关于windows xp sp2/sp3 中tcpip.sys对于Raw socket的限制

WINDOWS XP SP2修改了TCPIP.SYS,增加了对于RAW SOCKET的发送和伪造源地的限制，详情如下 :

1) 不能通过raw socket发送TCP报文。做此尝试时会得到10004号错误。

2) 不能通过raw socket发送伪造源IP的UDP报文。

3) 不能通过raw socket发送IP碎片。做此尝试时会得到10004号错误。

不知微软在哪次对2000 SP4的修补中实现了类似上述第三条的限制，只是要宽松一些:

3) 不能通过raw socket发送全部IP碎片，只有第一个碎片可被发送出去。试图发送
后续碎片时会得到10004号错误。

来自微软的说明：

//What new functionality is added to this feature in Windows XP Service Pack 2?
//Restricted traffic over raw sockets
//Detailed description
A very small number of Windows applications make use of raw IP sockets, which provide an industry-standard way for applications to create TCP/IP packets with fewer integrity and security checks by the TCP/IP stack. The Windows implementation of TCP/IP still supports receiving traffic on raw IP sockets. However, the ability to send traffic over raw sockets has been restricted in two ways:
//
//TCP data cannot be sent over raw sockets.
//
//UDP datagrams with invalid source addresses cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped.
//
//Why is this change important? What threats does it help mitigate?
//
//This change limits the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets, which are TCP/IP packets with a forged source IP address.
//

这个限制是能过一些判断和跳转实现的，跳转的地方如下:

汇编代码来自对于WINDOWS XP SP2的 反汇编，这段代码使RAW SOCKET的SENTO失败:

.text:00034007 loc_34007: ; CODE XREF: IPTransmit(x,x,x,x,x,x,x,x,x,x)+213C4j
.text:00034007 8B 45 B4 mov eax, [ebp+var_4C]
.text:0003400A 89 50 0C mov [eax+0Ch], edx
.text:0003400D 8B 45 B4 mov eax, [ebp+var_4C]
.text:00034010 88 58 1C mov [eax+1Ch], bl
.text:00034013 8B 4D AC mov ecx, [ebp+var_54]
.text:00034016 8A 41 09 mov al, [ecx+9] ; <---开始判断类型

.text:00034019 3C 06 cmp al, 6
.text:0003401B 0F 84 A9 14 00 00 jz pos_to_drop_skip_packet <--这里改为jmp 0003405D 即可绕过这个限制.
.text:00034021 3C 04 cmp al, 4
.text:00034023 0F 84 A1 14 00 00 jz pos_to_drop_skip_packet
.text:00034029 3C 29 cmp al, 29h
.text:0003402B 0F 84 99 14 00 00 jz pos_to_drop_skip_packet
.text:00034031 FF 71 0C push dword ptr [ecx+0Ch]
.text:00034034 E8 D6 CD FD FF call _GetAddrType@4 ; GetAddrType(x)
.text:00034039 84 C0 test al, al
.text:0003403B 74 20 jz short loc_3405D ; <---不检查，直接执行
.text:0003403D 8B 45 AC mov eax, [ebp+var_54]
.text:00034040 FF 70 10 push dword ptr [eax+10h]
.text:00034043 E8 C7 CD FD FF call _GetAddrType@4 ; GetAddrType(x)
.text:00034048 3C 03 cmp al, 3
.text:0003404A 0F 85 7A 14 00 00 jnz pos_to_drop_skip_packet
.text:00034050 8B 45 8C mov eax, [ebp+var_74]
.text:00034053 F6 40 0C 20 test byte ptr [eax+0Ch], 20h
.text:00034057 0F 84 6D 14 00 00 jz pos_to_drop_skip_packet
.text:0003405D
.text:0003405D loc_3405D: ; CODE XREF: IPTransmit(x,x,x,x,x,x,x,x,x,x)+213FDj
.text:0003405D 8B 45 AC mov eax, [ebp+var_54] ; <---不检查，直接执行
.text:00034060 0F B6 00 movzx eax, byte ptr [eax]
.text:00034063 83 E0 0F and eax, 0Fh
.text:00034066 C1 E0 02 shl eax, 2
.text:00034069 8B F0 mov esi, eax
.text:0003406B 83 FE 14 cmp esi, 14h
.text:0003406E 89 B5 64 FF FF FF mov [ebp+var_9C], esi
.text:00034074 0F 82 50 14 00 00 jb pos_to_drop_skip_packet
.text:0003407A 76 67 jbe short loc_340E3
.text:0003407C 6A 10 push 10h ; Priority
.text:0003407E 8D 46 EC lea eax, [esi-14h]
.text:00034081 68 54 43 69 77 push 77694354h ; Tag
.text:00034086 33 FF xor edi, edi
.text:00034088 50 push eax ; NumberOfBytes
.text:00034089 47 inc edi
.text:0003408A 53 push ebx ; PoolType
.text:0003408B 89 7D 80 mov [ebp+var_80], edi
.text:0003408E 89 45 88 mov [ebp+Length], eax
.text:00034091 FF 15 AC F2 04 00 call ds:__imp__ExAllocatePoolWithTagPriority@16 ; ExAllocatePoolWithTagPriority(x,x,x,x)
.text:00034097 3B C3 cmp eax, ebx
.text:00034099 89 45 A8 mov [ebp+VirtualAddress], eax
.text:0003409C 75 0C jnz short loc_340AA
.text:0003409E BE FE 2A 00 00 mov esi, 2AFEh
.text:000340A3 56 push esi
.text:000340A4 57 push edi
.text:000340A5 E9 3C 14 00 00 jmp loc_354E6

另外如果你要发送伪造的源地址，你需要关闭WINDOWS XP的个人防火墙方可.

顺便做些对比: window 2003 sp1 对应代码如下:

text:0003A088 F7 D0 not eax
.text:0003A08A 66 89 41 0A mov [ecx+0Ah], ax
.text:0003A08E 38 1D B0 CC 08 00 cmp _RunningOnWorkstation, bl <---如果是工作站上运行的话也会有限制,不过你是server的话就没有问题....试过了，确实没有问题
.text:0003A094 74 46 jz short loc_3A0DC
.text:0003A096 8B 4D AC mov ecx, [ebp+var_54]
.text:0003A099 8A 41 09 mov al, [ecx+9]
.text:0003A09C 3C 06 cmp al, 6
.text:0003A09E 74 2C jz short loc_3A0CC
.text:0003A0A0 3C 04 cmp al, 4
.text:0003A0A2 74 28 jz short loc_3A0CC
.text:0003A0A4 3C 29 cmp al, 29h
.text:0003A0A6 74 24 jz short loc_3A0CC
.text:0003A0A8 FF 71 0C push dword ptr [ecx+0Ch]
.text:0003A0AB E8 0B A5 FE FF call _GetAddrType@4 ; GetAddrType(x)
.text:0003A0B0 84 C0 test al, al
.text:0003A0B2 74 28 jz short loc_3A0DC
.text:0003A0B4 8B 45 AC mov eax, [ebp+var_54]
.text:0003A0B7 FF 70 10 push dword ptr [eax+10h]
.text:0003A0BA E8 FC A4 FE FF call _GetAddrType@4 ; GetAddrType(x)
.text:0003A0BF 3C 03 cmp al, 3
.text:0003A0C1 75 09 jnz short loc_3A0CC
.text:0003A0C3 8B 45 84 mov eax, [ebp+var_7D+1]
.text:0003A0C6 F6 40 0C 20 test byte ptr [eax+0Ch], 20h
.text:0003A0CA 75 10 jnz short loc_3A0DC
.text:0003A0CC
.text:0003A0CC loc_3A0CC: ; CODE XREF: _IPTransmit(x,x,x,x,x,x,x,x,x,x)+13E69j
.text:0003A0CC ; _IPTransmit(x,x,x,x,x,x,x,x,x,x)+13E6Dj ...
.text:0003A0CC FF 05 AC 04 06 00 inc dword_604AC
.text:0003A0D2 BE 2A 2B 00 00 mov esi, 2B2Ah
.text:0003A0D7 E9 C6 00 00 00 jmp loc_3A1A2
.text:0003A0DC ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:0003A0DC
.text:0003A0DC loc_3A0DC: ; CODE XREF: _IPTransmit(x,x,x,x,x,x,x,x,x,x)+13E5Fj
.text:0003A0DC ; _IPTransmit(x,x,x,x,x,x,x,x,x,x)+13E7Dj ...
.text:0003A0DC 8B 45 AC mov eax, [ebp+var_54]
.text:0003A0DF 66 8B 95 36 FF FF FF mov dx, [ebp-0CAh]
.text:0003A0E6 33 C9 xor ecx, ecx
.text:0003A0E8 8A 08 mov cl, [eax]
.text:0003A0EA 66 89 50 02 mov [eax+2], dx
.text:0003A0EE 8B 45 84 mov eax, [ebp+var_7D+1]
.text:0003A0F1 8A 40 0A mov al, [eax+0Ah]
.text:0003A0F4 8B 55 AC mov edx, [ebp+var_54]
.text:0003A0F7 88 42 01 mov [edx+1], al
.text:0003A0FA 8B 45 AC mov eax, [ebp+var_54]
.text:0003A0FD 66 89 58 0A mov [eax+0Ah], bx
.text:0003A101 83 E1 0F and ecx, 0Fh
.text:0003A104 8B C1 mov eax, ecx
.text:0003A106 C1 E0 02 shl eax, 2
.text:0003A109 50 push eax
.text:0003A10A FF 75 AC push [ebp+var_54]
.text:0003A10D 53 push ebx
.text:0003A10E FF 15 38 01 06 00 call _tcpxsum_routine ; tcpxsum(x,x,x)
.text:0003A114 8B 4D AC mov ecx, [ebp+var_54]
.text:0003A117 8B 75 8C mov esi, [ebp+var_74]
.text:0003A11A F7 D0 not eax
.text:0003A11C 66 89 41 0A mov [ecx+0Ah], ax
.text:0003A120 E9 D8 C4 FE FF jmp loc_265FD
.text:0003A125 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:0003A125
.text:0003A125 loc_3A125: ; CODE XREF: _IPTransmit(x,x,x,x,x,x,x,x,x,x)+13FE2j
.text:0003A125 33 F6 xor esi, esi
.text:0003A127
.text:0003A127 loc_3A127: ; CODE XREF: _IPTransmit(x,x,x,x,x,x,x,x,x,x)+13FEDj
.text:0003A127 56 push esi ; int
.text:0003A128 6A 01 push 1 ; P
.text:0003A12A FF 75 B4 push [ebp+var_4C] ; BytesCopied
.text:0003A12D E8 EC B8 FE FF call _FreeIPPacket@12 ; FreeIPPacket(x,x,x)
.text:0003A132 39 5D B0 cmp [ebp+var_50], ebx
.text:0003A135 0F 84 F4 0C FE FF jz loc_1AE2F
.text:0003A13B FF 75 B0 push [ebp+var_50]
.text:0003A13E E9 85 03 00 00 jmp loc_3A4C8

WIN2003 ENT原版:

text:00023BB0 loc_23BB0: ; CODE XREF: SendRSTFromTCB(x,x)+42A7j
.text:00023BB0 mov eax, [ebp+4]
.text:00023BB3 mov [eax+0Ch], edx
.text:00023BB6 mov eax, [ebp+4]
.text:00023BB9 mov [eax+1Ch], bl
.text:00023BBC mov eax, [ebp+Packet]
.text:00023BBF movzx eax, byte ptr [eax]
.text:00023BC2 and eax, 0Fh
.text:00023BC5 shl eax, 2
.text:00023BC8 cmp eax, esi
.text:00023BCA mov [ebp+arg_54], eax
.text:00023BCD jb loc_2F98C
.text:00023BD3 ja loc_23A81
.text:00023BD9
.text:00023BD9 loc_23BD9: ; CODE XREF: SendRSTFromTCB(x,x)-7C01j
.text:00023BD9 mov eax, [ebp+arg_58]
.text:00023BDC mov eax, [eax+14h]
.text:00023BDF mov esi, [ebp+arg_54]
.text:00023BE2 push 10h ; Priority
.text:00023BE4 push [ebp+var_4C] ; int
.text:00023BE7 add eax, esi
.text:00023BE9 sub [ebp+arg_5C], eax
.text:00023BEC call _TcpipBufferVirtualAddress@8 ; TcpipBufferVirtualAddress(x,x)
.text:00023BF1 cmp eax, ebx
.text:00023BF3 jz loc_2F9DB
.text:00023BF9 mov ecx, [ebp+var_4C]
.text:00023BFC mov edi, [ecx]
.text:00023BFE mov ecx, [ecx+14h]
.text:00023C01 sub ecx, esi
.text:00023C03 jz loc_2F9CB
.text:00023C09 push ecx ; Length
.text:00023C0A add eax, esi
.text:00023C0C push eax ; VirtualAddress
.text:00023C0D push _BufferPool ; PoolHandle
.text:00023C13 lea eax, [ebp+Buffer]
.text:00023C19 push eax ; Buffer
.text:00023C1A lea eax, [ebp+Status]
.text:00023C1D push eax ; Status
.text:00023C1E call ds:__imp__NdisAllocateBuffer@20 ; NdisAllocateBuffer(x,x,x,x,x)
.text:00023C24
.text:00023C24 loc_23C24: ; CODE XREF: SendRSTFromTCB(x,x)+4321j
.text:00023C24 ; SendRSTFromTCB(x,x)+432Dj
.text:00023C24 cmp [ebp+Status], ebx
.text:00023C27 jnz loc_2FA12
.text:00023C2D mov eax, [ebp+MemoryDescriptorList]
.text:00023C30 mov ecx, [ebp+var_4C]
.text:00023C33 mov [eax+1Ch], ecx
.text:00023C36 mov eax, [ebp+Buffer]
.text:00023C3C mov ecx, [ebp+arg_58]
.text:00023C3F mov [ecx], eax
.text:00023C41 mov [eax], edi
.text:00023C43 mov edi, [ebp+Packet]
.text:00023C46 mov [ecx+14h], ebx
.text:00023C49 cmp [edi+4], bx
.text:00023C4D jnz short loc_23C71
.text:00023C4F xor eax, eax
.text:00023C51 inc eax
.text:00023C52 mov ecx, offset _IPIDCacheLine
.text:00023C57 lock xadd [ecx], eax
.text:00023C5B mov [edi+4], ax
.text:00023C5F mov edi, [ebp+Packet]
.text:00023C62 mov ax, [edi+4]
.text:00023C66 mov ch, al
.text:00023C68 mov cl, ah
.text:00023C6A mov [edi+4], cx
.text:00023C6E mov edi, [ebp+Packet]
.text:00023C71
.text:00023C71 loc_23C71: ; CODE XREF: SendRSTFromTCB(x,x)-7A93j
.text:00023C71 mov eax, [ebp+arg_5C]
.text:00023C74 add esi, eax
.text:00023C76 mov ax, si
.text:00023C79 mov esi, [ebp+MemoryDescriptorList]
.text:00023C7C mov ch, al
.text:00023C7E mov cl, ah
.text:00023C80 mov eax, [ebp+arg_68]
.text:00023C83 mov [edi+2], cx
.text:00023C87 mov al, [eax+0Ah]
.text:00023C8A mov ecx, [ebp+Packet]
.text:00023C8D mov [ecx+1], al
.text:00023C90 mov eax, [ebp+Packet]
.text:00023C93 mov [eax+0Ah], bx
.text:00023C97 jmp loc_13544
.text:00023C97 ; END OF FUNCTION CHUNK FOR _SendRSTFromTCB@8
.text:00023C9C ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:00023C9C ; START OF FUNCTION CHUNK FOR _IPTransmit@40
.text:00023C9C
.text:00023C9C loc_23C9C: ; CODE XREF: IPTransmit(x,x,x,x,x,x,x,x,x,x)+5Fj
.text:00023C9C cmp [ebp+50h+arg_C], 0FFFFh
.text:00023CA3 jg loc_2F3EA
.text:00023CA9 jmp loc_1330F
.text:00023CAE ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:00023CAE
.text:00023CAE loc_23CAE: ; CODE XREF: IPTransmit(x,x,x,x,x,x,x,x,x,x)+1B5j
.text:00023CAE mov eax, [ebp+50h+arg_8]
.text:00023CB1 mov esi, [eax]
.text:00023CB3 lea eax, [ebp+50h+var_54]
.text:00023CB6 push eax
.text:00023CB7 push _IpHeaderPool
.text:00023CBD mov [ebp+50h+var_D4], ebx
.text:00023CC3 mov [ebp+50h+var_9C], esi
.text:00023CC6 call _MdpAllocate@8 ; MdpAllocate(x,x)
.text:00023CCB cmp eax, ebx
.text:00023CCD mov [ebp+50h+var_98], eax
.text:00023CD0 jz loc_26B4C
.text:00023CD6 push 10h ; Priority
.text:00023CD8 push esi ; int
.text:00023CD9 call _TcpipBufferVirtualAddress@8 ; TcpipBufferVirtualAddress(x,x)
.text:00023CDE jmp loc_23B63

如果你修改了tcpip.sys，记得也把它的checksum修正一下.