#define UDP_DEVICE_NAME 　　L"//Device//Udp"
#define TCP_DEVICE_NAME 　　L"//Device//Tcp"
#define TDI_FILTER_DEVICE_NAME 　　L"//Device//TdiFilter"typedef struct __TDI_FILTER_DEVICE_EXTENSION
{//过滤设备至少需要记录下真正Tdi网络设备的指针，来调用真正的TDI设备功能。
    PDEVICE_OBJECT pTdiDeviceObject;
} TDI_FILTER_DEVICE_EXTENSION, *PTDI_FILTER_DEVICE_EXTENSION;DriverEntry( PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath )
{UNICODE_STRING TdiDeviceName;......RtlInitUnicodeString( ( PUNICODE_STRING )&TdiDeviceName, UDP_DEVICE_NAME );ntStatus = IoCreateDevice( DriverObject, sizeof( TDI_FILTER_DEVICE_EXTENSION ), //指定设备扩展长度
        NULL, FILE_DEVICE_NETWORK, //网络类型设备0, 0, &DeviceObject ); //生成一个无名、网络类型设备，附加至TDI TCP/UDP设备，实现过滤功能。if( NT_SUCCESS( ntStatus ) ){DeviceObject->Flags |= DO_DIRECT_IO; //生成新的页表将同样的用户内存空间映射至系统虚拟内存空间来进行通信ntStatus = IoAttachDevice( DeviceObject, TdiDeviceName, ( PDEVICE_OBJECT* )DeviceObject->DeviceExtension //附加至的设备的指针将会输出至此参数中，这样就将真正的TDI设备的指针记录在过滤设备的扩展中
        ); }
}

typedef struct __TDI_EVENT_CONTEXT_WRAP
{DWORD dwEventContextMark; //对自己生成的结构实例加一个四字节的标志，可以不使用。DWORD dwEventType; //记录事件回调函数的类型PVOID pOrgEventHandler; //记录原始的事件回调函数PVOID pOrgEventContext; //记录原始的事件回调函数参数PFILE_OBJECT pAssocAddr; //记录事件回调函数所绑定的本机套接字PDEVICE_OBJEXT pDeviceObjext; //记录注册事件IRP所发送至的TDI设备
} TDI_EVENT_HANDLER_WRAP, *PTDI_EVENT_HANDLER_WRAP;typedef struct __TDI_EVENT_HANDLER_LINK
{LIST_ENTRY List; //将事件回调钩子记录以链表形式进行管理
    PTDI_EVENT_HANDLER_WRAP pTdiEventHandlerWrap;
} TDI_EVENT_HANDLER_LIST, *PTDI_EVENT_HANDLER_LIST;LIST_ENTRY g_TdiEventHandlerInfoList;NTSTATUS DeviceInternalIoControl( PDEVICE_OBJECT DeviceObject, PIRP Irp )
{PKIRQL OldIrql;PLIST_ENTRY pListEntry;PIO_STACK_LOCATION IrpSp;PTDI_EVENT_HANDLER_WRAP pTdiEventHandlerWrap;PTDI_EVENT_HANDLER_LIST pTdiEventHandlerList;PTDI_EVENT_HANDLER_WRAP pTdiEventHandlerWrap_;PTDI_EVENT_HANDLER_LIST pTdiEventHandlerList_;PTDI_FILTER_DEVICE_EXTENSION pTdiDeviceExtension; pTdiDeviceExtension = ( PTDI_FILTER_DEVICE_EXTENSION )DeviceObject->DeviceExtension;switch( IrpSp->MinorFunction ){case TDI_SET_EVENT_HANDLER:pTdiSetEvent = ( PTDI_REQUEST_KERNEL_SET_EVENT )&pIrpSp->Parameters;if( TDI_EVENT_RECEIVE == pTdiSetEvent->EventType )//|| TDI_EVENT_RECEIVE_EXPEDITED == pTdiSetEvent->EventType || TDI_EVENT_CHAINED_RECEIVE == pTdiSetEvent->EventType || TDI_EVENT_CHAINED_RECEIVE_EXPEDITED == pTdiSetEvent->EventType || TDI_EVENT_RECEIVE_DATAGRAM == pTdiSetEvent->EventType ){pTdiEventHandlerList = NULL;pTdiEventHandlerWrap = NULL;pProcessNetWorkTrafficInfo = NULL;if( NULL == pTdiSetEvent->EventHandler ){//注意！如果注册的事件回调函数是NULL的话，它表示的取消之前曾经注册过的事件回调函数, 这里当然不能挂钩，可以加入释放钩子资源的操作。goto CALL_PDO_DRIVER;}KeAcquireSpinLock( &g_SpLockTdiEventHandlerInfo, &OldIrql ); //对事件回调函数钩子列表写操作加锁保护
            pListEntry = g_TdiEventHandlerInfoList.Flink;for( ; ; ){if( pListEntry == &g_TdiEventHandlerInfoList ){pTdiEventHandlerWrap_ = NULL;break;}pTdiEventHandlerList_ = ( PTDI_EVENT_HANDLER_LIST )pListEntry;pTdiEventHandlerWrap_ = pTdiEventHandlerList_->pTdiEventHandlerWrap;if( pTdiEventHandlerWrap_->pAssocAddr == pFileObject &&pTdiEventHandlerWrap_->dwEventType == dwEventType ) //如果此本机套接字对象的相应事件回调函数已经存在，则直接对其进行修改就可以了，而不是不断的新建事件件回调钩子
                {pTdiEventHandlerWrap_->pOrgEventHandler = pEventHandler;pTdiEventHandlerWrap_->pOrgEventContext = pEventContext;break;}}if( NULL == pTdiEventHandlerWrap_ ) //没有找到，加入新的事件回调函数钩子
            {pTdiEventHandlerWrap = ( PTDI_EVENT_HANDLER_WRAP )ExAllocatePoolWithTag( NonPagedPool, sizeof( TDI_EVENT_HANDLER_WRAP ), 0 );if( NULL == pTdiEventHandlerWrap ){goto RELEASE_RESOURCE;}pTdiEventHandlerList = ( PTDI_EVENT_HANDLER_LIST )ExAllocatePoolWithTag( NonPagedPool, sizeof( TDI_EVENT_HANDLER_LIST ), 0 );if( NULL == pTdiEventHandlerList ){goto RELEASE_RESOURCE;}pTdiEventHandlerWrap->dwEventContextMark = TDI_EVENT_CONTEXT_MARK;pTdiEventHandlerWrap->dwEventType = dwEventType;pTdiEventHandlerWrap->pOrgEventHandler = pEventHandler;pTdiEventHandlerWrap->pOrgEventContext = pEventContext;pTdiEventHandlerWrap->pAssocAddr = pFileObject;pTdiEventHandlerWrap->pDeviceObject = pTdiDeviceExtension->pTdiDeviceObject;pTdiEventHandlerList->pTdiEventHandlerWrap = pTdiEventHandlerWrap;InsertTailList( &g_TdiEventHandlerInfoList, pTdiEventHandlerList );}else{pTdiEventHandlerWrap = pTdiEventHandlerWrap_;pTdiEventHandlerList = pTdiEventHandlerList_;}KeReleaseSpinLock( &g_SpLockTdiEventHandlerInfo, OldIrql ); //释放事件回调钩子列表锁if( TDI_EVENT_RECEIVE == pTdiSetEvent->EventType || TDI_EVENT_RECEIVE_EXPEDITED == pTdiSetEvent->EventType ){pTdiSetEvent->EventHandler = TdiFilterRecvEventHandler; //加入自己的事件过滤回调函数
            }else if( TDI_EVENT_CHAINED_RECEIVE == pTdiSetEvent->EventType ||TDI_EVENT_CHAINED_RECEIVE_EXPEDITED == pTdiSetEvent->EventType ){pTdiSetEvent->EventHandler = TdiFilterChainedRecvHandler;}else{pTdiSetEvent->EventHandler = TdiFilterRecvDatagramEventHandler;}pTdiSetEvent->EventContext = pTdiEventHandlerWrap;IoSkipCurrentIrpStackLocation( pIrp );ntStatus = IoCallDriver( pDeviceExtension->pTdiDeviceObject, pIrp );if( !NT_SUCCESS( ntStatus ) ){if( NULL == pTdiEventHandlerWrap_ ){//如果是新加入的事件回调函数钩子，可以在出错时将其释放, 也可以保留至套接字关闭时，再进行释放KeAcquireSpinLock( &g_SpLockTdiEventHandlerInfo, &OldIrql ); //对事件回调函数钩子列表写操作加锁保护
                    RemoveEntryList( ( PLIST_ENTRY )pTdiEventHandlerList );ExFreePoolWithTag( pTdiEventHandlerWrap );ExFreePoolWithTag( pTdiEventHandlerList );KeReleaseSpinLock( &g_SpLockTdiEventHandlerInfo, OldIrql ); //释放事件回调钩子列表锁
                }}return ntStatus;}break;default:goto CALL_PDO_DRIVER;break;}RELEASE_RESOURCE:if( NULL != pTdiEventHandlerWrap ){ExFreePoolWithTag( pTdiEventHandlerWrap, NonPagedPool );}if( NULL != pTdiEventHandlerList ){ExFreePoolWithTag( pTdiEventHandlerList, NonPagedPool );}CALL_PDO_DRIVER:IoSkipCurrentIrpStackLocation( pIrp );return IoCallDriver( pDeviceExtension->pTdiDeviceObject, pIrp );
}

NTSTATUS TdiFilterCleanUp(PDEVICE_OBJECT DeviceObject, PIRP pIrp )
{NTSTATUS ntStatus;KIRQL OldIrql;PTDI_EVENT_HANDLER_LIST pTdiEventHandlerList;PTDI_EVENT_HANDLER_WRAP pTdiEventHandlerWrap;PFILE_OBJECT pFileObject;TDI_FILTER_DEVICE_EXTENSION *pDeviceExtension;PIO_STACK_LOCATION pIrpSp;pDeviceExtension = ( TDI_FILTER_DEVICE_EXTENSION* )DeviceObject->DeviceExtension;pIrpSp = IoGetCurrentIrpStackLocation( pIrp );pFileObject = pIrpSp->FileObject;...//如果是主控制设备，要将调用IoCompleteIrp完成Irp, 如果是过滤设备，调用PDO设备驱动
IoSkipCurrentIrpStackLocation( pIrp );ntStatus = IoCallDriver( pDeviceExtension->pTdiDeviceObject, pIrp );if( !NT_SUCCESS( ntStatus ) ){DebugPrintEx( CLEANUP_INFO,"netmon TdiFilterCleanUp IoCallDriver return ERROR/n" );return ntStatus;}//下一步，释放套接字对应的事件回调钩子KeAcquireSpinLock( &g_SpLockTdiEventHandlerInfo, &OldIrql );FIND_LIST_AGAIN:pListEntry = g_TdiEventHandlerInfoList.Flink;for( ; ; ){if( pListEntry == &g_TdiEventHandlerInfoList ){break;}pTdiEventHandlerList = ( PTDI_EVENT_HANDLER_LIST )pListEntry;pTdiEventHandlerWrap = pTdiEventHandlerList->pTdiEventHandlerWrap;if( pTdiEventHandlerWrap->pAssocAddr == pFileObject ){RemoveEntryList( pListEntry );ExFreePoolWithTag( pTdiEventHandlerWrap, 0 );ExFreePoolWithTag( pTdiEventHandlerList, 0 );goto FIND_LIST_AGAIN;}pListEntry = pListEntry->Flink;}KeReleaseSpinLock( &g_SpLockTdiEventHandlerInfo, OldIrql );return ntStatus;
}

NTSTATUS TdiFilterRecvEventHandler( IN PVOID TdiEventContext,IN CONNECTION_CONTEXT ConnectionContext,IN ULONG ReceiveFlags,IN ULONG BytesIndicated,IN ULONG BytesAvailable,OUT ULONG *BytesTaken,IN PVOID Tsdu,OUT PIRP *IoRequestPacket)
{NTSTATUS ntStatus;PIO_STACK_LOCATION pIrpSp;PTDI_EVENT_HANDLER_WRAP pEventHandlerWrap;PTDI_COMPLETION_WRAP pCompletionWrap;LARGE_INTEGER RecvedDataSize;pEventHandlerWrap = ( PTDI_EVENT_HANDLER_WRAP )TdiEventContext;if( FALSE == g_bFiltering ) //是否进行过滤
    {goto CALL_ORIGINAL_EVENT_HANDLER;}if( FALSE != bStopRecv ){ ntStatus = STATUS_DATA_NOT_ACCEPTED;goto RELEASE_PROCESS_IO_INFO_RETURN;}ntStatus = ( ( ClientEventReceive )pEventHandlerWrap->pOrgEventHandler )( pEventHandlerWrap->pOrgEventContext, ConnectionContext, ReceiveFlags, BytesIndicated, BytesAvailable, BytesTaken, Tsdu, IoRequestPacket );if( NULL != BytesTaken && 0 != *BytesTaken ){//这里对数据进行处理, 比如可以进行通信数据量的统计
    }if( STATUS_MORE_PROCESSING_REQUIRED != ntStatus ){goto RELEASE_PROCESS_IO_INFO_RETURN;}if( NULL == *IoRequestPacket ){goto RELEASE_PROCESS_IO_INFO_RETURN;}//IoRequestPacket表示当前接收IRP中的数据如果并不完整, 并且认为接下来的数据是有价值，需要接收的话，那么需要自己新建一个IRP包，将其指针传入此参数中，并返回STATUS_MORE_PROCESSING_REQUIRED，通知IO管理不终止此IRP，TDI驱动将继续接收接下来的数据。//所以如果此IRP包存在，可以截取它的信息，具体方法下一步讲述。return ntStatus;CALL_ORIGINAL_EVENT_HANDLER:return ( ( ClientEventReceive )pEventHandlerWrap->pOrgEventHandler )( //直接调用原始的IRP钩子函数，不进行处理pEventHandlerWrap->pOrgEventContext, ConnectionContext, ReceiveFlags, BytesIndicated, BytesAvailable, BytesTaken, Tsdu, IoRequestPacket);
}

typedef struct __TDI_COMPLETION_WRAP
{...//可以加入用来记录/处理数据的成员, 比如通信标志, 流量统计等
　　PIO_COMPLETION_ROUTINE pCompletionRoutine;LPVOID pContext;
} TDI_COMPLETION_WRAP, *PTDI_COMPLETION_WRAP;

if( TDI_SEND == MinorFunction ||TDI_SEND_DATAGRAM == MinorFunction || TDI_RECEIVE == MinorFunction || TDI_RECEIVE_DATAGRAM == MinorFunction )
{if( TDI_RECEIVE == MinorFunction && TDI_RECEIVE_PEEK == ( ULONG )pIrpSp->Parameters.Others.Argument2 ){//TDI_RECEIVE_PEEK不会真正接收数据，可以不需要对其进行过滤。goto SKIP_CURRENT_STACK_LOCATION;}pCompletionWrap = ( PTDI_COMPLETION_WRAP )ExAllocateFromNPagedLookasideList( &g_CompletionWrapList ); //可以使用链表或HASH等数据结构来管理所有的CompletionRoutine包装信息，这里使用了NPAGED_LOOKASIDE_LIST，它的优势在于系统中所有的NPAGED_LOOKASIDE_LIST资源的最大占用量将会被内存管理器动态管理if( NULL == pCompletionWrap ){goto SKIP_CURRENT_STACK_LOCATION;}//这里可以设置CompletionRoutine的具体工作参数，比如具体操作的类型，原始的Completion函数等，在用户层传送至的IRP中是不会设置CompletionRoutine函数的，但其它驱动传送至的IRP中可能会进行设置，如在Receive事件回调函数中的IoRequestPacket参数IoCopyCurrentIrpStackLocationToNext( pIrp ); //设置下一个设备栈工作参数
IoSetCompletionRoutine( pIrp, TdiFilterCompletion, pCompletionWrap, TRUE, TRUE, TRUE);//这里就为这个IRP加入自己的CompletionRoutine函数goto CALL_PDO_DRIVER;SKIP_CURRENT_STACK_LOCATION:IoSkipCurrentIrpStackLocation( pIrp );CALL_PDO_DRIVER:return IoCallDriver( pDeviceExtension->pTdiDeviceObject, pIrp );
}

NTSTATUS TdiFilterCompletion( PDEVICE_OBJECT pDeviceObject, PIRP pIrp, LPVOID pContext )
{NTSTATUS ntStatus;PTDI_COMPLETION_WRAP pCompletionWrap;LARGE_INTEGER TransferredDataSize;PIRP pMasterIrp;PIO_STACK_LOCATION pIrpSp;ntStatus = pIrp->IoStatus.Status;pCompletionWrap = ( PTDI_COMPLETION_WRAP )pContext;if( NT_SUCCESS( ntStatus ) ){//可以在这里对成功传输的数据进行处理
    }//这里可以调用原始的Completion函数
    RETURN_SUCCESS:return ntStatus;
}