title: How to use .sys driver functions in delphi
body: <p>I have a specific driver(a firewall driver) which i managed to load with delphi but i dont know how to call his function inside my program.
  The specification for this functions on driver are like folows :
  Firewall functions can be called with DeviceIoControl (DDoSflt) 
      IoControl codes (needed for DeviceIoControl) are as following:</p>
  
  <pre><code>0x2220c0 = IOCTL_START
  Input:  none
  Output: none
  </code></pre>
  
  <p>After loading the driver, call this function to install firewall hook.</p>
  
  <pre><code>0x2220c4 = IOCTL_STOP
  Input:  none
  Output: none
  </code></pre>
  
  <p>Call this function to disable the firewall without unloading it.</p>
  
  <pre><code>0x2220c8 = IOCTL_DDOSADDIP
  Input:  a DWORD containing an IP address
  Output: none
  </code></pre>
  
  <p>This function notifies the firewall that a DDoS attack is in progress and adds an IP to DDoS filter. Until IOCTL_DDOSSTOP is called, all the traffic from IPs that are in DDoS filter will be filtered.</p>
  
  <pre><code>0x2220cc = IOCTL_DDOSSTOP
  Input:  none
  Output: none
  </code></pre>
  
  <p>This function notifies the firewall that DDoS attack was stopped, the function will delete the DDoS filter.</p>
  
  <pre><code>0x2220d0 = IOCTL_BAN0
  Input:  two DWORDs containing an IP range
  Output: none
  </code></pre>
  
  <p>This function sets a ban on an IP range.</p>
  
  <pre><code>0x2220d4 = IOCTL_GETFLT
  Input:  none
  Output: DWORD
  </code></pre>
  
  <p>This function returns the number of filtered TCP/SYN packets that were sent from IPs found in DDoS filter.
  2. Structures used by firewall</p>
  
  <p>2.1. FirewallParametersInfo</p>
  
  <pre><code>typedef struct _FirewallParametersInfo{
      WORD    pcapFlags;  // bit 0 = WinPCap is enabled, bit 1 = detection of adapters was completed (this WORD is not used by version 1.03 of DDoSflt)
      WORD    pcapAdapters;   // mask of enabled / disabled adapters used by WinPCap procedures (this WORD is not used by version 1.03 of DDoSflt)
      DWORD   pcapTimer;  // timeout for capturing packets using WinPCap procedures (not used by version 1.03 of DDoSflt)
      BYTE    pcapSyn;    // maximum number of TCP/SYN packets per second allowed from one IP
      BYTE    pcapUdp;    // maximum number of UDP packets per second allowed from one IP
      BYTE    pcapIcmp;   // maximum number of ICMP packets per second allowed from one IP
      BYTE    firewallFlags;  // bit 0 = firewall is registered
                  // bit 1 = firewall is started
                  // bit 2 = maximum SYN/second on hub's registered ports will be checked
                  // bit 3 = maximum SYN/second on unregistered ports will be checked
                  // bit 4 = ICMP traffic will be blocked
                  // bit 5 = TCP/RST packets will not be sent (will be filtered)
                  // bit 6 = if flood is detected, the application will call the firewall to set a _ban0_ (not used by firewall)
                  // bit 7 = if flood is detected, a notification message will be sent in opchat (not used by firewall)
      WORD    hubSyn;     // maximum SYN rate allowed for one of registered hub's ports
      WORD    otherSyn;   // maximum SYN rate allowed for non-registered ports
  } FirewallParametersInfo;
  </code></pre>
  
  <p>2.2. port_info</p>
  
  <pre><code>typedef struct _port_info{
      WORD    port;       // port value in network byte order
      int synRate;    // maximum number of TCP/SYN packets per second allowed from all users
  } port_info;
  </code></pre>
  
  <hr>
  
  <p>This is ...</p>