Re: Windows Filtering Platform
Posted: Sun Sep 29, 2013 3:55 am
On another note - here is what I've been working on (not as straight forward as I thought).
(does not work at the moment, but is the basis for other things)
Stuff to Note:
- #DIVERT_FLAG_DEFAULT = 0 (injection, etc.)
- DivertHelperParseIPv4Address (same as PB: MakeIPAddress)
- DivertHelperCalcChecksums (it's that easy)
NB*: It takes more then just changing the DstAddr to redirect a webpage; why at this point I don't know, but I was in contact with -basil and he put me on to some script examples.
NB**: DivertHelperCalcChecksums will calculate even if nothing has changed - so if you change the DivertHelperParseIPv4Address to match *ppIpHdr\DstAddr it passes through correctly... means I'm on the right track.
(does not work at the moment, but is the basis for other things)
Stuff to Note:
- #DIVERT_FLAG_DEFAULT = 0 (injection, etc.)
- DivertHelperParseIPv4Address (same as PB: MakeIPAddress)
- DivertHelperCalcChecksums (it's that easy)
NB*: It takes more then just changing the DstAddr to redirect a webpage; why at this point I don't know, but I was in contact with -basil and he put me on to some script examples.
NB**: DivertHelperCalcChecksums will calculate even if nothing has changed - so if you change the DivertHelperParseIPv4Address to match *ppIpHdr\DstAddr it passes through correctly... means I'm on the right track.
Code: Select all
#DIVERT_LAYER_NETWORK = 0
#DIVERT_LAYER_NETWORK_FORWARD = 1
#DIVERT_PRIORITY_DEFAULT = 0
#DIVERT_FLAG_DEFAULT = 0
#DIVERT_FLAG_SNIFF = 1
#DIVERT_FLAG_DROP = 2
#MAXBUF = $FFFF
#DIVERT_DIRECTION_OUTBOUND = 0
#DIVERT_DIRECTION_INBOUND = 1
#DIVERT_HELPER_NO_IP_CHECKSUM = 1
#DIVERT_HELPER_NO_ICMP_CHECKSUM = 2
#DIVERT_HELPER_NO_ICMPV6_CHECKSUM = 4
#DIVERT_HELPER_NO_TCP_CHECKSUM = 8
#DIVERT_HELPER_NO_UDP_CHECKSUM = 16
Structure DIVERT_ADDRESS
IfIdx.l
SubIfIdx.l
Direction.a
EndStructure
Structure DIVERT_IPHDR
StructureUnion
HdrLength.a
Version.a
EndStructureUnion
TOS.a
Length.u
Id.u
FragOff0.u
TTL.a
Protocol.a
Checksum.u
SrcAddr.l
DstAddr.l
EndStructure
Structure DIVERT_TCPHDR
SrcPort.u
DstPort.u
SeqNum.l
AckNum.l
StructureUnion
Reserved1.a
HdrLength.a
EndStructureUnion
StructureUnion
Fin.a
Syn.a
Rst.a
Psh.a
Ack.a
Urg.a
Reserved2.a
EndStructureUnion
Window.u
Checksum.u
UrgPtr.u
EndStructure
Prototype protoDivertOpen(filter.s, layer, priority.u, flags.q)
Global DivertOpen.protoDivertOpen
Prototype.b protoDivertRecv(handle, *pPacket, packetLen, pAddr, recvLen)
Global DivertRecv.protoDivertRecv
Prototype.b protoDivertSend(handle, *pPacket, packetLen, pAddr, sendLen)
Global DivertSend.protoDivertSend
Prototype.b protoDivertHelperParsePacket(*pPacket, packetLen, *ppIpHdr, *ppIpv6Hdr, *ppIcmpHdr, *ppIcmpv6Hdr, *ppTcpHdr, *ppUdpHdr, *ppData, pDataLen)
Global DivertHelperParsePacket.protoDivertHelperParsePacket
Prototype.b protoDivertHelperParseIPv4Address(addrStr.s, pAddr)
Global DivertHelperParseIPv4Address.protoDivertHelperParseIPv4Address
Prototype protoDivertHelperCalcChecksums(*pPacket, packetLen, flags.q)
Global DivertHelperCalcChecksums.protoDivertHelperCalcChecksums
Prototype.b protoDivertClose(handle)
Global DivertClose.protoDivertClose
WinDivert = OpenLibrary(#PB_Any, "WinDivert.dll")
If IsLibrary(WinDivert)
DivertOpen = GetFunction(WinDivert, "DivertOpen")
DivertRecv = GetFunction(WinDivert, "DivertRecv")
DivertHelperParsePacket = GetFunction(WinDivert, "DivertHelperParsePacket")
DivertHelperParseIPv4Address = GetFunction(WinDivert, "DivertHelperParseIPv4Address")
DivertHelperCalcChecksums = GetFunction(WinDivert, "DivertHelperCalcChecksums")
DivertSend = GetFunction(WinDivert, "DivertSend")
DivertClose = GetFunction(WinDivert, "DivertClose")
hWndDivert = DivertOpen("tcp.DstPort == 80", #DIVERT_LAYER_NETWORK, #DIVERT_PRIORITY_DEFAULT, #DIVERT_FLAG_DEFAULT)
If hWndDivert <> #INVALID_HANDLE_VALUE
pAddr.DIVERT_ADDRESS
*ppIpHdr.DIVERT_IPHDR
*ppTcpHdr.DIVERT_TCPHDR
RunProgram("iexplore", "http://www.purebasic.com/french/", "")
Repeat
*pPacket = AllocateMemory(#MAXBUF)
If DivertRecv(hWndDivert, *pPacket, #MAXBUF, @pAddr, @recvLen)
DivertHelperParsePacket(*pPacket, recvLen, @*ppIpHdr, #Null, #Null, #Null, @*ppTcpHdr, #Null, @*ppData, @pDataLen)
If IPString(*ppIpHdr\DstAddr) = "88.191.144.148"
DivertHelperParseIPv4Address("184.72.115.86", @AddrRedirect)
*ppIpHdr\DstAddr = htonl_(AddrRedirect)
DivertHelperCalcChecksums(*pPacket, recvLen, #DIVERT_HELPER_NO_ICMP_CHECKSUM | #DIVERT_HELPER_NO_ICMPV6_CHECKSUM | #DIVERT_HELPER_NO_UDP_CHECKSUM)
Debug "AddrRedirect: " + IPString(htonl_(AddrRedirect))
EndIf
DivertSend(hWndDivert, *pPacket, recvLen, @pAddr, #Null)
EndIf
FreeMemory(*pPacket)
ForEver
DivertClose(hWndDivert)
EndIf
CloseLibrary(WinDivert)
RunProgram("sc", "stop WinDivert1.0", "", #PB_Program_Hide)
RunProgram("sc", "delete WinDivert1.0", "", #PB_Program_Hide)
EndIf
but as you can see with my latest contribution I some-what figured that part out (actually -basil pointed it out in an email just recently, I'm still not 100%).