Click here to Skip to main content
15,896,153 members
Articles / Desktop Programming / Windows Forms

NDIS MONITOR .NET 32-bit v1.00

Rate me:
Please Sign up or sign in to vote.
4.81/5 (36 votes)
27 Apr 20078 min read 176.5K   9.9K   90  
NDIS Monitor allows to catch and log the exchange of packet data between NDIS miniport drivers and network protocol modules that occurs in kernel space.
using System;
using System.Drawing;
using System.Collections;
using System.ComponentModel;
using System.Windows.Forms;

namespace NdisMonitor
{
	/// <summary>
	/// Summary description for OpenAdapters.
	/// </summary>
	public class OpenAdapters : System.Windows.Forms.Form
	{
		private System.Windows.Forms.Label ctrlExplanation;
		private System.Windows.Forms.TreeView ctrlTree;
		private System.Windows.Forms.Button ctrlOK;
		private System.Windows.Forms.Button ctrlCancel;
		private System.Windows.Forms.ImageList ctrlTreeImages;
		private System.ComponentModel.IContainer components;

		public OpenAdapters()
		{
			//
			// Required for Windows Form Designer support
			//
			InitializeComponent();

			//
			// TODO: Add any constructor code after InitializeComponent call
			//
		}

		/// <summary>
		/// Clean up any resources being used.
		/// </summary>
		protected override void Dispose( bool disposing )
		{
			if( disposing )
			{
				if(components != null)
				{
					components.Dispose();
				}
			}
			base.Dispose( disposing );
		}

		#region Windows Form Designer generated code
		/// <summary>
		/// Required method for Designer support - do not modify
		/// the contents of this method with the code editor.
		/// </summary>
		private void InitializeComponent()
		{
			this.components = new System.ComponentModel.Container();
			System.Resources.ResourceManager resources = new System.Resources.ResourceManager(typeof(OpenAdapters));
			this.ctrlExplanation = new System.Windows.Forms.Label();
			this.ctrlTree = new System.Windows.Forms.TreeView();
			this.ctrlTreeImages = new System.Windows.Forms.ImageList(this.components);
			this.ctrlOK = new System.Windows.Forms.Button();
			this.ctrlCancel = new System.Windows.Forms.Button();
			this.SuspendLayout();
			// 
			// ctrlExplanation
			// 
			this.ctrlExplanation.Dock = System.Windows.Forms.DockStyle.Top;
			this.ctrlExplanation.Location = new System.Drawing.Point(0, 0);
			this.ctrlExplanation.Name = "ctrlExplanation";
			this.ctrlExplanation.Size = new System.Drawing.Size(496, 80);
			this.ctrlExplanation.TabIndex = 0;
			this.ctrlExplanation.Text = @"An ""open adapter"" is a NDIS miniport driver (that represents a NIC card of your system) to which a ""protocol driver"" (such as TCP/IP) has requested to bind itself to. You can choose from the tree control below which adapter/protocol exchange of packets you want to intercept and monitor. The first time this dialog is opened no adapter is selected. This means that no packet will be captured until you double click on one or more open adapters in the list below. NOTE: select ""TCPIP_WANARP"" for WAN drivers (such as the ones controlling ADSL modems, for example).";
			// 
			// ctrlTree
			// 
			this.ctrlTree.Anchor = ((System.Windows.Forms.AnchorStyles)((((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Bottom) 
				| System.Windows.Forms.AnchorStyles.Left) 
				| System.Windows.Forms.AnchorStyles.Right)));
			this.ctrlTree.CheckBoxes = true;
			this.ctrlTree.FullRowSelect = true;
			this.ctrlTree.ImageList = this.ctrlTreeImages;
			this.ctrlTree.Location = new System.Drawing.Point(0, 80);
			this.ctrlTree.Name = "ctrlTree";
			this.ctrlTree.Size = new System.Drawing.Size(496, 248);
			this.ctrlTree.TabIndex = 1;
			this.ctrlTree.KeyDown += new System.Windows.Forms.KeyEventHandler(this.ctrlTree_KeyDown);
			this.ctrlTree.MouseDown += new System.Windows.Forms.MouseEventHandler(this.ctrlTree_MouseDown);
			this.ctrlTree.MouseUp += new System.Windows.Forms.MouseEventHandler(this.ctrlTree_MouseUp);
			this.ctrlTree.DoubleClick += new System.EventHandler(this.ctrlTree_DoubleClick);
			this.ctrlTree.BeforeCollapse += new System.Windows.Forms.TreeViewCancelEventHandler(this.ctrlTree_BeforeCollapse);
			// 
			// ctrlTreeImages
			// 
			this.ctrlTreeImages.ImageSize = new System.Drawing.Size(16, 16);
			this.ctrlTreeImages.ImageStream = ((System.Windows.Forms.ImageListStreamer)(resources.GetObject("ctrlTreeImages.ImageStream")));
			this.ctrlTreeImages.TransparentColor = System.Drawing.Color.Transparent;
			// 
			// ctrlOK
			// 
			this.ctrlOK.Anchor = ((System.Windows.Forms.AnchorStyles)((System.Windows.Forms.AnchorStyles.Bottom | System.Windows.Forms.AnchorStyles.Right)));
			this.ctrlOK.Location = new System.Drawing.Point(416, 336);
			this.ctrlOK.Name = "ctrlOK";
			this.ctrlOK.TabIndex = 2;
			this.ctrlOK.Text = "Accept";
			this.ctrlOK.Click += new System.EventHandler(this.ctrlOK_Click);
			// 
			// ctrlCancel
			// 
			this.ctrlCancel.Anchor = ((System.Windows.Forms.AnchorStyles)((System.Windows.Forms.AnchorStyles.Bottom | System.Windows.Forms.AnchorStyles.Left)));
			this.ctrlCancel.Location = new System.Drawing.Point(8, 336);
			this.ctrlCancel.Name = "ctrlCancel";
			this.ctrlCancel.TabIndex = 3;
			this.ctrlCancel.Text = "Cancel";
			this.ctrlCancel.Click += new System.EventHandler(this.ctrlCancel_Click);
			// 
			// OpenAdapters
			// 
			this.AutoScaleBaseSize = new System.Drawing.Size(5, 13);
			this.ClientSize = new System.Drawing.Size(496, 368);
			this.Controls.Add(this.ctrlCancel);
			this.Controls.Add(this.ctrlOK);
			this.Controls.Add(this.ctrlTree);
			this.Controls.Add(this.ctrlExplanation);
			this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.SizableToolWindow;
			this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon")));
			this.MaximizeBox = false;
			this.MinimizeBox = false;
			this.Name = "OpenAdapters";
			this.StartPosition = System.Windows.Forms.FormStartPosition.CenterScreen;
			this.Text = "Open Adapters";
			this.MouseUp += new System.Windows.Forms.MouseEventHandler(this.ctrlTree_MouseUp);
			this.ResumeLayout(false);

		}
		#endregion

		private void ctrlCancel_Click(object sender, System.EventArgs e)
		{
			Close ();
		}

		//
		// # data. #
		//

		public UInt32[]										_input = null;
		public UInt32[]										_retval = null;

		protected NdisHookStubs.NT_PROTOCOL_LIST			_protList = null;

		//
		// # methods. #
		//

		public void SetProtList( NdisHookStubs.NT_PROTOCOL_LIST protList, UInt32[] input )
		{
			this._protList = protList;
			this._input = input;

			// populate the tree view.

			TreeNode		s = null;

			foreach( NdisHookStubs.NT_PROTOCOL ntProt in _protList._protocols )
			{
				TreeNode		n = null;

				// add the open adapters.

				bool			state = true;

				ArrayList		list = new ArrayList ();

				foreach( NdisHookStubs.NT_OPEN_ADAPTER ntOa in _protList._adapters )
					if ( ntOa._dwProtocolOrd == ntProt._dwOrdinal )
					{
						n = new TreeNode( ntOa.adapterName, 0, 0 );
						n.Tag = ntOa;

						if ( this._input != null )
							foreach( UInt32 id in this._input )
								if ( id == ntOa._dwOrdinal )
								{
									n.Checked = true;
									break;
								}

						if ( n.Checked == false )
							state = false;

						list.Add( n );
					}

				TreeNode[]			children = new TreeNode[ list.Count ];
				for( int x=0; x<list.Count; x++ )
					children[ x ] = (TreeNode) list[ x ];

				if ( list.Count == 0 )
					state = false;

				// add the protocol.

				n = new TreeNode( ntProt._szName, 1, 1, children );
				n.Tag = ntProt;
				n.Checked = state;
				ctrlTree.Nodes.Add( n );

				if ( s == null )
					s = n;
			}

			ctrlTree.ExpandAll ();
			if ( s != null )
				ctrlTree.SelectedNode = s;
		}

		protected void EnsureCheckedConsistency ()
		{
			// manage the checked state change.

			TreeNode		sel = ctrlTree.SelectedNode;
			if ( sel != null )
			{
				if ( sel.Tag is NdisHookStubs.NT_PROTOCOL )
				{
					foreach( TreeNode tn in sel.Nodes )
						tn.Checked = sel.Checked;
				}
				else if ( sel.Tag is NdisHookStubs.NT_OPEN_ADAPTER )
				{
					bool			state = true;
					
					TreeNode		par = sel.Parent;
					foreach( TreeNode tn in par.Nodes )
						if ( tn.Checked == false )
						{
							state = false;
							break;
						}

					par.Checked = state;
				}
			}

			// return.

			return;
		}

		private void ctrlTree_DoubleClick(object sender, System.EventArgs e)
		{
			TreeNode		sel = ctrlTree.SelectedNode;
			if ( sel != null )
			{
				sel.Checked = ! sel.Checked;
				EnsureCheckedConsistency ();
			}
		}

		private void ctrlTree_BeforeCollapse(object sender, System.Windows.Forms.TreeViewCancelEventArgs e)
		{
			e.Cancel = true;
		}

		private void ctrlTree_KeyDown(object sender, System.Windows.Forms.KeyEventArgs e)
		{
			if ( e.KeyCode == Keys.Space )
			{
				ctrlTree_DoubleClick( null, null );
				e.Handled = true;
			}
		}

		private void ctrlTree_MouseDown(object sender, System.Windows.Forms.MouseEventArgs e)
		{
			TreeNode		sel = ctrlTree.GetNodeAt( e.X, e.Y );
			if ( sel != null )
			{
				ctrlTree.SelectedNode = sel;
				this.Capture = true;
			}
		}

		private void ctrlTree_MouseUp(object sender, System.Windows.Forms.MouseEventArgs e)
		{
			EnsureCheckedConsistency ();
			this.Capture = false;
		}

		private void ctrlOK_Click(object sender, System.EventArgs e)
		{
			// compose the open adapters vector.

			ArrayList		list = new ArrayList ();

			foreach( TreeNode par in ctrlTree.Nodes )
				foreach( TreeNode oa in par.Nodes )
					if ( oa.Checked && oa.Tag != null && oa.Tag is NdisHookStubs.NT_OPEN_ADAPTER )
						list.Add( oa.Tag );

			UInt32[]		vector = new UInt32[ list.Count ];
			int				index = 0;
			foreach( NdisHookStubs.NT_OPEN_ADAPTER oa in list )
				vector[ index ++ ] = oa._dwOrdinal;

			_retval = vector;

			// close.

			Close ();
			return;
		}
	}
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


Written By
Web Developer
Italy Italy
Vito is a former videogame programmer. Now, Vito is the founder and CEO of VPC Technologies, a company that specializes in online services. VPC Technologies also provides consulting, developing and training services to several italian companies and government agencies in the field of kernel, component, enterprise and tridimensional software, for the Microsoft Windows platform.

Vito has attended as a speaker several italian conferences and events on development and security, such as the Microsoft Security Roadshow 2006.

Vito is the man behind GoToTerminal, a secure, reliable and innovative web technology to control remote Microsoft Windows, Telnet and VNC servers over the internet. He is also the author of BugChecker, an independent research project to create the only clone of SoftICE to date, NDIS Monitor, MapGen and Image Downloader.

For more information, you can visit Vito Plantamura's technical website at www.VitoPlantamura.com.

Comments and Discussions