I'm doing network filter driven development using WPF. When I use the example and call FwpsCalloutRegister and try to register a Callout, this function always returns unsuccessful. The error code is 0xc022001c. After querying, I learned that the required parameters have null pointers. However, I carefully verified each incoming FwpsCalloutRegister. The variable does not have a null pointer, so I cannot continue to investigate.
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath) {
pDriverObject->DriverUnload = DriverUnload;
NTSTATUS status;
KdPrint(("[WFP Driver]pDeviceObject value: %p\r\n", pDeviceObject));
status = IoCreateDevice(
pDriverObject,
0,
NULL,
FILE_DEVICE_UNKNOWN,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&pDeviceObject
);
KdPrint(("[WFP Driver]pDeviceObject value: %p\r\n", pDeviceObject));
if (!NT_SUCCESS(status)) {
KdPrint(("[WFP Driver]IoCreateDevice Failed:0x%08x\r\n",status));
return status;
}
else
{
KdPrint(("[WFP Driver]IoCreateDevice Success\r\n"));
}
status = InitialzeWfp();
if (!NT_SUCCESS(status)) {
KdPrint(("[WFP Driver]InitialzeWFP Failed:0x%08x\r\n", status));
//IoDeleteDevice(pDeviceObject);
return status;
}
else
{
KdPrint(("[WFP Driver]InitialzeWFP Success\r\n"));
}
return status;
}
NTSTATUS InitialzeWfp() {
//OpenWFP
if (!NT_SUCCESS(WfpOpenEngine())) {
KdPrint(("[WFP Driver]WfpOpenEngine Failed\r\n"));
goto Exit;
};
KdPrint(("[WFP Driver]WfpOpenEngine Success\r\n"));
//RegCallout
if (!NT_SUCCESS(WfpRegisterCallout())) {
KdPrint(("[WFP Driver]WfpRegisterCallout Failed\r\n"));
goto Exit;
......TO DO......
return STATUS_SUCCESS;
Exit:
UnInitialzeWfp();
return STATUS_UNSUCCESSFUL;
}
NTSTATUS WfpRegisterCallout() {
FWPS_CALLOUT sCallout = { 0 };
sCallout.flags = 0;
sCallout.calloutKey = FWP_CALLOUT_KEY_V4_GUID;
sCallout.classifyFn = FilterCallback;
//sCallout.notifyFn = NULL;
//sCallout.flowDeleteFn = NULL;
GUID guid = FWP_CALLOUT_KEY_V4_GUID;
KdPrint(("[WFP Driver]GUID: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}\r\n",
guid.Data1, guid.Data2, guid.Data3, guid.Data4[0], guid.Data4[1], guid.Data4[2],
guid.Data4[3], guid.Data4[4], guid.Data4[5], guid.Data4[6], guid.Data4[7]
));
KdPrint(("[WFP Driver]RegCalloutId=%d", RegCalloutId));
NTSTATUS status;
status = FwpsCalloutRegister(pDeviceObject, &sCallout, &RegCalloutId);
if (!NT_SUCCESS(status)) {
KdPrint(("[WFP Driver]FwpsCalloutRegister Failed:0x%08x\r\n",status));
}
return status;
}
As the information output by KdPrint in the code, I output and checked every incoming variable to ensure that they are all valid parameters.