📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

Blogs >> evilcry's Blog

Created: Monday, September 25 2006 11:00.37 CDT Modified: Monday, September 25 2006 11:25.13 CDT
Printer Friendly ...
Something about Firewall hooking and Packet Filtering
Author: evilcry # Views: 4267

Firewall hooking, is a task in major part not well documented, MS doesn't provides a clear and exaustive documentation about structures and development, so the only mode to have more knowledge is the Back-Trace method.

These filter-hooks obviously works only at kernel mode, installing a callback function, and the driver installs a callback into \device\IP (which can be seen with WinObj) but let's also parse \system32\Drivers {...}

Fortunately, no extreme binary analysis is needed, we can study directly some header file from DDK, and precisely ipfirewall.h, so let's take a deeper look to this file. Immediately we can see two intersing structs, the first is IPPacketFirewallPtr that works as a callout routine, and the most interesting _IP_SET_FIREWALL_HOOK_INFO

First Struct: typedef FORWARD_ACTION (*IPPacketFirewallPtr)(
    VOID      **pData,               //can be pMdl or pRcvBuf
    UINT      RecvInterfaceIndex,    //Received Data
    UINT      *pSendInterfaceIndex,  //Index where data is sent
    UCHAR     *pDestinationType,     //Can be Local Network, Remote, Broadcast, Multicast.
    VOID      *pContext,             //Points to _FIREWALL_CONTEXT_T
    UINT      ContextLength,         //sizeof(FIREWALL_CONTEXT_T)
    struct IPRcvBuf      **pRcvBuf
    );

Second Struct: typedef struct _IP_SET_FIREWALL_HOOK_INFO {
    IPPacketFirewallPtr FirewallPtr;    // Packet filter callout.
    UINT                Priority;               // Priority of the hook
    BOOLEAN             Add;              // if TRUE then ADD else DELETE
} IP_SET_FIREWALL_HOOK_INFO, *PIP_SET_FIREWALL_HOOK_INFO;

This is the heart structure necessary to set-up the filter-hook, which can be done by sending a IOCTL to \device\Ip

#define IOCTL_IP_SET_FIREWALL_HOOK  \
            _IP_CTL_CODE(12, METHOD_BUFFERED, FILE_WRITE_ACCESS)

and where _IP_CTL_CODE is:

#define _IP_CTL_CODE(function, method, access) \
            CTL_CODE(FSCTL_IP_BASE, function, method, access)

IP_SET_FIREWALL_HOOK_INFO will be the Input Structure to be filled for the IOCTL.

By observing IPPacketFirewallPtr, we can see _FIREWALL_CONTEXT_T which is

typedef struct _FIREWALL_CONTEXT_T {
        DIRECTION_E  Direction;                      
        void         *NTE;
        void         *LinkCtxt;
        NDIS_HANDLE  LContext1;
        UINT         LContext2;
     } FIREWALL_CONTEXT_T, *PFIREWALL_CONTEXT_T;

After installing the filter-hook, can be powered up a set of rules to FORWARD or DROP a packet.


Thanks to Jesus O.




Add New Comment
Comment:









There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit