基于NDIS中间层驱动的隐蔽通信研究与实现  

Research and Implementation of the Covert Communication based on the NIDS Middle Layer Driver

作　　者：鄢明[1] 陆幼骊[1] 解海涛 

机构地区：[1]海军指挥学院浦口分院,江苏南京210000

出　　处：《通信技术》2014年第6期679-685,共7页Communications Technology

摘　　要：传统计算机隐蔽通信方式采用的HOOK技术,不能从根本上解决通信数据包被防火墙截获丢弃的问题。NDIS中间层驱动技术常用于防火墙和抓包软件,通过分析NDIS中间层驱动技术原理,提出一种新的可应用于Windows防火墙穿透的隐蔽通信方法,并详细介绍了隐蔽通信方式的设计思路和实现方式,最后,在安装有常见Windows防火墙的主机上进行测试,测试结果表明,该隐蔽通信方式能成功穿透大多数防火墙。Traditional computer convert communication mostly uses the HOOK technique, but this method couldn＇ t fundamentally solve the problem of communication packets discarded by firewall intercept. NDIS technology is commonly used in firewall and capture software. By analyzing the NDIS principle, this paper suggests a new convert communication method that can pass through the windows firewall, and shows the design and implementation. In the end, a test is done on stalled. The result shows that the method can pass though computer with the usual windows firewalls in- most of the firewalls.

关 键 词：中间层驱动 隐蔽通信 传输协议 防火墙 

分 类 号：TP311.56[自动化与计算机技术—计算机软件与理论]