xeonkhj / shadowdriver

ShadowDriver a network utitlity library that allows user-mode application to filter link layer and network layer packet data.

ShadowDriver

What is this?

ShadowDriver a network utitlity library that allowing user-mode application to filter link layer and network layer packet data.

How

Filtering link layer and network layer requires a kernel-mode driver. ShadowDriver is a kernel mode driver that expose an interface that accept IOCTL calls from user-mode app to control filtering process.

Progress

You can see the detail in the project page.

Windows

• Network layer and link layer packet captureing.
• IPv4 packet modification.
• IPv6 packet modification.
• IPv4 packet Injection.
• IPv6 packet Injection.
• Link layer packet modification.
• Link layer packet injection.
• Library that communicate with the kernel driver.
• System test.

Linux

• Network layer and link layer packet captureing.
• Network layer and link layer packet modification.
• Network layer and link layer packet injection.
• Library that communicate with the kernel driver.
• System test.

Features

• Windows and Linux support.
• Mutil user-mode apps support.
• Network layer and link layer packet captureing.
• Network layer and link layer packet modification.
• Network layer and link layer packet injectction.
• Provide .NET library and UWP library.

Usage example

Use warpped APIs (Recommanded)

Fill it later.

Communicate to the kernel-mode driver directly

Fill it later.

Develope jounal (Mostly in Chinese)

Open Onenote development notebook

shadowdriver's Issues

Unable stop user-mode process after Stop Filtering and Unregister App

Likely some IOCTLs is pending in the queue. Need further investigation.

Link layer inbound path filter sends packet to user-mode application without ethernet header

计算校验和的结果与处理器字节顺序相关

在ShadowUtilities.c文件中的
unsigned short CalculateCheckSum(char* bytes, char* fakeHeader, int byteCounts, int fakeHeaderCounts, int marginBytes)
该方法计算好像与处理器大小端相关，具体表现为：
在Windows内核开发下使用该方法计算出来后返回的short结果直接放在IP头部的缓冲区中（用指针）没问题，但在用Hyper-V中的Ubuntu会使顺序相反。

Issue with registering same app to the driver more than once

The driver doesn't have the ability to identify multiple register IOCTLs that were send by the same app.
This needs to be fixed.

Keep calling StartFilteringAsync will increase the number of queued IOCTL

Only able to filter 114.114.114.114 packet.

Weird, right?

Use direct I/O to send packet via IOCTL

Might be better for performance.

An unregistered app will causes BSOD when queueing a IOCTL

Filtering condition bug

When I add link layer inbound and outbound 2 condition, only one path was being filtered.

A certain operation sequence that will crush windows network.

Start network layer filtering, deregister the app, then start link layer filtering. Then network crushed.

A memory free error causes BSOD

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8061b04c847, Address of the instruction which caused the bugcheck
Arg3: fffffd08d79414a0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

WinDbg shows that BSOD occurs in

ShadowDriver/WindowsKernel/ShadowDriver/IOCTLHelper.cpp

Line 241 in ba6d909

delete helper->_context.FilterContext;

The driver didn't undo the start filtering process when start procedure failed

Using LIST_ENTRY to queue NBL during modification will cause BSOD

No packet received after adding more than 1 condition