Hello all
Thax for the suggestions if any.
The work is meant for Windows CE. Some of the questions are generic to
all of Windows.
Ethernet, WAN
=============
Assumptions about NDIS hook filter driver:
a. Ndis Hook driver resides between Tcpip.sys and Ndis.sys (in NT/2K
)
b. Replace NDIS.SYS function pointers(addresses) with new hook
function addresses.
c. So NDIS.SYS calls these new functions and new ones can call the
original functions etc.
1. Under windows CE is this Ndis hook driver possible?
(I guess YES. but usually replacing the NDIS.SYS addresses etc.
might cause system exceptions in CE. doen't it?).
2. If yes, then Ethernet is okay. Meaning, it sits between tcpip and
Ndis
3. But for WAN cases in CE, TCP/IP talks to PPP(No Ethernet emulation
like NT/2K).
PPP is a NDIS protocol driver in CE.
So how do you hook this driver between these 2 protocols drivers?
3. If its not possible, Does a TDI driver type work in WAN case?
Bluetooth
=========
In case of bluetooth, different profiles use different stack paths( at
least in CE )
Examples
1. A Serial port application goes thru RFCOMM to L2CAP
2. PAN NDIS driver goes to L2CAP directly. (I think TCP/IP talks to
PNDIS).
3. LAN access profile goes thru TCP/UDP --> IP --> PPP ---> RFCOMM
---> L2CAP.
How would one control bluetooth activities?
a. Since more than 90% of the data flow goes thru L2CAP(rare cases
hit HCI directly), Is there a way to develop a driver just above
L2CAP and analyze the packets? Of course this may not be the useful
place for encrypted packets, but we can control some.
b. HCI Stack Extension Layer could be a solution?. If we develop
one of this over L2CAP, could we selectively block the traffic?
c. Any kind of hooking filter or TDI driver is helpful for this
traffic?
Thanks for the help and suggestions.
Ganesan