摘要
提出利用Hook系统核心函数方法来实现软件防火墙 .操作系统在加载NDIS驱动程序时 ,将NDIS协议特征结构表中的API函数映射到内存中 .通过在内存中定位这些API地址 ,按照PE格式将导出表中的函数地址替换成自定义的函数地址 ,在操作系统调用系统自身API函数前 ,先进行自定义函数的处理 。
A new method to implement software firewall based on hooking system kernel functions was brought forward. When operating system uploads NDIS driver, it reflects API functions of NDIS protocol characteristics table into memory. By orienting these API addresses in memory, replacing them in export table by user-defined functions addresses according to PE rule, it can deal with theses user-defined functions before operating system manages its API functions, so filter net packets.
出处
《华中科技大学学报（自然科学版）》
EI
CAS
CSCD
北大核心
2004年第3期83-85,共3页
Journal of Huazhong University of Science and Technology(Natural Science Edition)
基金
国家自然科学基金九五重大项目 (79990 5 80 )
关键词
挂钩技术
网络驱动接口规范
软件防火墙
Hook technology
Network Driver Interface Specification (NDIS)
software firewall
