Main Page Modules Data Structures File List Data Fields Globals Related Pages

# dump.c File Reference

`#include <stdarg.h>`
`#include <ntddk.h>`
`#include <ntiologc.h>`
`#include <ndis.h>`
`#include "debug.h"`
`#include "packet.h"`
`#include "win_bpf.h"`

Go to the source code of this file.

## Functions
NTSTATUS | NPF_OpenDumpFile (POPEN_INSTANCE Open, PUNICODE_STRING fileName, BOOLEAN Append)
| Creates the file that will receive the packets when the driver is in dump mode.
NTSTATUS | NPF_StartDump (POPEN_INSTANCE Open)
| Starts dump to file.
VOID | NPF_DumpThread (POPEN_INSTANCE Open)
NTSTATUS | NPF_SaveCurrentBuffer (POPEN_INSTANCE Open)
| Saves the content of the packet buffer to the file associated with current instance.
NTSTATUS | NPF_CloseDumpFile (POPEN_INSTANCE Open)
| Closes the dump file associated with an instance of the driver.
NTSTATUS | PacketDumpCompletion (PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID Context)
VOID | NPF_WriteDumpFile (PFILE_OBJECT FileObject, PLARGE_INTEGER Offset, ULONG Length, PMDL Mdl, PIO_STATUS_BLOCK IoStatusBlock)
| Writes a block of packets on the dump file.

## Function Documentation

NTSTATUS NPF_CloseDumpFile | ( | POPEN_INSTANCE | Open | ) |

  | Closes the dump file associated with an instance of the driver. Parameters:
  Open | The NPF instance that closes the file.
Returns: The status of the operation. See ntstatus.h in the DDK. Definition at line 459 of file dump.c. References _OPEN_INSTANCE::DumpFileHandle, _OPEN_INSTANCE::DumpFileName, _OPEN_INSTANCE::DumpFileObject, _OPEN_INSTANCE::DumpOffset, NPF_OpenDumpFile(), and NPF_SaveCurrentBuffer(). Referenced by NPF_Close(), NPF_IoControl(), and NPF_UnbindAdapter().

VOID NPF_DumpThread | ( | POPEN_INSTANCE | Open | ) |

| Definition at line 263 of file dump.c. References _OPEN_INSTANCE::DumpEvent, _OPEN_INSTANCE::DumpLimitReached, _OPEN_INSTANCE::DumpOffset, NPF_SaveCurrentBuffer(), and _OPEN_INSTANCE::Size.

NTSTATUS NPF_OpenDumpFile | ( | POPEN_INSTANCE | Open,
|  | PUNICODE_STRING | fileName,
|  | BOOLEAN | append
| ) |

  | Creates the file that will receive the packets when the driver is in dump mode. Parameters:
  Open | The NPF instance that opens the file.
  fileName | Pointer to a UNICODE string containing the name of the file.
  append | Boolean value that specifies if the data must be appended to the file.
Returns: The status of the operation. See ntstatus.h in the DDK. Definition at line 34 of file dump.c. References _OPEN_INSTANCE::DumpFileHandle, and _OPEN_INSTANCE::DumpFileObject. Referenced by NPF_CloseDumpFile(), and NPF_IoControl().

NTSTATUS NPF_SaveCurrentBuffer | ( | POPEN_INSTANCE | Open | ) |

  | Saves the content of the packet buffer to the file associated with current instance. Parameters:
  Open | The NPF instance that creates the thread.
Used by NPF_DumpThread() and NPF_CloseDumpFile(). Definition at line 301 of file dump.c. References _OPEN_INSTANCE::DumpFileObject, _OPEN_INSTANCE::DumpLimitReached, _OPEN_INSTANCE::DumpOffset, _OPEN_INSTANCE::MaxDumpBytes, NPF_WriteDumpFile(), and _OPEN_INSTANCE::ReadEvent. Referenced by NPF_CloseDumpFile(), and NPF_DumpThread().

NTSTATUS NPF_StartDump | ( | POPEN_INSTANCE | Open | ) |

  | Starts dump to file. Parameters:
  Open | The NPF instance that opens the file.
Returns: The status of the operation. See ntstatus.h in the DDK. This function performs two operations. First, it writes the libpcap header at the beginning of the file. Second, it starts the thread that asynchronously dumps the network data to the file. Definition at line 142 of file dump.c. References _OPEN_INSTANCE::DumpFileHandle, _OPEN_INSTANCE::DumpFileObject, _OPEN_INSTANCE::DumpOffset, _OPEN_INSTANCE::DumpThreadHandle, _OPEN_INSTANCE::DumpThreadObject, packet_file_header::linktype, packet_file_header::magic, _OPEN_INSTANCE::Medium, PCAP_VERSION_MAJOR, PCAP_VERSION_MINOR, packet_file_header::sigfigs, packet_file_header::snaplen, TCPDUMP_MAGIC, packet_file_header::thiszone, packet_file_header::version_major, and packet_file_header::version_minor. Referenced by NPF_IoControl().

VOID NPF_WriteDumpFile | ( | PFILE_OBJECT | FileObject,
|  | PLARGE_INTEGER | Offset,
|  | ULONG | Length,
|  | PMDL | Mdl,
|  | PIO_STATUS_BLOCK | IoStatusBlock
| ) |

  | Writes a block of packets on the dump file. Parameters:
  FileObject | The file object that will receive the packets.
  Offset | The offset in the file where the packets will be put.
  Length | The amount of bytes to write.
  Mdl | MDL mapping the memory buffer that will be written to disk.
  IoStatusBlock | Used by the function to return the status of the operation.
Returns: The status of the operation. See ntstatus.h in the DDK. NPF_WriteDumpFile addresses directly the file system, creating a custom IRP and using it to send a portion of the NPF circular buffer to disk. This function is used by NPF_DumpThread(). Definition at line 520 of file dump.c. Referenced by NPF_SaveCurrentBuffer().

NTSTATUS PacketDumpCompletion | ( | PDEVICE_OBJECT | DeviceObject,
|  | PIRP | Irp,
|  | PVOID | Context
| ) | `[static]`

| Definition at line 504 of file dump.c.

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.