Vadim Smirnov

Forum Replies Created

Viewing 15 posts - 1,261 through 1,275 (of 1,474 total)
  • Author
    Posts
  • in reply to: TDI ip and bindings changes notifications #5921
    Vadim Smirnov
    Keymaster

      Well, may be it is not a good solution for your type of driver but you can track binding changes by hooking NdisOpenAdapter/NdisCloseAdapter in NDIS.SYS

      in reply to: Some WinpkFilter questions #5949
      Vadim Smirnov
      Keymaster

        Если адаптер будет удален из системы или соединение будет задизеблино (disabled), что в общем-то одно и то же, так как binding удаляется, то ReleaseInterface вызывать не нужно, все ассоциированные с сетвым интерфейсом ресурсы будут освобождены при его удалении.

        in reply to: Build Delphi examples #5947
        Vadim Smirnov
        Keymaster

          Гм, тогда все понятно. Действительно, в версии 3.0.1 (2005-Nov-24) при переходе с VC6 на VS2005 была допущена ошибка (в следствии конвертации проекта был выброшен DEF файл). Так как все основные тесты отрабатываются С++ (и большинством разработчиков в данной сфере используется именно С/C++), проблема была замечена и исправлена только 2006-Jan-05. Все это отражено в ньюсах http://www.ntkernel.com/news.php

          Проблема не является критической, и требовала единственного изменения в VS2005 проекте DLL (сборка с использованием VC++ 6.0 или из командной строки (sources) выполнялась правильно). В общем-то любой коммерческий WinpkFilter проект так или иначе требует пересборки драйверов (в случае Developers license пересборка осуществляется нами) и DLL во избежание конфликтов имен драйверов. Так что пересобрать и драйвера (с использование новых имен устройств, модулей и протоколов) и DLL все-таки необходимо иначе разработанное вами приложение будет конфликтовать со стандартной сборкой WinpkFilter и основанных на ней примерах.

          Заказчик может получить обновление используя полученные ранее реквизиты. Хотя как следует из вышесказанного стандартная сборка DLL не должна использоваться для конечного продукта.

          Прошу прощения за доставленные неудобства. Если возникнут вопросы относительно сборки драйверов, то пишите на support@ntkernel.com решим в рабочем порядке (единственое просьба указать покупателя, нашего клиента и вашего заказчика, приблизительную дату и номер ордера). Обычно, в случае Source Code license заказчик сам выполняет сборку драйверов и DLL, однако если это по каким-либо причинам проблематично мы так же делаем custom build как и в случае с Developer license.

          in reply to: Build Delphi examples #5945
          Vadim Smirnov
          Keymaster

            Вот что выдает dumpbin по экспортам ndisapi.dll собранной в Visual C++ (та что стандартно идет в инсталляторе WinpkFilter):

            Microsoft (R) COFF Binary File Dumper Version 6.00.8447
            Copyright (C) Microsoft Corp 1992-1998. All rights reserved.


            Dump of file ndisapi.dll

            File Type: DLL

            Section contains the following exports for ndisapi.dll

            0 characteristics
            43BD7734 time date stamp Thu Jan 05 21:44:52 2006
            0.00 version
            1 ordinal base
            57 number of functions
            57 number of names

            ordinal hint RVA name

            1 0 00001000 ??0CNdisApi@@QAE@ABV0@@Z
            2 1 00001110 ??0CNdisApi@@QAE@PBD@Z
            3 2 000011F0 ??1CNdisApi@@UAE@XZ
            4 3 00001040 ??4CNdisApi@@QAEAAV0@ABV0@@Z
            5 4 0000ABF0 ??_7CNdisApi@@6B@
            6 5 00001080 ??_FCNdisApi@@QAEXXZ
            7 6 00001E50 ?ConvertWindows2000AdapterName@CNdisApi@@SAHPBDPADK@Z
            8 7 00001FB0 ?ConvertWindows9xAdapterName@CNdisApi@@SAHPBDPADK@Z
            9 8 00001CA0 ?ConvertWindowsNTAdapterName@CNdisApi@@SAHPBDPADK@Z
            10 9 00001220 ?DeviceIoControl@CNdisApi@@QAEHKPAXH0HPAHPAU_OVERLAPPED@@@Z
            11 A 00001400 ?FlushAdapterPacketQueue@CNdisApi@@QAEHPAX@Z
            12 B 000013D0 ?GetAdapterMode@CNdisApi@@QAEHPAU_ADAPTER_MODE@@@Z
            13 C 00001430 ?GetAdapterPacketQueueSize@CNdisApi@@QAEHPAXPAK@Z
            14 D 00001BB0 ?GetAdaptersStartupMode@CNdisApi@@SAKXZ
            15 E 00001870 ?GetBytesReturned@CNdisApi@@QAEKXZ
            16 F 00001800 ?GetHwPacketFilter@CNdisApi@@QAEHPAXPAK@Z
            17 10 000019A0 ?GetMTUDecrement@CNdisApi@@SAKXZ
            18 11 000012D0 ?GetTcpipBoundAdaptersInfo@CNdisApi@@QAEHPAU_TCP_AdapterList@@@Z
            19 12 00001290 ?GetVersion@CNdisApi@@QAEKXZ
            20 13 00001860 ?IsDriverLoaded@CNdisApi@@QAEHXZ
            21 14 000016E0 ?NdisrdRequest@CNdisApi@@QAEHPAU_PACKET_OID_DATA@@H@Z
            22 15 00001370 ?ReadPacket@CNdisApi@@QAEHPAU_ETH_REQUEST@@@Z
            23 16 00001340 ?SendPacketToAdapter@CNdisApi@@QAEHPAU_ETH_REQUEST@@@Z
            24 17 00001310 ?SendPacketToMstcp@CNdisApi@@QAEHPAU_ETH_REQUEST@@@Z
            25 18 00001610 ?SetAdapterListChangeEvent@CNdisApi@@QAEHPAX@Z
            26 19 000013A0 ?SetAdapterMode@CNdisApi@@QAEHPAU_ADAPTER_MODE@@@Z
            27 1A 00001A90 ?SetAdaptersStartupMode@CNdisApi@@SAHK@Z
            28 1B 000017B0 ?SetHwPacketFilter@CNdisApi@@QAEHPAXK@Z
            29 1C 00001880 ?SetMTUDecrement@CNdisApi@@SAHK@Z
            30 1D 00001470 ?SetPacketEvent@CNdisApi@@QAEHPAX0@Z
            31 1E 00001540 ?SetWANEvent@CNdisApi@@QAEHPAX@Z
            32 1F 000020B0 CloseFilterDriver
            33 20 00002520 ConvertWindows2000AdapterName
            34 21 00002540 ConvertWindows9xAdapterName
            35 22 00002500 ConvertWindowsNTAdapterName
            36 23 000022A0 FlushAdapterPacketQueue
            37 24 00002260 GetAdapterMode
            38 25 000022F0 GetAdapterPacketQueueSize
            39 26 000024B0 GetAdaptersStartupMode
            40 27 000024E0 GetBytesReturned
            41 28 000020D0 GetDriverVersion
            42 29 00002420 GetHwPacketFilter
            43 2A 00002490 GetMTUDecrement
            44 2B 00002120 GetTcpipBoundAdaptersInfo
            45 2C 000024C0 IsDriverLoaded
            46 2D 000023A0 NdisrdRequest
            47 2E 00002090 OpenFilterDriver
            48 2F 000021E0 ReadPacket
            49 30 000021A0 SendPacketToAdapter
            50 31 00002160 SendPacketToMstcp
            51 32 00002380 SetAdapterListChangeEvent
            52 33 00002220 SetAdapterMode
            53 34 000024A0 SetAdaptersStartupMode
            54 35 000023C0 SetHwPacketFilter
            55 36 00002480 SetMTUDecrement
            56 37 00002340 SetPacketEvent
            57 38 00002360 SetWANEvent

            Summary

            2000 .data
            4000 .rdata
            2000 .reloc
            1000 .rsrc
            8000 .text

            Как видно их приведенного, ndisapi.dll экспортирует два набора функций, один в форме C++ класса (может быть использован только из C++) и второй в виде _stdcall функций (для использования из других програмных сред). C Visual C run time библиотека слинкована статически.

            Думаю, что проблема в следущем, библиотека была собрана в C++ Builder без учета DEF файла (судя по тому что экспортируется только C++ класс). Что касается cc3260mt.dll, тут мне сложно сказать с уверенностью(нет под рукой проверить), но думаю с run-time библиотекой можно и в C++ Builder слинковаться статически.

            Собственно, возможность сборки DLL под C++ Builder была добавлена только для использования с C++ Builder, из-за того что name decoration используемый Visual C++ и C++ Builder различен. Возникшие проблемы скорей всего обьясняются с переносом и сборкой проектов под версию C++ Builder отличную от используемой нами. Вот экспорты ndisapi.dll собранной под C++ Builder 6.0:

            Microsoft (R) COFF Binary File Dumper Version 6.00.8447
            Copyright (C) Microsoft Corp 1992-1998. All rights reserved.


            Dump of file ndisapi.dll

            File Type: DLL

            Section contains the following exports for ndisapi.dll

            0 characteristics
            0 time date stamp Thu Jan 01 02:00:00 1970
            0.00 version
            1 ordinal base
            54 number of functions
            54 number of names

            ordinal hint RVA name

            1 0 00001258 @CNdisApi@$bctr$qpxc
            2 1 00001344 @CNdisApi@$bdtr$qv
            26 2 00001E0C @CNdisApi@ConvertWindows2000AdapterName$qpxcpcul
            27 3 00001F30 @CNdisApi@ConvertWindows9xAdapterName$qpxcpcul
            25 4 00001CAC @CNdisApi@ConvertWindowsNTAdapterName$qpxcpcul
            3 5 00001390 @CNdisApi@DeviceIoControl$qulpvit2ipip11_OVERLAPPED
            11 6 00001554 @CNdisApi@FlushAdapterPacketQueue$qpv
            10 7 00001528 @CNdisApi@GetAdapterMode$qp13_ADAPTER_MODE
            12 8 00001580 @CNdisApi@GetAdapterPacketQueueSize$qpvpul
            24 9 00001BD8 @CNdisApi@GetAdaptersStartupMode$qv
            20 A 00001960 @CNdisApi@GetBytesReturned$qv
            18 B 000018EC @CNdisApi@GetHwPacketFilter$qpvpul
            22 C 00001A38 @CNdisApi@GetMTUDecrement$qv
            5 D 00001444 @CNdisApi@GetTcpipBoundAdaptersInfo$qp16_TCP_AdapterList
            4 E 0000140C @CNdisApi@GetVersion$qv
            19 F 00001954 @CNdisApi@IsDriverLoaded$qv
            16 10 000017BC @CNdisApi@NdisrdRequest$qp16_PACKET_OID_DATAi
            8 11 000014D0 @CNdisApi@ReadPacket$qp12_ETH_REQUEST
            7 12 000014A4 @CNdisApi@SendPacketToAdapter$qp12_ETH_REQUEST
            6 13 00001478 @CNdisApi@SendPacketToMstcp$qp12_ETH_REQUEST
            15 14 00001710 @CNdisApi@SetAdapterListChangeEvent$qpv
            9 15 000014FC @CNdisApi@SetAdapterMode$qp13_ADAPTER_MODE
            23 16 00001B0C @CNdisApi@SetAdaptersStartupMode$qul
            17 17 0000188C @CNdisApi@SetHwPacketFilter$qpvul
            21 18 0000196C @CNdisApi@SetMTUDecrement$qul
            13 19 000015AC @CNdisApi@SetPacketEvent$qpvt1
            14 1A 00001664 @CNdisApi@SetWANEvent$qpv
            30 1B 0000202C CloseFilterDriver
            53 1C 00002398 ConvertWindows2000AdapterName
            54 1D 000023B0 ConvertWindows9xAdapterName
            52 1E 00002380 ConvertWindowsNTAdapterName
            38 1F 000021AC FlushAdapterPacketQueue
            37 20 00002184 GetAdapterMode
            39 21 000021D4 GetAdapterPacketQueueSize
            49 22 0000232C GetAdaptersStartupMode
            51 23 0000235C GetBytesReturned
            31 24 00002098 GetDriverVersion
            45 25 000022D4 GetHwPacketFilter
            47 26 00002310 GetMTUDecrement
            32 27 000020BC GetTcpipBoundAdaptersInfo
            50 28 00002338 IsDriverLoaded
            43 29 0000227C NdisrdRequest
            29 2A 00001FD8 OpenFilterDriver
            35 2B 00002134 ReadPacket
            34 2C 0000210C SendPacketToAdapter
            33 2D 000020E4 SendPacketToMstcp
            42 2E 00002254 SetAdapterListChangeEvent
            36 2F 0000215C SetAdapterMode
            48 30 0000231C SetAdaptersStartupMode
            44 31 000022A8 SetHwPacketFilter
            46 32 00002300 SetMTUDecrement
            40 33 00002200 SetPacketEvent
            41 34 0000222C SetWANEvent
            28 35 000030F8 ___CPPdebugHook

            Summary

            1000 .data
            1000 .edata
            1000 .idata
            1000 .reloc
            1000 .rsrc
            2000 .text
            1000 .tls

            Как видно экспорты опять отличаются от приведенных вами.

            Решение проблемы в том что необходимо должным образом настроить проект под C++ Builder:

            1) Убедится что DEF файл включен в сборку (по всей видимости он был убран в следствии конвертации проекта).

            2) Вместо динамической run-time библиотеки использовать статическую.

            in reply to: NAT #5930
            Vadim Smirnov
            Keymaster

              В общем-то нет необходимости менять MAC адреса в случае реализации NAT (если это не MAC NAT конечно). В Internet Gateway задачи маршрутизации (и постановки нужных MAC адресов) возлагаются на стек, мы меняем тока адреса источника.

              in reply to: NeT Firewall on Virtual Network Adapter #5919
              Vadim Smirnov
              Keymaster

                Hmm, since we already have the 64 bit version of WinpkFilter then making a 64 bit firewall is not a great problem. However, so far we are not sure that there is enough user interest in this solution. We will discuss internally the possibility of making this a priority task.

                in reply to: Winpkfilter question #5937
                Vadim Smirnov
                Keymaster

                  You was answered by e-mail. 🙂

                  1. There are any documents or information with potential restrictions or conflicts with any other commercial software?

                  Regretfully we can’t guarantee that you won’t ever meet compatibility problems when using WinpkFilter because any driver based on the similar technology (NDIS hooking) but implemented on the different or incorrect way may cause a conflict. That’s why the latest release of WinpkFilter in addition to NDIS hooking based driver also includes the driver based on NDIS intermediate driver technology (it should not cause any compatibility issues but it has some other disadvantages, like installation an example). So for those users who need some specific compatibility you can create a special build with NDIS IM based driver.

                  Luckily, so far we are aware about the only irresolvable conflict of WinpkFilter with Sygate firewall, but since it was recently bought by Symantec and discontinued then it is not a real problem anymore.

                  2. My license covers solutions to any potential conflicts found with some other software?

                  Some conflicts are resolvable, and we always trying to keep WinpkFilter up-to-date and compatible with any other commercial software. However, sometimes the compatibility problem can’t be resolved (like it was with Sygate, it patched TCPIP.SYS image and the only way to achieve the compatibility with it was implementing similar ugly hooking).

                  3. Once I get the Source license, Is there any restriction to source code modify? E.g.: Only drivers, not Winpkfilter API, etc.

                  The only restriction applied to Source Code license is that you can’t distribute/resell the WinpkFilter driver’s source code. You are free to modify drivers on the way you want and distribute your solutions in binary form.

                  Sorry, 4th question is not answered here because we have not permissions from our clients to use their names for online ad.

                  in reply to: Custom build #5939
                  Vadim Smirnov
                  Keymaster

                    Custom build is usually created in 48 hours (needs some time for building and testing the resulting solution).

                    in reply to: TDImon #5906
                    Vadim Smirnov
                    Keymaster

                      – не знаю можешь ли ты написать TDImon, но на вскидку, через TDI_SET_EVENT_HANDLER можно зарегистрировать клиентские callback и этот метод применим к способу Attach, а не patch.

                      Оба метода и patch и attach очень близки по реализации. И обработка event handler в них проводится аналогично.

                      in reply to: NeT Firewall on Virtual Network Adapter #5909
                      Vadim Smirnov
                      Keymaster

                        Could you please specify the exact version of the NeT Firewall you are using. There were some problems relative to MMC console initialization and shutdown, but we hope we had fixed them.

                        However, there is also a chance that NeT Firewall driver was not succesfully installed on your system. Did you have NeT Firewall working at all? Is it just a startup/shutdown problem or you could not managed the firewall to work at all?

                        NeT Firewall should be able to see and filter packets on all locally installed Ethernet, WiFi, dial-up network adapters including the virtual ones.

                        in reply to: Help with building "ndisrd.sys" from your sources. #5908
                        Vadim Smirnov
                        Keymaster

                          Вообще говоря, краткие инструкции по сборке заказчик должен был получить вместе с исходниками. Привожу их ниже:

                          1) For building Windows NT/2000/XP/2003 32 bit drivers you have to use Windows DDK (DDK must be XP or higher but building environment must be 2000, some NDIS structures depends from the environment). Sources file and dbuild.bat (automatic script for building drivers) are provided with the source code.

                          2) For building Windows 9x/ME you need MS Visual C++ 6.0 and Compuware VToolsD (in the meantime it is available as a part of SoftIce Driver Suite and Driver Studio). It is recommended to use VToolsD (makes building and maintaining driver much easier), however VxD project with a little effort can be configured to build with Windows 9x/ME DDK (it will make building driver process a bit more complex and you will have to use at least one ASM file with VxD skeleton). VxD projects explicitly includes two files from DDK assuming that DDK (you need 9x/ME DDK or cumulative DDK which includes 9x/ME DDK as its part) is installed into the H:NTDDK, if you set up DDK to the different folder you will see failed to include message when trying to build. To fix this change the path to DDK in the vxdhooks.h.

                          3) For building x64 version of WinpkFilter drivers you need one of the latest Windows DDK (which supports building x64 drivers). Sources file and dbuild.bat (automatic script for building drivers) are provided with the source code. For the automatic installation of NDIS IM driver from the installation program you can use slightly modified (the original version copies only single INF file but IM driver requires copying two INF files) snetcfg sample from XP DDK. It works just fine in combination with the special script (signdrv.bat) which disables driver signing warnings (works with Windows x64, Windows XP SP2, Windows Server 2003; earlier Windows versions regretfully have bugs in signing policy implementation and script does not work properly for them).

                          4) NT kernel-mode driver and VxD driver share some portion of source code located in Kernelcommon folder; these are actual filtering/functional routines.

                          in reply to: Handle VLAN? #5822
                          Vadim Smirnov
                          Keymaster

                            Thats right, VLAN is implemented inside NIC NDIS miniport driver, the only way to handle VLAN tags for this type of cards is NIC driver modification, since they are not visible (striped) above it.

                            in reply to: Using the virtual network adapter VirtNet #5862
                            Vadim Smirnov
                            Keymaster

                              Can I install virtual adapter programmatically?

                              In general yes, but I should note that this is not easy if you intend to support different Windows.I’m also not sure if it is possible on NT 4.0 at all.

                              Can I install 2,3…5 adapters in one system and set different MAC addresses for each adapter programmatically?

                              You can create more than one network device within single virtual network adapter driver. So the amswer is yes, but requires additional work.

                              Virtual adapter supports frame length > 1514 bytes for 802.1p/q standards?

                              VirtNet emulates 802.3 device, however you can create driver to emulate any kind of network device.

                              in reply to: dial-up connections over NDIS #5899
                              Vadim Smirnov
                              Keymaster

                                Sorry, I don’t know why I had replied in Russian.

                                You can differ WAN connections by the pair of MAC’s used (source and destination are unique for each WAN link). When the new dial-up connection is created you get a call to you ProtocolStatus handler with wan line up event and you can parse and extract the data passed to this call. However, this won’t alllow you to get the exact connection name, you’ll need a user-mode mode agent for this.

                                in reply to: dial-up connections over NDIS #5897
                                Vadim Smirnov
                                Keymaster

                                  Отличать WAN соединения можно по парам MAC адресов. При создании соединения можно пропарсить данные переданные в ProtocolStatus при wan line up event, однако имени соединения оттуда не вытащить, нужно делпть агента в user-mode.

                                Viewing 15 posts - 1,261 through 1,275 (of 1,474 total)