The problem of FwpsCalloutRegister function registration failure in WPF driver

56 views Asked by At

I'm doing network filter driven development using WPF. When I use the example and call FwpsCalloutRegister and try to register a Callout, this function always returns unsuccessful. The error code is 0xc022001c. After querying, I learned that the required parameters have null pointers. However, I carefully verified each incoming FwpsCalloutRegister. The variable does not have a null pointer, so I cannot continue to investigate.

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath) {
    pDriverObject->DriverUnload = DriverUnload;
    NTSTATUS status;
    KdPrint(("[WFP Driver]pDeviceObject value: %p\r\n", pDeviceObject));
    status = IoCreateDevice(
        pDriverObject,
        0,
        NULL,
        FILE_DEVICE_UNKNOWN,
        FILE_DEVICE_SECURE_OPEN,
        FALSE,
        &pDeviceObject
    );
    KdPrint(("[WFP Driver]pDeviceObject value: %p\r\n", pDeviceObject));
    if (!NT_SUCCESS(status)) {
        KdPrint(("[WFP Driver]IoCreateDevice Failed:0x%08x\r\n",status));
        return status;
    }
    else
    {
        KdPrint(("[WFP Driver]IoCreateDevice Success\r\n"));
    }
    status = InitialzeWfp();
    if (!NT_SUCCESS(status)) {
        KdPrint(("[WFP Driver]InitialzeWFP Failed:0x%08x\r\n", status));
        //IoDeleteDevice(pDeviceObject);
        return status;
    }
    else
    {
        KdPrint(("[WFP Driver]InitialzeWFP Success\r\n"));
    }
    return status;
}
NTSTATUS InitialzeWfp() {
    //OpenWFP
    if (!NT_SUCCESS(WfpOpenEngine())) {
        KdPrint(("[WFP Driver]WfpOpenEngine Failed\r\n"));
        goto Exit;
    };
    KdPrint(("[WFP Driver]WfpOpenEngine Success\r\n"));
    //RegCallout
    if (!NT_SUCCESS(WfpRegisterCallout())) {
        KdPrint(("[WFP Driver]WfpRegisterCallout Failed\r\n"));
        goto Exit;

        ......TO DO......
    return STATUS_SUCCESS;
Exit:
    UnInitialzeWfp();
    return STATUS_UNSUCCESSFUL;
}
NTSTATUS WfpRegisterCallout() {
    FWPS_CALLOUT sCallout = { 0 };
    sCallout.flags = 0;
    sCallout.calloutKey = FWP_CALLOUT_KEY_V4_GUID;
    sCallout.classifyFn = FilterCallback;
    //sCallout.notifyFn = NULL;
    //sCallout.flowDeleteFn = NULL;
    GUID guid = FWP_CALLOUT_KEY_V4_GUID;

    KdPrint(("[WFP Driver]GUID: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}\r\n", 
        guid.Data1, guid.Data2, guid.Data3, guid.Data4[0], guid.Data4[1], guid.Data4[2],
        guid.Data4[3], guid.Data4[4], guid.Data4[5], guid.Data4[6], guid.Data4[7]
        ));
    KdPrint(("[WFP Driver]RegCalloutId=%d", RegCalloutId));
    NTSTATUS status;
    status = FwpsCalloutRegister(pDeviceObject, &sCallout, &RegCalloutId);
    if (!NT_SUCCESS(status)) {
        KdPrint(("[WFP Driver]FwpsCalloutRegister Failed:0x%08x\r\n",status));
    }
    return status;
}

enter image description here

As the information output by KdPrint in the code, I output and checked every incoming variable to ensure that they are all valid parameters.

0

There are 0 answers