Question

我有一个特定的驱动程序（防火墙驱动程序），我设法加载delphi但我不知道如何在我的程序中调用他的功能。驱动程序上此函数的规范如下：可以使用DeviceIoControl（DDoSflt）调用防火墙功能 IoControl代码（DeviceIoControl需要）如下：

0x2220c0 = IOCTL_START
Input:  none
Output: none

加载驱动程序后，调用此函数安装防火墙钩子。

0x2220c4 = IOCTL_STOP
Input:  none
Output: none

调用此函数禁用防火墙而不卸载它。

0x2220c8 = IOCTL_DDOSADDIP
Input:  a DWORD containing an IP address
Output: none

此功能通知防火墙正在进行DDoS攻击，并向DDoS过滤器添加IP。在调用IOCTL_DDOSSTOP之前，将过滤来自DDoS过滤器中IP的所有流量。

0x2220cc = IOCTL_DDOSSTOP
Input:  none
Output: none

此功能通知防火墙DDoS攻击已停止，该功能将删除DDoS过滤器。

0x2220d0 = IOCTL_BAN0
Input:  two DWORDs containing an IP range
Output: none

此功能设置禁止IP范围。

0x2220d4 = IOCTL_GETFLT
Input:  none
Output: DWORD

此函数返回从DDoS过滤器中找到的IP发送的已过滤TCP / SYN数据包的数量。 2.防火墙使用的结构

2.1。 FirewallParametersInfo

typedef struct _FirewallParametersInfo{
    WORD    pcapFlags;  // bit 0 = WinPCap is enabled, bit 1 = detection of adapters was completed (this WORD is not used by version 1.03 of DDoSflt)
    WORD    pcapAdapters;   // mask of enabled / disabled adapters used by WinPCap procedures (this WORD is not used by version 1.03 of DDoSflt)
    DWORD   pcapTimer;  // timeout for capturing packets using WinPCap procedures (not used by version 1.03 of DDoSflt)
    BYTE    pcapSyn;    // maximum number of TCP/SYN packets per second allowed from one IP
    BYTE    pcapUdp;    // maximum number of UDP packets per second allowed from one IP
    BYTE    pcapIcmp;   // maximum number of ICMP packets per second allowed from one IP
    BYTE    firewallFlags;  // bit 0 = firewall is registered
                // bit 1 = firewall is started
                // bit 2 = maximum SYN/second on hub's registered ports will be checked
                // bit 3 = maximum SYN/second on unregistered ports will be checked
                // bit 4 = ICMP traffic will be blocked
                // bit 5 = TCP/RST packets will not be sent (will be filtered)
                // bit 6 = if flood is detected, the application will call the firewall to set a _ban0_ (not used by firewall)
                // bit 7 = if flood is detected, a notification message will be sent in opchat (not used by firewall)
    WORD    hubSyn;     // maximum SYN rate allowed for one of registered hub's ports
    WORD    otherSyn;   // maximum SYN rate allowed for non-registered ports
} FirewallParametersInfo;

2.2。 port_info

typedef struct _port_info{
    WORD    port;       // port value in network byte order
    int synRate;    // maximum number of TCP/SYN packets per second allowed from all users
} port_info;

这是......

Answer 1

您需要使用CreateFile API打开驱动程序的句柄，然后您就可以使用DeviceIoControl将命令发送到驱动程序。

    function InstallAndStartDriver(DriverPath,DriverName: WideString; out DriverDevice : THandle): Boolean;
    var
      hSCManager, hService: THandle;
      lpServiceArgVectors: PWideChar;
    begin
      Result := False;
      hSCManager := 0;
      hSCManager := OpenSCManagerW(nil, nil, SC_MANAGER_ALL_ACCESS);
      if hSCManager <> 0 then
      begin
        try
          hService := 0;
          hService := CreateServiceW(hSCManager, DriverName, DriverName, SERVICE_ALL_ACCESS, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL, PWideChar(DriverPath), nil, nil, nil, nil, nil);
          hService := 0;
          lpServiceArgVectors := nil;
          hService := OpenServiceW(hSCManager, DriverName, SERVICE_ALL_ACCESS);
          if hService <> 0 then
          begin
            try
              if StartServiceW(hService, 0, PWideChar(lpServiceArgVectors)) then
              begin
                Result := True;
              end;
            finally
              CloseServiceHandle(hService);
            end;
          end;
        finally
          CloseServiceHandle(hSCManager);
        end;
      end;
      if Result then
      begin
      DriverDevice := CreateFileW(PWideChar('\\.\' + DriverName), GENERIC_READ or GENERIC_WRITE, 0, PSECURITY_DESCRIPTOR(nil), OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
      Result := GetLastError() = ERROR_SUCCESS;
      end;
    end;


procedure TForm1.Button2Click(Sender: TObject);
var
  driver : THandle;
begin
  if InstallAndStartDriver('D:\mydriver.sys','Firewall',driver) then
    DeviceIoControl(...)
end;

如何在delphi中使用.sys驱动程序函数

1 个答案: