一种基于NDIS驱动程序实现隐蔽通道的方法

摘要

提出一种基于网络驱动程序(NDIS)来实现隐蔽通道的方法.通过在Windows系统内核中实现自定义网络协议来建立一个隐蔽通道,使应用程序可利用该协议绕开防火墙监控实现与外界通信.实验证明该方法实现的网络协议层次低,隐蔽效果好.%This article proposes one method for realizing the covert channel based on the NDIS driver. We build up a covert channel in the Windows Kernel mode by realizing the definition network protocol, which can go round firewall monitoring to commu-nicate with the outside.The advantage of this method is the low level network protocol and the good covert effect.