A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #23693  by fsdhook
 Wed Aug 27, 2014 9:44 am
Hi, everyone, I want to achieve most of the socket api in kernel mode.
There are so many stable code of kernel socket base on TDI layer.
But I want to achieve this function on NDIS layer.
Please tell me how to do that, or give me some links about it.

Best regards.
fsdhook
 #23716  by Cr4sh
 Thu Aug 28, 2014 2:28 pm
Sounds like incorrect question. Sockets -- it's a program interface for TCP/IP stack, you can't have it on NDIS layer because NDIS is an interface of lower level.
If under "sockets" you mean possibility of transmitting raw ethernet frames -- check the network/ndis/ndisprot project that can be found in WDK examples.
 #23719  by fsdhook
 Thu Aug 28, 2014 5:21 pm
Cr4sh wrote:Sounds like incorrect question. Sockets -- it's a program interface for TCP/IP stack, you can't have it on NDIS layer because NDIS is an interface of lower level.
If under "sockets" you mean possibility of transmitting raw ethernet frames -- check the network/ndis/ndisprot project that can be found in WDK examples.
I know what you said.
I thought is: Achieve the TCP/IP stack base on NDIS layer before achieve the socket functions.