1

我有一个特定的驱动程序（防火墙驱动程序），我设法用 delphi 加载它，但我不知道如何在我的程序中调用他的函数。驱动程序上此功能的规范如下： 可以使用 DeviceIoControl (DDoSflt) IoControl 代码调用防火墙功能（DeviceIoControl 需要）如下：

0x2220c0 = IOCTL_START
Input:  none
Output: none

加载驱动后，调用该函数安装防火墙钩子。

0x2220c4 = IOCTL_STOP
Input:  none
Output: none

调用此函数可禁用防火墙而不卸载它。

0x2220c8 = IOCTL_DDOSADDIP
Input:  a DWORD containing an IP address
Output: none

此功能通知防火墙正在进行 DDoS 攻击并将 IP 添加到 DDoS 过滤器。在调用 IOCTL_DDOSSTOP 之前，将过滤来自 DDoS 过滤器中的 IP 的所有流量。

0x2220cc = IOCTL_DDOSSTOP
Input:  none
Output: none

此功能通知防火墙 DDoS 攻击已停止，该功能将删除 DDoS 过滤器。

0x2220d0 = IOCTL_BAN0
Input:  two DWORDs containing an IP range
Output: none

此函数设置 IP 范围的禁令。

0x2220d4 = IOCTL_GETFLT
Input:  none
Output: DWORD

此函数返回从 DDoS 过滤器中找到的 IP 发送的过滤 TCP/SYN 数据包的数量。2.防火墙使用的结构

2.1。防火墙参数信息

typedef struct _FirewallParametersInfo{
    WORD    pcapFlags;  // bit 0 = WinPCap is enabled, bit 1 = detection of adapters was completed (this WORD is not used by version 1.03 of DDoSflt)
    WORD    pcapAdapters;   // mask of enabled / disabled adapters used by WinPCap procedures (this WORD is not used by version 1.03 of DDoSflt)
    DWORD   pcapTimer;  // timeout for capturing packets using WinPCap procedures (not used by version 1.03 of DDoSflt)
    BYTE    pcapSyn;    // maximum number of TCP/SYN packets per second allowed from one IP
    BYTE    pcapUdp;    // maximum number of UDP packets per second allowed from one IP
    BYTE    pcapIcmp;   // maximum number of ICMP packets per second allowed from one IP
    BYTE    firewallFlags;  // bit 0 = firewall is registered
                // bit 1 = firewall is started
                // bit 2 = maximum SYN/second on hub's registered ports will be checked
                // bit 3 = maximum SYN/second on unregistered ports will be checked
                // bit 4 = ICMP traffic will be blocked
                // bit 5 = TCP/RST packets will not be sent (will be filtered)
                // bit 6 = if flood is detected, the application will call the firewall to set a _ban0_ (not used by firewall)
                // bit 7 = if flood is detected, a notification message will be sent in opchat (not used by firewall)
    WORD    hubSyn;     // maximum SYN rate allowed for one of registered hub's ports
    WORD    otherSyn;   // maximum SYN rate allowed for non-registered ports
} FirewallParametersInfo;

2.2. 端口信息

typedef struct _port_info{
    WORD    port;       // port value in network byte order
    int synRate;    // maximum number of TCP/SYN packets per second allowed from all users
} port_info;

这是 ...

4

1 回答 1

1

您需要使用 CreateFile API 打开驱动程序的句柄，然后您将能够使用 DeviceIoControl 向驱动程序发送命令。

    function InstallAndStartDriver(DriverPath,DriverName: WideString; out DriverDevice : THandle): Boolean;
    var
      hSCManager, hService: THandle;
      lpServiceArgVectors: PWideChar;
    begin
      Result := False;
      hSCManager := 0;
      hSCManager := OpenSCManagerW(nil, nil, SC_MANAGER_ALL_ACCESS);
      if hSCManager <> 0 then
      begin
        try
          hService := 0;
          hService := CreateServiceW(hSCManager, DriverName, DriverName, SERVICE_ALL_ACCESS, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL, PWideChar(DriverPath), nil, nil, nil, nil, nil);
          hService := 0;
          lpServiceArgVectors := nil;
          hService := OpenServiceW(hSCManager, DriverName, SERVICE_ALL_ACCESS);
          if hService <> 0 then
          begin
            try
              if StartServiceW(hService, 0, PWideChar(lpServiceArgVectors)) then
              begin
                Result := True;
              end;
            finally
              CloseServiceHandle(hService);
            end;
          end;
        finally
          CloseServiceHandle(hSCManager);
        end;
      end;
      if Result then
      begin
      DriverDevice := CreateFileW(PWideChar('\\.\' + DriverName), GENERIC_READ or GENERIC_WRITE, 0, PSECURITY_DESCRIPTOR(nil), OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
      Result := GetLastError() = ERROR_SUCCESS;
      end;
    end;


procedure TForm1.Button2Click(Sender: TObject);
var
  driver : THandle;
begin
  if InstallAndStartDriver('D:\mydriver.sys','Firewall',driver) then
    DeviceIoControl(...)
end;
于 2012-06-20T08:28:48.387 回答