Search code examples
windowsdriverwdkwindows-kernelndis

Why does NdisFSendNetBufferLists only work when called from FilterSendNetBufferLists?

I have got an NDIS Filter Driver (see https://pastebin.com/c5r87NNw) and a userspace application.

I want to send an arbitrary packet with my filter driver (in the function SendData). I can see with a DbgPrint in the function FilterReceiveNetBufferLists that I have received the packet but I can not find the packet in WireShark.

As long as the code from SendData was called or directly pasted in the FilterSendNetBufferLists-function, it worked just fine. But now, as the execution of SendData is triggered by the userspace application, it doesn't work anymore.

Do you have any guess why that might be?

Solution

  • I made it work: The error was in my OriginalNdisFilterHandle. I set it in the function FilterAttach and didn't think that the function gets called multiple times. Because of this the variable had the wrong value.