass NdisFRestartFilterNdisRestartFilter
NDIS FilterModule FilterSetModuleOptions
NdisSetOptionalHandlers FilterXXX

TCP
FilterDriver OptionalDriverService
FilterSetOptions

2.8 FilterDriver
NDIS FilterSetOptions OptionalFilterDriverService

 FilterSetOptions NdifFRegisterFilterDriver
FilterSetOption Optional Service FilterXXX
NdisSetOptionalHandlers (
FilterModule)OptionalFilterDriver
Service
FilterModule FilterXXX DataBypassMode
NdisSetOptionalHandlers FilterRestart Filter
Module FilterModule

2.9 FilterModule
NDIS 6.0 Filter Driver Filter Driver
FilterModule
Miniport Adapter Filter Module

Filter Driver NDIS_PACKET

NET_BUFFER NDIS
NET_BUFFER NDIS_PACKET
Filter Driver Filter Module FilterXXX

FilterDriver

2.9.1 FilterDriver
Filter Driver
Filter Driver
Filter Driver
NET_BUFFER_LIST NET_BUFFER
NdisAllocateNetBufferListPool
NdisAllocateNetBufferPool

NdisAllocateNetBufferAndNetBufferList
NdisAllocateNetBufferList
NdisAllocateNetBuffer
NdisAllocateNetBufferAndNetBufferList NdisAllocateNetBufferList
NdisAllocateNetBuffer NdisAllocateNetBufferAndNetBufferList
NET_BUFFER_LIST

NET_BUFFER

NdisAllocateNetBufferAndNetBufferList NdisAllocateNetBufferListPool

AllocateNetBuffer TRUE
Filter Driver
FilterDriver FilterRestart
FilterDriver Restarting FilterDriver
FilterDriver Restarting

NdisFreeNetBufferListPool
NdisFreeNetBufferPool
NdisFreeNetBufferList
NdisFreeNetBuffer

NET_BUFFER_LIST NdisAllocateNetBuffer
NET_BUFFER NET_BUFFER NdisAllocateNetBufferAndNetBufferList
NdisFreeNetBufferList NET_BUFFER_LIST

2.9.2 FilterDriver
Filter Driver
NdisFSendNetBufferLists NET_BUFFER_LIST
FilterModule

FilterDriver

FilterDriver

Filter Driver NdisFSendNetBufferLists NET_BUFFERLIST

Filter Driver NET_BUFFER_LIST SourceHandle
NdisFSendNetBufferLists NdisFilterHandle NDIS
NET_BUFFER_LIST SourceHandle
NdisFSendNetBufferLists NET_BUFFER_LIST_INFO
Filter Driver
NdisSentNetBufferLists NET_BUFFER_LIST NDIS

NDIS FilterSendNetBufferListsComplete Filter Driver

NDIS NdisFSendNetBufferLists
FilterSendNetBufferListsComplete NDIS FilterSendNetBufferListsComplete
Filter Driver NDIS
FilterSendNetBufferListsComplete NET_BUFFER_LIST
FilterSendNetBufferListsComplete
NDIS FilterSendNetBufferListsComplete FilterDriver
FilterSendNetBufferListsComplete
NdisFSendNetBufferLists
NDIS FilterDriver NdisFSendNetBufferLists
FilterSendNetBufferListsComplete Filter Driver
NdisFSendNetBufferLists SendFlags
NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK NDIS

Filter Driver
NdisFSendNetBufferComplete

NDIS FilterDriver FilterSendNetBufferLists

Filter Driver NET_BUFFER_LIST SourceHandle
FilterSendNetBufferLists
NDIS_BUFFER_LIST
1 NdisFSendBufferLists NDIS Filter
Driver

2 NdisFSendNetBufferListsComplete
3

4
NdisFSendNetBufferComplete
NdisMSendNetBufferListsComplete
NDIS Filter Driver
FilterSendNetBufferLists Filter Driver
FilterSendNetBufferLists FilterSendNetBufferComplete

NET_BUFFER_LIST Filter
Module FilterSendNetBufferListsComplete NDIS
ProtocolSendNetBufferListsComplete FilterDriver FilterSendNetBufferLists
FilterSendNetBufferListsComplete
Filter Driver
NDIS FilterSendNetBufferLists SendFlags
NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK Filter Driver
NdisFSendNetBufferLists NDIS

FilterDriver NDIS
NDIS FilterDriver
FilterDriver NDIS
Filter Driver

2.9.3 FilterDriver
FilterDriver

FilterDriver

FilterDriver

NDIS_SET_NET_BUFFER_LIST_CANCEL_ID NET_BUFFER_LIST
Id ID NdisGenratePartialCanceId
ID ID
DriverEntry NdisGenratePartialCanceld
ID ID
NdisFCancelSendNetBufferLists ID
NDIS_GET_NET_BUFFER_LIST_CANCEL_ID Filter Driver
NET_BUFFER_LIST ID NdisFCancelSendNetBufferLists
NET_BUFFER_LIST ID
NdisFCancelSendNetBufferLists
NDIS

 NdisMSendNetBufferListComplete
NET_BUFFER_LIST NDIS_STATUS_CANCELLEDNDIS Filter
Driver FilterSendNetBufferListsComplete FilterSendNetBufferListsComplete
NDIS_SET_NET_BUFFER_LIST_CANCEL_ID NET_BUFFER_LIST ID NULL
ID NET_BUFFER_LIST

NET_BUFFER_LIST
IDNDIS Filter Driver FilterCancelSendNetBufferLists ID
NET_BUFFER_LIST FilterCanCelSendNetBufferLists
1) FilterDriver NDIS_GET_NET_BUFFER_LSIT_CANCEL_ID
NET_BUFFER_LIST ID FilterCancelSendBufferLists ID
2) ID FilterCancelSentBufferLists ID
3) NdisFSendNetBufferListsComplete NET_BUFFER_LIST
NDIS_STATUS_CANCELLED
4) NdisFCancelSendNetBufferLists ID
FilterDriver

2.9.4 FilterDriver
Filter Driver
NdisMIndicateReceiveNetBufferLists NDIS NET_BUFFER_LIST
FilterModule

1) FilterDriver


Filter Driver NdisFIndicateReceiveNetBufferLists
NET_BUFFER_LIST Filter Driver
FilterDriver NdisFIndicateReceiveNetBufferLists NDIS_STATUS_SUCCESSNDIS
FilterReturnNetBufferLists Filter Driver
NET_BUFFER_LIST FilterReturnNetBufferLists Filter Driver
NdisFIndicateReceiveNetBufferLists ReceiveFlags NDIS_RECEIVE_FLAGS_RESOURCES
FilterDriver NET_BUFFER_LIST FilterDriver
NET_BUFFER_LIST NDIS
FilterReturnNetBufferLists NET_BUFFER_LIST
FilterDriver FilterReturnNetBufferLists
NdisFReturnNetBufferLists

2)

NDIS FilterReceiveNetBufferLists
NDIS Filter Driver
FilterReceiveNetBufferLists

FilterReceiveNetBufferLists

ReciverFlags

NDIS_RECEIVE_FLAGS_RESOURCES FilterDriver NET_BUFFER_LIST

FilterReturnNetBufferLists Filter Driver
Filter Driver

Filter Driver NET_BUFFER_LIST

FilterReceiveNetBufferLists NET_BUFFER_LIST


Filter Driver
FilterReceiveNetBufferLists
1 NDIS
: NDIS FilterReceiveNetBufferLists ReceiveFlags
NDIS_RECEIVE_FLAGS_RESOURCES FilterDriver
FilterReturnNetBufferLists
2 FilterReceiveNetBufferLists ReceiveFlags
NDIS_RECEIVE_FLAGS_RESOURCES Filter Drivre NdisFReturnNetBufferList

3 FilterReceiveNetBufferLists ReceiveFlags
NDIS_RECEIVE_FLAGS_RESOURCES NET_BUFFER_LIST
NET_BUFFER_LIST

FilterDriver NdisFIndicateNetBufferLists
FilterDriver NET_BUFFER_LIST
NDIS Filter Driver FilterReturnNetBufferLists
FilterReturnNetBufferLists FilterReciveNetBufferLists
Filter Module NET_BUFFER_LIST
NDIS FilterReceiveNetBufferLists ReceiveFlags
NDIS_RECEIVE_FLAGS_RESOURCES FilterDrivre NdisFReturnNetBufferList
FilterReceiveNetBufferLists

2.10 FilterModuleOID
NDIS ID OID
NDISOIDsFilterDriver
OID NDIS 6.1 OID DirectOIDRequestInterface
OID OID IPSec Offload Version 2
IPSecV2 OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SAOID OID
OID NDIS
OID

2.10.1 FilterDriverOID
FilterDriver OID
NDIS FilterDriver FilterOidRequest
OID FilterDriver NdisFOidRequest
NDIS FilterCancelOidRequest OID NDIS
FilterCancelOidRequest FilterDriver NdisFCancelOidRequest
NdisFOidRequest NdisFCancelOidRequest
OID

Filter Driver FilterOidRequest OID

NDIS_STATS_SUCCESS NDIS_STATUS_PENDING FilterOidRequest
OID
Filter Driver OID OID
NDIS_OID_REQUESTSupportRevisionOID
SpecifyingNDISVersionInformation
FilterOidRequest NDIS_STATUS_PENDING OID
NdisFOidRequestComplete
NdisFOidRequestComplete OidRequest Status

FilterOidRequest NDIS_STATUS_SUCCESS FIlterOidRequest OidRequest

NdisFOidRequestComplete
OID Filter Driver NdisFOidRequest OID

NDIS_STATUS_SUCCESS NDIS_STATUS_PENDING
NdisFOidRequestComplete
OID OID
FilterDriver

FilterDriver OID RestartingRunningPausing Paused

FilterDriver OID NDIS

OID FilterModule OID OID

FilterDriver OID :
Filter Driver Filter Driver
OID_GEN_MAXIMUM_FRAME_SIZE
FilterDriver

2.10.2 FilterDriverOID
FilterDriver NdisFOidRequest OID


Filter Driver NdisFOidRequest NDIS
OID
NdisFOidRequest OID NDIS_STATUS_SUCCESS
NDIS_STATUS_PENDING
SupportRevision
SpecifyingNDISVersionInformation
NdisFOidRequest NDIS_STATUS_PENDINGNDIS OID
FilterOidRequestComplete
NdisFOidRequestComplete OidRequest Status

NdisFOidRequest NDIS_STATUS_SUCCESS NdisFOidRequest OidRequest

FilterOidRequestComplete
FilterDriver NdisFOidRequest OID RestartingRunningPausing
Paused
Filter Driver FilterOidRequestComplete
NdisFOidRequestComplete

2.10.3 FilterModuleOIDDirectOIDRequest
OID Filter Driver NDIS_FILTER_DRIVER_CHARACTERISTICS
FilterXXX NDIS NdisFDirectXXX
OID OID NdisFDirectOidRequest
FilterDirectOidRequest NdisFOidRequest FilterOidRequest
NDIS 6.1 OID OID 6.1 6.1
OID OID OID OID OID
OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SA
OID OID NDIS OID
OID OID OID
DISPATCH_LEVEL
OID OID
OID
DirectOIDfunction

StandardOIDfunction

FilterDirectOidRequest

FilterOidRequest

FilterCancelDirectOidRequest

FilterCancelOidRequest

FilterDirectOidRequestComplete

FilterOidRequestComplete

NdisFDirectOidRequest

NdisFOidRequest

NdisFDirectOidRequestComplete

NdisFDirectOidRequestComplete

NdisFCancelDirectOidRequest

NdisFCancelOidRequest

2.11 FilterModulePnP
Filter Driver PnP

FilterDriver PnP

FilterDriver FilterPnpEventNotify NDIS PnP

MiniportDevicePnPEventNotify
FilterDriver NdisFDevicePnPEventNotify

FilterDriver

Filter Driver FilterNetPnpEvent PnP

ProtocolNetPnPEvent
Filter Driver PnP
NdisFNetPnpEvent

FilterDriverNDIS
PnPFilterDriver
DDKModifyingaRunningDriverStack
PnPNDIS
DDKPausingaDriverStack

2.12 FilterModule
FilterDriver FilterStatus NDIS
FilterDriver

NdisMIndicateStatusExNdisFIndicateStatsNDIS
FilterDriverFilterStatus
DDKAdapterStatusIndications
FilterDriver FilterStatus NdisFIndicateStatus
NdisFIndicateStatus NdisFIndicateStatus

Filter Driver NDIS FilterStatus

NdisFIndicateStatus
Filter Driver SourceHandle FilteAttech
NdisFilterHandle OID OID

DestinationHandle RequestId OID

Filter Driver NdisFIndicateStatus NDIS

ProtocolStatusEx FilterStatus

3 NDISFilterDrivers
NDISFilterDriver FilterDriver
Filter Driver
MiniportAdapter NDIS FilterModule FilterDriver

(virtualminiport)
Filter Driver INF

Filter Driver INF INF Prolocol INF

File INF MiniportINFFile
FilterDriver INF

3.1 FilterDriver
INF UpperRanget LowerRange

Filter Driver UpperRange LowerRange noupper

nolower FilterDriver INF
HKR, Ndi\Interfaces,UpperRange,,"noupper"
HKR, Ndi\Interfaces,LowerRange,,"nolower"
FilterDriver INF FilterMediaTypes FilterDriver
FilterDriver FilterDriver INF
FilterMediaTypes FilterMediaTypes
HKR, Ndi\Interfaces, FilterMediaTypes,,"ethernet"
FilterMediaTypes LowerRange

ethernet

Ethernetadapter

atm

ATMadapter

tokenring

tokenringadapter

serial

serialadapter

fddi

FDDIadapter

baseband

basebandadapter

broadband

broadbandadapter

arcnet

Arcnetadapter

isdn

ISDNadapter

localtalk

LocalTalkadapter

wan

WANadapter

nolower

ndis5

NDIS5.x ATM

Ndisatm

NDIS5.x ATM

Wlan

native802.11wirelessLANadapter.

FilterDriver FilterDriver
ProtocoltoAdapterBanding FilterMediaTypes

3.2 FilterDriverINF
FilterDriver INF Modifying
Monitoring Mandatory Optional INF FilterDriver
FilterModule Filter Drivr
GUIDFIDGUID

Monitoring Modifying FilterDriver

3.2.1 MonitoringFilterDriverINF
FilterDriver Monitoring FilterDriver:
1) INF Class NetService ClassGUID
Class
=NetService
ClassGUID ={4D36E974E32511CEBFC108002BE10318}
2) DDInstall, INF Characteristics

[Install]
AddReg=Inst_Ndi
Characteristics=0x40000
NetCfgInstanceId="{5cbf81bd505547cd9055a76b2b4e3697}"
Copyfiles=NdisMon.copyfiles.sys
0x40000 NCF_LW_FILTER Filter Driver NCF_FILTER(0x400)

3) NetCfgInstanceId Id FilterDriver NdisFRegisterFilterDriver

FilterDriver Uuidgent.exe

[Install]
AddReg=Inst_Ndi
Characteristics=0x40000
NetCfgInstanceId="{5cbf81bd505547cd9055a76b2b4e3697}"
Copyfiles=NdisMon.copyfiles.sys
4) DDInstall, INF AddReg
Ndi Ndi Service
[Install]
AddReg=Inst_Ndi
Characteristics=0x40000
NetCfgInstanceId="{5cbf81bd505547cd9055a76b2b4e3697}"
Copyfiles=NdisMon.copyfiles.sys
[Inst_Ndi]
HKR,Ndi,Service,,"NdisMon"
HKR,Ndi,CoServices,0x00010000,"NdisMon"
HKR,Ndi,HelpText,,%NdisMon_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000002
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
5) Filter Driver FilterType FilterRunType Filter
Driver Monitoring Mandatory
[Inst_Ndi]
HKR,Ndi,Service,,"NdisMon"
HKR,Ndi,CoServices,0x00010000,"NdisMon"
HKR,Ndi,HelpText,,%NdisMon_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000001
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
FilterType 0x00000001 Monitoring FilterDriverFilterRunType 1
Mandatory 2 Optional
6) FilterDriver
[Install.Services]
AddService=NdisMon,,NdisMon_Service_Inst

[NdisMon_Service_Inst]

7)

8)
9)

10)

DisplayName =%NdisMon_Desc%
ServiceType =1;SERVICE_KERNEL_DRIVER
StartType =1;SERVICE_SYSTEM_START
ErrorControl =1;SERVICE_ERROR_NORMAL
ServiceBinary =%12%\NdisMon.sys
LoadOrderGroup =NDIS
Description =%NdisMon_Desc%
AddReg =Common.Params.reg
INF CoService FilterDriver

[Inst_Ndi]
HKR,Ndi,Service,,"NdisMon"
HKR,Ndi,CoServices,0x00010000,"NdisMon"
HKR,Ndi,HelpText,,%NdisMon_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000002
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
INF FilterClass Filter Driver
Monitoring FilterDriver
Filter
[Inst_Ndi]
HKR,Ndi,Service,,"NdisMon"
HKR,Ndi,CoServices,0x00010000,"NdisMon"
HKR,Ndi,HelpText,,%NdisMon_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000002
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
Filter Driver
FilterModule
[Common.Params.reg]

HKR,FilterDriverParams\DriverParam,
ParamDesc, ,"DriverparamforMon"
HKR,FilterDriverParams\DriverParam,
default, ,"5"
HKR,FilterDriverParams\DriverParam,
type,
,"int"

HKR,FilterAdapterParams\AdapterParam,
ParamDesc, ,"AdapterparamforMon"
HKR,FilterAdapterParams\AdapterParam,
default, ,"10"
HKR,FilterAdapterParams\AdapterParam,
type,
,"int"


HKR,FilterInstanceParams\InstanceParam,ParamDesc,,"Instanceparamforlwf"
HKR,FilterInstanceParams\InstanceParam,default,,"15"
HKR,FilterInstanceParams\InstanceParam,type,,"int"

3.2.2 ModifyingFilterDriverINF
FilterDriver Modifying FilterDriver:
1) INF Class NetService ClassGUID
Class
=NetService
ClassGUID ={4D36E974E32511CEBFC108002BE10318}
2) DDInstall, INF Characteristics

[Install]
AddReg=Inst_Ndi
Characteristics=0x40000
NetCfgInstanceId="{5cbf81bd505547cd9055a76b2b4e3697}"
Copyfiles=NdisMon.copyfiles.sys
0x40000 NCF_LW_FILTER Filter Driver NCF_FILTER(0x400)

3) NetCfgInstanceId Id FilterDriver NdisFRegisterFilterDriver

FilterDriver Uuidgent.exe

[Install]
AddReg=Inst_Ndi
Characteristics=0x40000
NetCfgInstanceId="{5cbf81bd505547cd9055a76b2b4e3697}"
Copyfiles=NdisMon.copyfiles.sys
4) DDInstall, INF AddReg
Ndi Ndi Service
[Install]
AddReg=Inst_Ndi
Characteristics=0x40000
NetCfgInstanceId="{5cbf81bd505547cd9055a76b2b4e3697}"
Copyfiles=NdisMon.copyfiles.sys
[Inst_Ndi]
HKR,Ndi,Service,,"NdisLwf"
HKR,Ndi,CoServices,0x00010000,"NdisLwf"
HKR,Ndi,HelpText,,%NdisLwf_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000002
HKR,Ndi\Interfaces,UpperRange,,"noupper"

5)

6)

7)

8)

HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
Filter Driver FilterType FilterRunType Filter
Driver Monitoring Mandatory
[Inst_Ndi]
HKR,Ndi,Service,,"NdisLwf"
HKR,Ndi,CoServices,0x00010000,"NdisLwf"
HKR,Ndi,HelpText,,%NdisLwf_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000002
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
FilterType 0x00000002 Modifying Filter DriverFilterRunType 1
Mandatory 2 Optional
FilterDriver
[Install.Services]
AddService=NdisLwf,,NdisLwf_Service_Inst

[NdisLwf_Service_Inst]
DisplayName =%NdisLwf_Desc%
ServiceType =1;SERVICE_KERNEL_DRIVER
StartType =1;SERVICE_SYSTEM_START
ErrorControl =1;SERVICE_ERROR_NORMAL
ServiceBinary =%12%\NdisLwf.sys
LoadOrderGroup =NDIS
Description =%NdisLwf_Desc%
AddReg =Common.Params.reg
INF CoService FilterDriver

[Inst_Ndi]
HKR,Ndi,Service,,"NdisLwf"
HKR,Ndi,CoServices,0x00010000,"NdisLwf"
HKR,Ndi,HelpText,,%NdisLwf_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000002
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
INF FilterClass FilterDriver Modifying
FilterDriver


scheduler

FilterDriver
Encryption 802.1p

Encryption

Scheduler Compression

Compression

Encryption Vpn

Vpn

Compression loadbalance

Loadbalance

PacketScheduling
Failover . FilterDriver

failover

Loadbalance
Diagnostic

Diagnostic

FilterDriver FailOver

Custom

FilterDriver Diagnostic

Modifying Filter Driver

Modifying FilterDriver FilterClassic scheduler
Filter Driver
FilterDriver

[Inst_Ndi]
HKR,Ndi,Service,,"NdisLwf"
HKR,Ndi,CoServices,0x00010000,"NdisLwf"
HKR,Ndi,HelpText,,%NdisLwf_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000002
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"
HKR,Ndi,FilterRunType,0x00010001,1
9) Filter
[Inst_Ndi]
HKR,Ndi,Service,,"NdisLwf"
HKR,Ndi,CoServices,0x00010000,"NdisLwf"
HKR,Ndi,HelpText,,%NdisLwf_HelpText%
HKR,Ndi,FilterClass,,compression
HKR,Ndi,FilterType,0x00010001,0x00000002
HKR,Ndi\Interfaces,UpperRange,,"noupper"
HKR,Ndi\Interfaces,LowerRange,,"nolower"
HKR,Ndi\Interfaces,FilterMediaTypes,,"ethernet"

HKR,Ndi,FilterRunType,0x00010001,1
10) Filter Driver
FilterModule
[Common.Params.reg]

HKR,FilterDriverParams\DriverParam,
ParamDesc, ,"DriverparamforLwf"
HKR,FilterDriverParams\DriverParam,
default, ,"5"
HKR,FilterDriverParams\DriverParam,
type,
,"int"

HKR,FilterAdapterParams\AdapterParam,
ParamDesc, ,"AdapterparamforLwf"
HKR,FilterAdapterParams\AdapterParam,
default, ,"10"
HKR,FilterAdapterParams\AdapterParam,
type,
,"int"

HKR,FilterInstanceParams\InstanceParam,ParamDesc,,"Instanceparamforlwf"
HKR,FilterInstanceParams\InstanceParam,default,,"15"
HKR,FilterInstanceParams\InstanceParam,type,,"int"

3.3 FilterDriver
NDIS FilterDriver FilterDriver
PnP
NDIS_STATUS
NdisOpenConfigurationEx(
INPNDIS_CONFIGURATION_OBJECTConfigObject,
OUTPNDIS_HANDLEConfigurationHandle
);
NdisOpenConfigurationEx
NdisFRegisterFilterDriver
NDIS_CONFIGURATION_OBJECT NdisHandle NdisOpenConfigurationEx
Filter Driver
NdisDeregisterFilterDriver
FilterAttech NdisHandle
NdisOpenConfigurationEx Filter Module
FilterDetach Filter Module
Monitoring Filter Driver NDIS_CONFIGURATION_OBJECT Flags
NDIS_CONFIG_FLAG_FILTER_INSTANCE_CONFIGURATION Filter
Module Modifying FilterDriver
FilterDriver NdisClosConfiguration

4
4.1 NET_BUFFER
4.1.1
NDIS NDIS
6.0
1) NET_BUFFER
2) NET_BUFFERLIST
3) NET_BUFFER_LIST_CONTEXT
:

 NDIS 6.0 NET_BUFFER NET_BUFFER

MDL MDL NET_BUFFER
NDIS 5.X NDIS_PACKET NDIS
MDL
NET_BUFFER NET_BUFFER_LIS NET_BUFFER
NULL NDIS NET_BUFFER_LIST
NET_BUFFER
NET_BUFFER_LIST NET_BUFFER
NET_BUFFER_LIST
NET_BUFFER_LIST_CONTEXT NDIS NET_BUFFER_LIST_CONTEXT

NET_BUFFER_LIST NET_BUFFER_LIST
NULL

4.1.1.1NET_BUFFER
NDIS6.0 NET_BUFFER NDIS5.X NDIS_PACKET
NET_BUFFER
NET_BUFFER

NET_BUFFER NetBufferHeader NET_BUFFER_HEADER

NET_BUFFER_DATA NetBufferData NDIS
NET_BUFFER
NET_BUFFER_NEXT_NB
NET_BUFFER_FIRST_MDL
NET_BUFFER_DATA_OFFSET
NET_BUFFER_DATA_LENGTH
NET_BUFFER_PROTOCOL_RESERVED
NET_BUFFER_MINIPORT_RESERVED
NET_BUFFER_CHECKSUM_BIAS
NET_BUFFER_CURRENT_MDL

NET_BUFFER_CURRENT_MDL_OFFSET
NdisGetPoolFromNetBuffer
NET_BUFFER NDIS

ProtocolReserved

MiniportReserved

NdisPoolHandle
NET_BUFFER NET_BUFFER
Next
NET_BUFFER NET_BUFFER
NULL
DataLength
MDL
DataOffset
MDL

CurrentMdl
MDL MDL NDIS
MDL MDL
CurrentMdlOffset
CurrentMdl MDL

NDIS MDL

Retreat Advance
Retreat Advance
NET_BUFFER
UsedDataSpace

Retreat Advance
UnusedDataSpace

TotalDataSize
UsedDataSpace UnusedDataSpace
DataOffset DataLength
Retreat

Advance

4.1.1.2NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER
NET_BUFFER_LIST

NET_BUFFER_LIST NET_BUFFER_LIST_HEADER NetBufferListHeader

NET_BUFFER_LIST_DATA NetBufferListData
NDIS
NET_BUFFER_LIST_NEXT_NBL
NET_BUFFER_LIST_FIRST_NB
NET_BUFFER_LIST_FLAGS
NET_BUFFER_LIST_MINIPORT_RESERVED
NET_BUFFER_LIST_CONTEXT_DATA_START
NET_BUFFER_LIST_CONTEXT_DATA_SIZE
NET_BUFFER_LIST_INFO
NET_BUFFER_LIST_STATUS
NET_BUFFER_LIST_PROTOCOL_RESERVED
NdisGetPoolFromNetBufferList
NET_BUFFER_LIST NDIS

ParentNetBufferList
NET_BUFFER_LIST
NULL
NdisPoolHandle

ProtocolReserved

MiniportReserved

SourceHandle
NET_BUFFER_LIST NDIS

ChildRefCount
0
Flags
NET_BUFFER_LIST
Status

NetBufferListInfo
NET_BUFFER_LIST NET_BUFFER

Next
NET_BUFFER_LIST
Next NULL
FirstNetBuffer
NET_BUFFER_LIST NET_BUFFER
Context NET_BUFFER_LIST_CONTEXT NDIS

NdisAllocateNetBufferListContext
NdisFreeNetBufferListContext
NET_BUFFER_LIST_CONTEXT_DATA_START
NET_BUFFER_LIST_CONTEXT_DATA_SIZE

4.1.1.3NET_BUFFER_LIST_CONTEXT
NDIS NET_BUFFER_LIST_CONTEXT NET_BUFFER_LIST
NET_BUFFER_LIST Context NET_BUFFER_LIST_CONTEXT
NDIS

 ContextData NET_BUFFER_LIST
NET_BUFFER_LIST_CONTEXT

NdisAllocateNetBufferListContext
NdisFreeNetBufferListContext
NET_BUFFER_LIST_CONTEXT_DATA_START
NET_BUFFER_LIST_CONTEXT_DATA_SIZE

4.1.2 RetreatAdvance
NDIS Retreat Advance NET_BUFFER Retreat
Advance
Retreat
NdisRetreatNetBufferDataStart
Advance
NdisAdvanceNetBufferStart

4.1.2.1Retreat
Retreat NET_BUFFER NET_BUFFER_LIST NET_BUFFER
Retreat
NdisRetreatNetBufferDataStart
NdisRetreatNetBufferListDataStart
Retreat NET_BUFFER MDL
NetAlloceMdl NULL
MDL NetFreeMdl
DataLength NDIS DataOffsetDelta
DataLength DataOffset
DataOffsetDelta DataOffset DataLengh DataOffsetDelta
DataLength
Retreat NDIS
DataOffset
Retreat NDIS
NDIS DataOffset DataLength
Retreat
Retreat DataOffset DataLength
Advance Retreat

4.1.2.2Advance
Aduvance NET_BUFFER NET_BUFFER_LIST NET_BUFFER


NdisAdvanceNetBufferDataStart
NdisAdvanceNetBufferListDataStart
Advanced NET_BUFFER
NetFreeMdl NDIS
MDL
DataLengthNDIS DataLength DataOffsetDelta
Retreat Advance
NDIS DataLength DataOffset
Advance Retreat
Retreat
Advance DataLength DataOffset
Advance

4.1.3
NDIS
NdisAllocateNetBufferPool
NdisAllocateNetBufferListPool
NDIS6.0

NdisRegisterProtocolDriver

NDIS MiniportInitializeEx

NdisRegisterProtocolDriver
NDIS MiniportInitializeEx

(FilterDriver)

NDIS FilterAttach

NdisAllocateGenericObject

4.1.4 IRQL
NDIS IRQL
IRQL IRQL
otherflag(otherabbritues)
IRQL
NDIS_SEND_FLAGS_DISPATCH_LEVEL

NDIS_SEND_COMPLETE_FLAGS_DISPATCH_LEVEL
NDIS_RECEIVE_FLAGS_DISPATCH_LEVEL
NDIS_RETURN_FLAGS_DISPATCH_LEVEL
NDIS_RWL_AT_DISPATCH_LEVEL
IRQL IRQL
IRQL
IRQL DISPATCH_LEVEL IRQL
DISPATCH_LEVEL

NDIS
IRQL

4.1.5
NDIS6.0 NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER
NET_BUFFER_LIST
NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER 802.11
NET_BUFFER NET_BUFFER_LIST NDIS
NET_BUFFER_LIST
NDIS5.X NDIS NDIS_PACKET NET_BUFFER
NDIS
NET_BUFFER NET_BUFFER_LIST NDIS

4.1.5.1
NDIS

NdisSendNetBufferLists NET_BUFFER_LIST
NDIS MiniportSendNetBufferLists NET_BUFFER_LIST
NET_BUFFER
NdisMSendNetBufferListsComplete NET_BUFFER_LIST

 NET_BUFFER_LIST
NdisMSendNetBufferListsComplete NDIS
ProtocolSendNetBufferListsComplete
NDIS ProtocolSendNetBufferListsComplete
NET_BUFFER_LIST NET_BUFFER
NDIS NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER
NDIS NET_BUFFER NET_BUFFER_LIST
NET_BUFFER MDL
NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER MDL
NET_BUFFER_LIST NET_BUFFER_LIST
NdisOpenAdapterEx NDIS NdisBindingHandle
NET_BUFFER_LIST SourceHandle NDIS
NET_BUFFER_LIST
NET_BUFFER_LIST SourceHandle
NdisOpenAdapterEx NdisBindingHandle NET_BUFFER_LIST
SourceHandle SourceHandle
SourceHandle

4.1.5.2

NDIS_SET_NET_BUFFER_LIST_CANCEL_ID
NET_BUFFER_LIST ID
ID NdisGeneratePartialCancelId ID
ID DriverEntry
ID ID

 ID
NdisCancelSendNetBufferLists NET_BUFFER_LIST
ID
NDIS_GET_NET_BUFFER_LIST_CANCEL_ID NET_BUFFER_LIST
ID
NET_BUFFER_LIST ID
NET_BUFFER_LIST ID ID

NDIS MiniportCancelSend
NdisMSendNetBufferListsComplete NET_BUFFER_LIST
NDIS_STATUS_CANCELLED NDIS PotocolSendNetBufferListsComplete
NET_BUFFER_LIST ID NULL

4.1.5.3
NDIS

NdisMIndicateReceiveNetBufferLists
NET_BUFFER_LIST NET_BUFFER_LIST
NET_BUFFER_LIST
NET_BUFFER_LIST
NdisMIndicateReceiveNetBufferLists NDIS NET_BUFFER_LIST
ProtocolReceiveNetBufferLists NDIS
NET_BUFFER_LIST NET_BUFFER_LIST
NetBufferListFrameType NDIS

ReceiveFlag NDIS_RECEIVE_FLAGS_RESOURCES
NDIS ProtocolReceiveNetBufferLists
NET_BUFFER_LIST

NET_BUFFER_LIST
NDIS NET_BUFFER_LIST
NET_BUFFER NET_BUFFER MDL

 NET_BUFFER_LIST

NET_BUFFER_LIST
NdisReturnNetBufferLists

NdisReturnNetBufferLists NDIS
MiniportRetrunNetBufferLists
NDIS_RECEIVE_FLAGS_RESOURCES
NDIS MiniportRetrunNetBufferLists
NdisMIndicateReceiveNetBufferLists
NDIS NET_BUFFER_LIST
NdisMIndicateReceiveNetBufferLists NDIS NET_BUFFER_LIST

NET_BUFFER_LIST SourceHandle
NDIS MiniprotInitEx MiniprotAdapterHandle
NDIS NET_BUFFER_LIST

NET_BUFFER_LIST SourceHandle
NDIS MiniprotInitEx
MiniprotAdapterHandle
SourceHandle NDIS NET_BUFFER_LIST
SourceHandle NdisMReturnNetBufferLists

4.1.5.4NDIS
NET_BUFFER_LIST NblFlags NDIS_NBL_FLAGS_IS_LOOPBACK_PACKET
Filter Driver

1 NdisMedium802_3 NdisMedium802_5
2
a) OID OID_GEN_CURRENT_PACKET_FILTER
NDIS_PACKET_TYPE_PROMISCUOUS
z
z FilterModule
b) OID OID_GEN_CURRENT_PACKET_FILTER
NDIS_PACKET_TYPE_ALL_LOCAL
z
z FilterModule
c) NdisSendNetBufferLists SendFlags
NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK
3
a) MAC MAC

 NDIS_PACKET_TYPE_ALL_MULTICAST

NDIS_PACKET_TYPE_ALL_MULTICAST
c) NDIS_PACKET_TYPE_BROADCAST

d) NDIS_PACKET_TYPE_PROMISCUOUS
NDIS_PACKET_TYPE_ALL_LOCAL

1
2 NDIS_PACKET_TYPE_NO_LOCAL

1) NDIS_PACKET_TYPE_NO_LOCAL

2) SendFlags
NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK

b)

4.1.6
4.1.6.1
WindowsVista TCP/IP
TCP/IP

1 NET_BUFFER_LIST
NET_BUFFER_LIST OOB NET_BUFFER_LIST
NetBufferListInfo
2 NET_BUFFER
NET_BUFFER_LIST
3 NET_BUFFER_LIST NET_BUFFER
4 NET_BUFFER_LIST NET_BUFFER MAC

5 TCP UDP NET_BUFFER_LIST NET_BUFFER

TCP UDP
6 MAC MDL MAC VLAN
7 NET_BUFFER MDL NET_BUFFER_LIST NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER_LIST
NET_BUFFER_LIST

4.1.6.2
WindowsVista TCP/IP
TCP/IP

1 NET_BUFFER_LIST NET_BUFFER_LIST
OOB NET_BUFFER_LIST NetBufferListInfo

2 NET_BUFFER NET_BUFFER_LIST
MDL NET_BUFFER
3 VISTA MDL

4 Windows NET_BUFFER_LIST
MDL IP IPV4 IPSEC IPV6 MDL
NDIS LOOKHEAD
5 NDIS6.0 FilterDriver
NET_BUFFER_LIST MDL

Windows

4.1.7 NET_BUFFER_LIST
NDIS6.0 NET_BUFFER_LIST NET_BUFFER_LIST

NET_BUFFER_LIST
NdisAllocateCloneNetBufferList
NdisAllocateFragmentNetBufferList
NdisAllocateReassembledNetBufferList

NET_BUFFER_LIST
Clone

NET_BUFFER_LIST

Fragrance

NET_BUFFER_LIST NET_BUFFER

Reassembled

NET_BUFFER_LIST NET_BUFFER_LIST
NET_BUFFER NET_BUFFER_LIST
NET_BUFFER_LIST

4.1.7.1NET_BUFFER_LIST

1) NET_BUFFER_LIST

2)

3) NET_BUFFER_LIST

4) NDIS NET_BUFFER_LIST
NET_BUFFER_LIST

5) NDIS NET_BUFFER_LIST 0NDIS

4.1.7.2
NET_BUFFER_LIST

 NdisAllocateCloneNetBufferList NET_BUFFER_LIST
NET_BUFFER_LIST NET_BUFFER MDL
MDL
NET_BUFFER_LIST NET_BUFFER_LIST_CONTEXT
NdisFreeCloneNetBufferList

4.1.7.3

 NdisAllocateFragmentNetBufferList
NET_BUFFER_LIST NET_BUFFER_LIST NET_BUFFER MDL
NET_BUFFER_LIST_CONTEXT

NET_BUFFER

 NET_BUFFER NET_BUFFER
NET_BUFFER NET_BUFFER
NdisFreeFragmentNetBufferList NET_BUFFER_LIST

4.1.7.4

NdisReassemledNetBufferList NET_BUFFER_LIST

 NET_BUFFER_LIST NET_BUFFER MDL

NET_BUFFER_LIST_CONTEXT

NdisFreeReassemledNetBufferList NET_BUFFER_LIST
NET_BUFFER MDL

4.2 NDIS
NDIS HeaderNDIS Ndis
NDIS NDIS
NDIS

4.2.1 NDIS
Header NDIS_OBJECT_HEADER

1) NDIS revision
NDIS6.1
Header
2)

3)
NDIS

4) NDIS
5) Header.Size Header.Revision

4.2.2 NDIS
NDIS Header NDIS
NDIS NDIS NDIS
NDIS NDIS5.X 6.1 NDIS6.0
NDIS6.1 NDIS

revision2 revision1

1 Header.revision Header.size
2 Header.revision Header.size
NDIS
3

4 6.1
NDIS NDIS6.1
5 NDIS OID NDIS_OID_REQUEST SupportedRevision
revision
6 OID SupportedRevision

4.2.3 NDIS
NDIS NDIS
NDIS
1 NDIS NDIS

2
NDIS6.1 XXX_REVISION_2 NDIS

4.2.4 NDIS
NDIS RtlGetVersion
RtlVerifyVersionInfo NDIS NDIS
NDIS NdisGetVersion

4.2.5 NDIS WMI

NDIS WMI WMI
NDIS