I have a specific driver(a firewall driver) which i managed to load with delphi but i dont know how to call his function inside my program. The specification for this functions on driver are like folows : Firewall functions can be called with DeviceIoControl (DDoSflt) IoControl codes (needed for DeviceIoControl) are as following:
0x2220c0 = IOCTL_START
Input: none
Output: none
After loading the driver, call this function to install firewall hook.
0x2220c4 = IOCTL_STOP
Input: none
Output: none
Call this function to disable the firewall without unloading it.
0x2220c8 = IOCTL_DDOSADDIP
Input: a DWORD containing an IP address
Output: none
This function notifies the firewall that a DDoS attack is in progress and adds an IP to DDoS filter. Until IOCTL_DDOSSTOP is called, all the traffic from IPs that are in DDoS filter will be filtered.
0x2220cc = IOCTL_DDOSSTOP
Input: none
Output: none
This function notifies the firewall that DDoS attack was stopped, the function will delete the DDoS filter.
0x2220d0 = IOCTL_BAN0
Input: two DWORDs containing an IP range
Output: none
This function sets a ban on an IP range.
0x2220d4 = IOCTL_GETFLT
Input: none
Output: DWORD
This function returns the number of filtered TCP/SYN packets that were sent from IPs found in DDoS filter. 2. Structures used by firewall
2.1. FirewallParametersInfo
typedef struct _FirewallParametersInfo{
WORD pcapFlags; // bit 0 = WinPCap is enabled, bit 1 = detection of adapters was completed (this WORD is not used by version 1.03 of DDoSflt)
WORD pcapAdapters; // mask of enabled / disabled adapters used by WinPCap procedures (this WORD is not used by version 1.03 of DDoSflt)
DWORD pcapTimer; // timeout for capturing packets using WinPCap procedures (not used by version 1.03 of DDoSflt)
BYTE pcapSyn; // maximum number of TCP/SYN packets per second allowed from one IP
BYTE pcapUdp; // maximum number of UDP packets per second allowed from one IP
BYTE pcapIcmp; // maximum number of ICMP packets per second allowed from one IP
BYTE firewallFlags; // bit 0 = firewall is registered
// bit 1 = firewall is started
// bit 2 = maximum SYN/second on hub's registered ports will be checked
// bit 3 = maximum SYN/second on unregistered ports will be checked
// bit 4 = ICMP traffic will be blocked
// bit 5 = TCP/RST packets will not be sent (will be filtered)
// bit 6 = if flood is detected, the application will call the firewall to set a _ban0_ (not used by firewall)
// bit 7 = if flood is detected, a notification message will be sent in opchat (not used by firewall)
WORD hubSyn; // maximum SYN rate allowed for one of registered hub's ports
WORD otherSyn; // maximum SYN rate allowed for non-registered ports
} FirewallParametersInfo;
2.2. port_info
typedef struct _port_info{
WORD port; // port value in network byte order
int synRate; // maximum number of TCP/SYN packets per second allowed from all users
} port_info;
This is ...