NDISProtocol Driver for PPP (WinCE 4.2/5.0)

has anybody developed a NDISProtocol Driver for WinCE 4.2/5.0??? I've done
all the proper step to bind to the PPP but yet when I send the packet to PPP
I never receive the call back... I'm thinking there is issue with the way I
bind or do OpenAdapter... is there specific steps I should take? could
somebody point out a guideline??
would appreciate it...

Maxim
Wed Nov 16 11:16:02 CST 2005

In WinCE 4.2, PPP cannot be bound by anybody except the system-supplied
TCP/IP stack. It is implemented as "custom ARP" extension for TCP/IP, not as a
miniport.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"The Amazing" <theamazing@nowhere.com> wrote in message
news:OZk8VCt6FHA.2552@TK2MSFTNGP10.phx.gbl...
> has anybody developed a NDISProtocol Driver for WinCE 4.2/5.0??? I've done
> all the proper step to bind to the PPP but yet when I send the packet to PPP
> I never receive the call back... I'm thinking there is issue with the way I
> bind or do OpenAdapter... is there specific steps I should take? could
> somebody point out a guideline??
> would appreciate it...
>
>

The
Wed Nov 16 11:31:33 CST 2005

hhuuummm... scratching my head:) First thank you for your quick response...

so If I want to intercept calls or let say monitor the activities of PPP/WAN
Adapter then how do I do it??
would something like hooking works??
TA

"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:OdkSpFt6FHA.3752@tk2msftngp13.phx.gbl...
> In WinCE 4.2, PPP cannot be bound by anybody except the
system-supplied
> TCP/IP stack. It is implemented as "custom ARP" extension for TCP/IP, not
as a
> miniport.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
> "The Amazing" <theamazing@nowhere.com> wrote in message
> news:OZk8VCt6FHA.2552@TK2MSFTNGP10.phx.gbl...
> > has anybody developed a NDISProtocol Driver for WinCE 4.2/5.0??? I've
done
> > all the proper step to bind to the PPP but yet when I send the packet to
PPP
> > I never receive the call back... I'm thinking there is issue with the
way I
> > bind or do OpenAdapter... is there specific steps I should take? could
> > somebody point out a guideline??
> > would appreciate it...
> >
> >
>

Maxim
Wed Nov 16 11:42:48 CST 2005

> so If I want to intercept calls or let say monitor the activities of PPP/WAN
> Adapter then how do I do it??
> would something like hooking works??

The only way, provided you will be able to hook the section of the file-in-ROM
DLL.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

The
Wed Nov 16 11:48:03 CST 2005

> hook the section of the file-in-ROM DLL.
How can that be done?? very new to me!!! could you explain abit please?? is
there examples??? Is it even doable??


"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:OMTZmUt6FHA.3684@TK2MSFTNGP12.phx.gbl...
> > so If I want to intercept calls or let say monitor the activities of
PPP/WAN
> > Adapter then how do I do it??
> > would something like hooking works??
> The only way, provided you will be able to hook the section of the
file-in-ROM
DLL.

>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>

ddl
Wed Nov 16 14:30:54 CST 2005

In article <uaVNiXt6FHA.2364@TK2MSFTNGP12.phx.gbl>, theamazing@nowhere.com (The Amazing) writes:
| > hook the section of the file-in-ROM DLL.
| How can that be done?? very new to me!!! could you explain abit please?? is
| there examples??? Is it even doable??

The easiest approach is to re-map the virtual address to a page of RAM where
you have copied the contents of the ROM. At least, that worked for 4.2.

Dan Lanciani
ddl@danlan.*com

The
Wed Nov 16 18:37:10 CST 2005

would you explain how this would help??? so would this work like hooking
mechanism... or this mostly a user-mode approach to access file system from
user mode??
I would appreciate if you could generaly explain a bit about this approch...
"Dan Lanciani" <ddl@danlan.*com> wrote in message
news:1331673@news1.IPSWITCHS.CMM...
> In article <uaVNiXt6FHA.2364@TK2MSFTNGP12.phx.gbl>, theamazing@nowhere.com
(The Amazing) writes:
> | > hook the section of the file-in-ROM DLL.
> | How can that be done?? very new to me!!! could you explain abit please??
is
> | there examples??? Is it even doable??
>
> The easiest approach is to re-map the virtual address to a page of RAM
where
> you have copied the contents of the ROM. At least, that worked for 4.2.
>
> Dan Lanciani
> ddl@danlan.*com

gp
Thu Feb 16 12:09:29 CST 2006

Guys,

I am bit comfused so that means you cannot intercept or modify packets using
NDIS IM driver specifically for PPP is that correct?

thanks

"The Amazing" wrote:

> would you explain how this would help??? so would this work like hooking
> mechanism... or this mostly a user-mode approach to access file system from
> user mode??
> I would appreciate if you could generaly explain a bit about this approch...
> "Dan Lanciani" <ddl@danlan.*com> wrote in message
> news:1331673@news1.IPSWITCHS.CMM...
> > In article <uaVNiXt6FHA.2364@TK2MSFTNGP12.phx.gbl>, theamazing@nowhere.com
> (The Amazing) writes:
> > | > hook the section of the file-in-ROM DLL.
> > | How can that be done?? very new to me!!! could you explain abit please??
> is
> > | there examples??? Is it even doable??
> >
> > The easiest approach is to re-map the virtual address to a page of RAM
> where
> > you have copied the contents of the ROM. At least, that worked for 4.2.
> >
> > Dan Lanciani
> > ddl@danlan.*com
>
>
>

Omar
Sat Feb 25 21:21:12 CST 2006

ppp on CE has a private interface with tcpip (ie: not thru NDIS) therefore
you can't modify the packets with an NDIS IM driver.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Please do not send
email directly to this alias. This alias is for newsgroup purposes only.



"gp" <gp@discussions.microsoft.com> wrote in message
news:8A4BD4A4-893B-4985-8907-014D9C0DB62C@microsoft.com...
> Guys,
>
> I am bit comfused so that means you cannot intercept or modify packets
> using
> NDIS IM driver specifically for PPP is that correct?
>
> thanks
>
> "The Amazing" wrote:
>
>> would you explain how this would help??? so would this work like hooking
>> mechanism... or this mostly a user-mode approach to access file system
>> from
>> user mode??
>> I would appreciate if you could generaly explain a bit about this
>> approch...
>> "Dan Lanciani" <ddl@danlan.*com> wrote in message
>> news:1331673@news1.IPSWITCHS.CMM...
>> > In article <uaVNiXt6FHA.2364@TK2MSFTNGP12.phx.gbl>,
>> > theamazing@nowhere.com
>> (The Amazing) writes:
>> > | > hook the section of the file-in-ROM DLL.
>> > | How can that be done?? very new to me!!! could you explain abit
>> > please??
>> is
>> > | there examples??? Is it even doable??
>> >
>> > The easiest approach is to re-map the virtual address to a page of RAM
>> where
>> > you have copied the contents of the ROM. At least, that worked for
>> > 4.2.
>> >
>> > Dan Lanciani
>> > ddl@danlan.*com
>>
>>
>>

Andy
Mon Feb 27 09:25:02 CST 2006

I don't know if the original poster needs this info (it was asked 3
months ago) but thought I'd add it .....

Is the original query help in monitoring WAN traffic? (e.g. over GPRS
or such like) If thats the case you could insert an IM driver between
ASYNCMAC and PPP and you'll see the packets there.

I don't think the previous post about not being able to modify packets
in an IM is quite true ... unless I've misunderstood the original
question.

Kimo
Mon Feb 27 13:38:24 CST 2006

In PPP IM driver which runs on the top of the AsyncMac driver, you can
monitor the packets (incoming or outgoing). If you do not specify any data
or TCP/UDP header compression for GPRS connection, you can modify packets
you want. But if you specify those options for PPP connection, it is very
hard for you to do this job. Unless you capture all of the PPP options
inside the your IM, you probably can modify any packet you want. However,
you need to decompress the data or header in your IM driver. After you
decompress the data or header, you can modify the packets you want. However,
it take a lot of works which are already done by PPP protocol.

You might consider to modify the packet using LSP driver and that might be a
little bit easier.



"Andy" <bemacdev@yahoo.co.uk> wrote in message
news:1141053902.866594.27430@v46g2000cwv.googlegroups.com...
>I don't know if the original poster needs this info (it was asked 3
> months ago) but thought I'd add it .....
>
> Is the original query help in monitoring WAN traffic? (e.g. over GPRS
> or such like) If thats the case you could insert an IM driver between
> ASYNCMAC and PPP and you'll see the packets there.
>
> I don't think the previous post about not being able to modify packets
> in an IM is quite true ... unless I've misunderstood the original
> question.
>

Maxim
Mon Feb 27 15:10:13 CST 2006

> Is the original query help in monitoring WAN traffic? (e.g. over GPRS
> or such like) If thats the case you could insert an IM driver between
> ASYNCMAC and PPP and you'll see the packets there.

First - between NDISWAN and WANARP, filtering above ASYNCMAC will not work if
the connection is a VPN and not the serial port. Second - impossible on CE.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Maxim
Mon Feb 27 15:11:13 CST 2006

> In PPP IM driver which runs on the top of the AsyncMac driver, you can
> monitor the packets (incoming or outgoing). If you do not specify any data
> or TCP/UDP header compression for GPRS connection, you can modify

Correct. And, on PPTP VPN, such a filter is useless. It will see the encrypted
data with no keys for it.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Andy
Tue Feb 28 03:39:52 CST 2006

Hmmm, I wonder if we're talking at cross purposes here ...

The original question was todo with WinCE. So you're saying it is
impossible to create an NDIS IM driver for (say) PPC2003 (WinCE 4.x)
and get it to insert itself between ASYNCMAC and PPP so you can see the
packets being exchanged between the two?


Maxim S. Shatskih wrote:
> > Is the original query help in monitoring WAN traffic? (e.g. over GPRS
> > or such like) If thats the case you could insert an IM driver between
> > ASYNCMAC and PPP and you'll see the packets there.
>
> First - between NDISWAN and WANARP, filtering above ASYNCMAC will not work if
> the connection is a VPN and not the serial port. Second - impossible on CE.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com

Kimo
Tue Feb 28 12:57:00 CST 2006

Of course, you can implement a NDIS IM on the top of the AsyncMac. However,
you should understand some limitations on this(Plese see my reply).


"Andy" <bemacdev@yahoo.co.uk> wrote in message
news:1141119592.036592.192120@z34g2000cwc.googlegroups.com...
> Hmmm, I wonder if we're talking at cross purposes here ...
>
> The original question was todo with WinCE. So you're saying it is
> impossible to create an NDIS IM driver for (say) PPC2003 (WinCE 4.x)
> and get it to insert itself between ASYNCMAC and PPP so you can see the
> packets being exchanged between the two?
>
>
> Maxim S. Shatskih wrote:
>> > Is the original query help in monitoring WAN traffic? (e.g. over GPRS
>> > or such like) If thats the case you could insert an IM driver between
>> > ASYNCMAC and PPP and you'll see the packets there.
>>
>> First - between NDISWAN and WANARP, filtering above ASYNCMAC will not
>> work if
>> the connection is a VPN and not the serial port. Second - impossible on
>> CE.
>>
>> --
>> Maxim Shatskih, Windows DDK MVP
>> StorageCraft Corporation
>> maxim@storagecraft.com
>> http://www.storagecraft.com
>

Andy
Wed Mar 01 02:45:48 CST 2006

Kimo,

Thanks for your reply and I did see your post earlier.

The reason for my last post was that it was being hinted at that its
impossible to do when infact it is possible. I have created an IM that
intercepts WAN packets. Yes, there are issues with compression etc but
at the end of the day you can intercept and modify basic PPP packets
that are sent up from ASYNCMAC

Andy

Kimo Jolin wrote:
> Of course, you can implement a NDIS IM on the top of the AsyncMac. However,
> you should understand some limitations on this(Plese see my reply).
>
>
> "Andy" <bemacdev@yahoo.co.uk> wrote in message
> news:1141119592.036592.192120@z34g2000cwc.googlegroups.com...
> > Hmmm, I wonder if we're talking at cross purposes here ...
> >
> > The original question was todo with WinCE. So you're saying it is
> > impossible to create an NDIS IM driver for (say) PPC2003 (WinCE 4.x)
> > and get it to insert itself between ASYNCMAC and PPP so you can see the
> > packets being exchanged between the two?
> >
> >
> > Maxim S. Shatskih wrote:
> >> > Is the original query help in monitoring WAN traffic? (e.g. over GPRS
> >> > or such like) If thats the case you could insert an IM driver between
> >> > ASYNCMAC and PPP and you'll see the packets there.
> >>
> >> First - between NDISWAN and WANARP, filtering above ASYNCMAC will not
> >> work if
> >> the connection is a VPN and not the serial port. Second - impossible on
> >> CE.
> >>
> >> --
> >> Maxim Shatskih, Windows DDK MVP
> >> StorageCraft Corporation
> >> maxim@storagecraft.com
> >> http://www.storagecraft.com
> >

Maxim
Wed Mar 01 11:51:20 CST 2006

> impossible to create an NDIS IM driver for (say) PPC2003 (WinCE 4.x)

It is possible.

> and get it to insert itself between ASYNCMAC and PPP so you can see the
> packets being exchanged between the two?

It is possible too, and GPRS will be filtered, but not VPNs. You will also need
to decompress the packet headers and sometimes even the packets themselves in
the filter to examine them.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

oneneno
Tue May 30 07:42:02 CDT 2006


> > impossible to create an NDIS IM driver for (say) PPC2003 (WinCE 4.x)
>
> It is possible.
>
> > and get it to insert itself between ASYNCMAC and PPP so you can see the
> > packets being exchanged between the two?
>
> It is possible too, and GPRS will be filtered, but not VPNs. You will also need
> to decompress the packet headers and sometimes even the packets themselves in
> the filter to examine them.
>


So is it possible for PPC2005 (WinCe 5.0), too ?

bemacdev
Tue May 30 11:14:02 CDT 2006

Yep, it works for that too

Andy

"knopper" wrote:

>
> > > impossible to create an NDIS IM driver for (say) PPC2003 (WinCE 4.x)
> >
> > It is possible.
> >
> > > and get it to insert itself between ASYNCMAC and PPP so you can see the
> > > packets being exchanged between the two?
> >
> > It is possible too, and GPRS will be filtered, but not VPNs. You will also need
> > to decompress the packet headers and sometimes even the packets themselves in
> > the filter to examine them.
> >
>
>
> So is it possible for PPC2005 (WinCe 5.0), too ?

Vijay
Mon Jun 05 17:45:57 CDT 2006

It is possible

Vijay Visana
"knopper" <oneneno@gmx.net> wrote in message
news:811816D2-340C-4E07-80B8-0021F65D3BE7@microsoft.com...
>
>> > impossible to create an NDIS IM driver for (say) PPC2003 (WinCE 4.x)
>>
>> It is possible.
>>
>> > and get it to insert itself between ASYNCMAC and PPP so you can see the
>> > packets being exchanged between the two?
>>
>> It is possible too, and GPRS will be filtered, but not VPNs. You will
>> also need
>> to decompress the packet headers and sometimes even the packets
>> themselves in
>> the filter to examine them.
>>
>
>
> So is it possible for PPC2005 (WinCe 5.0), too ?

oneneno
Mon Jul 03 04:28:01 CDT 2006

Hi Vijay,

So do i need to add something to registry or in IM driver ?
I have tried to change registry, but it don't work.

My IM is based on passthru sample and is working for wireless lan.

thanks !

oneneno
Mon Aug 21 04:21:02 CDT 2006

Hi,

Now my NDIS IM driver can bind Asyncmac on MDAPro (PPC2005) . I have changed
the MediumArray for NdisOpenAdapter. So NdisOpenAdapter returns uiMediumIndex
as NdisMediumWan type and the virtual upper edge asyncmac miniport can
initialize by MiniportInitialize. puiSelectedMediumIndex should bee 3
(NdisMediumWan) and not NdisMedium802_3.
My problem is, i can establish the GPRS connnection any more. I can see
OID_WAN query/set request going through my IM driver during GPRS connection
proccess, but GPRS never connects by ConnectionManner.
Has anyone the same problem ? Do i have something wrong ?