Quantcast
Channel: Active questions tagged kernel - Stack Overflow
Viewing all articles
Browse latest Browse all 6334

Windows driver is printing nonexisting TCP ports in debugger

$
0
0

my goal is to write a driver which would display open TCP ports in kernel debugger. I made a function which hooks to nsiproxy driver and it waits for an IOCTL_NSI_GETALLPARAM request. If there is such a call, it prints in the debugger all of the TCP ports. But there is a problem, ports that are printed in the debugger don't exist and there is only a little bit of them shown. I am unable to find an issue in my code, because every time when I run a driver, it seems like printed ports are random.

Here is my printing function:

NTSTATUS PrintOpenPorts(IN PDEVICE_OBJECT DeviceObject, IN PIRP pIrp){     ULONG ioctl;    PIO_STACK_LOCATION irpStack;    ULONG status;    irpStack = IoGetCurrentIrpStackLocation(pIrp);    ioctl = irpStack->Parameters.DeviceIoControl.IoControlCode;    if (ioctl == IOCTL_NSI_GETALLPARAM)    {        if (irpStack->Parameters.DeviceIoControl.InputBufferLength == sizeof(NSI_PARAM))        {            PNSI_PARAM nsiParam = static_cast<PNSI_PARAM>(pIrp->UserBuffer);            if (nsiParam->Entries)            {                PNSI_TCP_ENTRY tcpEntries = (PNSI_TCP_ENTRY)nsiParam->Entries;                for(DWORD i = 0; i < nsiParam->Count; i++)                {                    if (nsiParam->Type == NSI_PARAM_TYPE::Tcp)                    {                        if (tcpEntries[i].Local.Port != 0)                        {                            DbgPrint("[+] Port : %d\n", ntohs(tcpEntries[i].Local.Port));                        }                    }                }            }        }    }    status = PreviousDispatch(DeviceObject, pIrp);    return status;}

The ntohs function:

#define ntohs(s) \    (((s >> 8) & 0x00FF) | \    ((s << 8) & 0xFF00))

Ports after executing netstat command

Ports printed in WinDbg


Viewing all articles
Browse latest Browse all 6334

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>