.386
.model flat, stdcall
;                                  I N C L U D E   F I L E S
;#########################################################################
include D:\masm32\include\w2k\ntstatus.inc
include D:\masm32\include\w2k\ntddk.inc
include D:\masm32\include\w2k\pfhook.inc
include D:\masm32\include\w2k\ntoskrnl.inc
include D:\masm32\Macros\Strings.mac
includelib D:\NTDDK\libfre\i386\ntdll.lib
includelib D:\NTDDK\libfre\i386\ntoskrnl.lib
;					P R O T O
;##########################################################################
set_hook PROTO  :PacketFilterExtensionPtr 
;					 D A T A
;##########################################################################
.data
CCOUNTED_UNICODE_STRING "\\Device\\IPFILTERDRIVER" ,drvsmbl,4
ipfilter_name UNICODE_STRING <>
hook_nfo PF_SET_EXTENSION_HOOK_INFO <>
status NTSTATUS ?
devobj PDEVICE_OBJECT ?
isb IO_STATUS_BLOCK <>
fileobj PFILE_OBJECT NULL 
myirp PIRP NULL
;                                        C O D E
;############################################################################
.code
;                                       DriverEntry
;############################################################################
DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
	mov eax,offset hookproc
	invoke set_hook, eax
	.if eax != STATUS_SUCCESS
        	ret
        .endif
        mov eax, pDriverObject
        assume eax:PTR DRIVER_OBJECT
        mov [eax].DriverUnload,offset Unload
        assume eax:nothing
        mov eax,STATUS_SUCCESS
	ret
DriverEntry endp
;			        Windows 2000 hook (built in)
;###############################################################################
Unload proc p1DriverObject:PDRIVER_OBJECT
	invoke set_hook,NULL
	ret
Unload endp
;###############################################################################
set_hook proc hook_fn:PacketFilterExtensionPtr 

		invoke IoGetDeviceObjectPointer,addr drvsmbl,STANDARD_RIGHTS_ALL,addr fileobj,
            						addr devobj

	mov status,eax   
        .if eax != STATUS_SUCCESS
        	jmp exit
        .endif

        mov eax,hook_fn
        mov hook_nfo.ExtensionPointer,eax
      
        invoke IoBuildDeviceIoControlRequest,IOCTL_PF_SET_EXTENSION_POINTER(),devobj, addr hook_nfo,\
        				sizeof hook_nfo, NULL, 0, FALSE, NULL,addr isb

	mov myirp,eax

        .if eax == NULL
        	mov status ,STATUS_INSUFFICIENT_RESOURCES
        	jmp exit
        .endif

        invoke IoCallDriver,devobj,myirp

        mov myirp,NULL
        mov eax,STATUS_SUCCESS
        ret
exit:

	.if fileobj!=NULL
		invoke ObDereferenceObject,fileobj
	.endif

	mov eax,status
	ret
	
set_hook endp
;###############################################################################
hookproc proc PacketHeader:DWORD, Packet:DWORD, PacketLength:WORD,
        RecvInterfaceIndex:WORD,SendInterfaceIndex:WORD,RecvLinkNextHop:DWORD,
        SendLinkNextHop:DWORD
        
       	mov eax,PF_DROP
	ret
hookproc endp

end DriverEntry
