From 877c5ae528738cbf968b953e07a40e6d64af6382 Mon Sep 17 00:00:00 2001 From: J M Rossy Date: Wed, 12 Aug 2015 11:56:39 -0700 Subject: Rename README.md files to standardize casing --- network/trans/README.md | 181 ++++++++++++++++++++++++++++++++++++++++ network/trans/ReadMe.md | 181 ---------------------------------------- network/trans/ddproxy/README.md | 66 +++++++++++++++ network/trans/ddproxy/ReadMe.md | 66 --------------- network/trans/inspect/README.md | 55 ++++++++++++ network/trans/inspect/ReadMe.md | 55 ------------ network/trans/msnmntr/README.md | 79 ++++++++++++++++++ network/trans/msnmntr/ReadMe.md | 79 ------------------ network/trans/stmedit/README.md | 60 +++++++++++++ network/trans/stmedit/ReadMe.md | 60 ------------- 10 files changed, 441 insertions(+), 441 deletions(-) create mode 100644 network/trans/README.md delete mode 100644 network/trans/ReadMe.md create mode 100644 network/trans/ddproxy/README.md delete mode 100644 network/trans/ddproxy/ReadMe.md create mode 100644 network/trans/inspect/README.md delete mode 100644 network/trans/inspect/ReadMe.md create mode 100644 network/trans/msnmntr/README.md delete mode 100644 network/trans/msnmntr/ReadMe.md create mode 100644 network/trans/stmedit/README.md delete mode 100644 network/trans/stmedit/ReadMe.md (limited to 'network/trans') diff --git a/network/trans/README.md b/network/trans/README.md new file mode 100644 index 00000000..d23c2554 --- /dev/null +++ b/network/trans/README.md @@ -0,0 +1,181 @@ +Windows Filtering Platform Sample +================================= + +The WFPSampler sample driver is a sample firewall. It has a command-line interface which allows adding filters at various WFP layers with a wide variety of conditions. Additionally it exposes callout functions for injection, basic action, proxying, and stream inspection. + +WFPSampler.Exe is the command-line interface used by the user to define the policy. + +WFPSamplerService.Exe is the service which instructs BFE to add or remove policies. + +WFPSamplerCalloutDriver.Sys is the driver which houses the various callout functions. + +WFPSamplerProxyService.Exe is the service which listens for connections to proxy. + +WFPSampler.Lib is a library of user mode helper functions used throughout the project. + +WFPSamplerSys.Lib is a library of kernel mode helper functions used throughout the project. + +"WFPSamplerInstall.cmd" will copy the necessary binaries to their appropriate location, and install each component. + +"WFPSamplerInstall.cmd -r" will uninstall each component and remove the binaries from the appropriate location. + +Once you have downloaded the sample, the .mht files in the sample's docs directory describe the various WFP filtering scenarios that you can try. + +For more information about WFP callout drivers, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). + + +Open the driver solution in Visual Studio +----------------------------------------- + +Navigate to the folder that contains the sample. Double click the solution file, WFPSampler.sln. In Visual Studio, locate Solution Explorer. (If this is not already open, choose **Solution Explorer** from the **View** menu.) In Solution Explorer, you can see one solution that has these projects: + +- a user-mode application project named **WFPSampler** (under the **Exe** node) +- a user-mode library project named **WFPSampler** (under the **Lib** node) +- a user-mode service project named **WFPSamplerService** (under the **Svc** node) +- a driver project named **WFPSamplerCalloutDriver** (under the **Sys** node) +- a kernel-mode library project named **WFPSampler** (under the **Syslib** node) + +Set the configuration and platform in Visual Studio +--------------------------------------------------- + +In Visual Studio, in Solution Explorer, right click **Solution 'WFPSampler' (5 projects)**, and choose **Configuration Manager**. Set the configuration and the platform. Make sure that the configuration and platform are the same for all projects. Do not check the **Deploy** boxes. + +Set the runtime library for the user-mode application, library, and service +--------------------------------------------------------------------------- + +In Solution Explorer, right-click the **WFPSampler** user-mode application project (under the **Exe** node), and choose **Properties.** Navigate to **Configuration Properties \> C/C++ \> Code Generation**. For **Runtime Library**, select **Multi-threaded Debug (/MTd)**. Click **OK**. + +Repeat this process for the **WFPSampler** user-mode library (under the **Lib** node) and the **WFPSampler** user-mode service (under the **Svc** node). + +Edit the restart setting in the sample installation script +---------------------------------------------------------- + +Open the WfpSamplerInstall.cmd file (in the scripts folder) in Visual Studio. + +Change this line: + +`RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 131 %WinDir%\System32\Drivers\WFPSamplerCalloutDriver.Inf` + +to this: + +`RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 132 %WinDir%\System32\Drivers\WFPSamplerCalloutDriver.Inf` + +For more information about this setting, see the Remarks section for the [**InstallHinfSection**](http://msdn.microsoft.com/en-us/library/windows/hardware/aa376957) function. + +Build the sample using Visual Studio +------------------------------------ + +In Visual Studio, on the **Build** menu, choose **Build Solution**. + +For more information about using Microsoft Visual Studio to build a driver package, see [Building a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554644). + +Locate the built driver package +------------------------------- + +In File Explorer, navigate to the folder that contains your built driver package. The location of this folder varies depending on what you set for configuration and platform. For example, if your settings are Debug and x64, the driver is in your sample folder under **\\Debug**. + +The driver folder contains these files: + +File | Description +-----|------------ +wfpsamplercalloutdriver.cat | A signed catalog file, which serves as the signature for the entire package. +WFPSamplerCalloutDriver.inf | An information (INF) file that contains information needed to install the driver. +WFPSamplerCalloutDriver.sys | The WFPSampler driver. + +**Note** The build process might also put WdfCoinstaller010*xx*.dll in the driver folder, but this file is not really part of the driver package. The INF file does not reference any coinstallers. + +Because the package does not contain a KMDF coinstaller, it is important that you set the KMDF minor version according to your target operating system when you built the driver. + +Locate the symbol file (PDB) for the driver +------------------------------------------- + +In **File Explorer**, locate the symbol file, WFPSamplerCalloutDriver.pdb. The location of this file varies depending on what you set for configuration and platform. For example, if your settings are Debug and Win32, the PDB file is in your sample folder under sys\\Debug. + +Locate the user-mode application and its symbol file (PDB) +---------------------------------------------------------- + +In **File Explorer**, locate the user-mode application (WFPSampler.exe) and its symbol file (WFPSampler.pdb). The location of these files varies depending on what you set for configuration and platform. For example, if your settings are Debug and x64, WFPSampler.exe and WFPSampler.pdb are in your sample folder under exe\\Debug. + +Locate the kernel-mode service and its symbol file (PDB) +-------------------------------------------------------- + +In **File Explorer**, locate the kernel-mode library, WFPSamplerService.exe. The location of this file varies depending on what you set for configuration and platform. For example, if your settings are Debug and x64, WFPSamplerService.exe and WFPSamplerService.pdb are in your sample folder under svc\\Debug. + +Run the sample +-------------- + +The computer where you install the driver is called the *target computer* or the *test computer*. Typically this is a separate computer from where you develop and build the driver package. The computer where you develop and build the driver is called the *host computer*. + +The process of moving the driver to the target computer and installing the driver is called *deploying the driver*. You can deploy the Windows Filtering Platform Sample driver automatically or manually. + +Automatic deployment +-------------------- + +Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: + +1. On the host computer, in Visual Studio, in Solution Explorer, right-click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. +2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. +3. In the **Build** menu, choose **Build Solution**. +4. Copy the following files to the DriverTest\\Drivers folder on the target computer: + - The user-mode application (WFPSampler.exe) file + - The kernel-mode service (WFPSamplerService.exe) file + +Manual deployment +----------------- + +Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, copy the following files to a folder on the target computer (for example, c:\\WFPSamplerSamplePackage): + +- The 4 files in your driver package folder +- The user-mode application (WFPSampler.exe) file +- The kernel-mode service (WFPSamplerService.exe) file + +Copy additional files to the target computer +-------------------------------------------- + +Copy the driver's PDB file (WFPSamplerCalloutDriver.pdb), the user-mode service's PDB file (WFPSamplerService.pdb) and the user-mode application's PDB file (WFPSampler.pdb) to a folder on the target computer (for example, c:\\Symbols). + +Copy the [**TraceView**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553872) and [**SignTool**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff551778) tools to a folder on the target computer (for example c:\\Tools). + +- [**TraceView**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553872) comes with the WDK. You can find it in your WDK installation folder under Tools (for example, c:\\Program Files (x86)\\Windows Kits\\10\\Tools\\x64\\TraceView.exe). +- [**SignTool**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff551778) also comes with the WDK. You can find it in your WDK installation folder under bin (for example, c:\\Program Files (x86)\\Windows Kits\\10\\bin\\x64\\SignTool.exe). + +Installing the driver +--------------------- + +1. On the target computer, open a Command Prompt window as Administrator. Navigate to the folder that contains the installation script: + - For manual deployment, this will be the folder that you copied the driver page files into (for example, c:\\WFPSamplerSamplePackage). + - For automatic deployment, this will be DriverTest\\Drivers. + +2. Enter **WFPSamplerInstall.cmd** to run the installation script. + + **Note** If you need to uninstall a previous version of the driver, enter **WFPSamplerInstall.cmd -r**. + +Running the user-mode application +--------------------------------- + +On the target computer, open a Command Prompt window as Administrator. + +If you just want to see whether you can run the application, enter **WFPSampler.exe -?**. + +The .mht files in the docs directory describe the various WFP filtering scenarios that you can try. + +For example, you can test the basic packet examination scenario by using the following command line: + +**WFPSampler.exe -s BASIC\_PACKET\_EXAMINATION -l FWPM\_LAYER\_INBOUND\_IPPACKET\_V4 -v** + +This command line adds a dynamic filter (-v) at the FWPM\_LAYER\_INBOUND\_IPPACKET\_V4 layer (-l) which references the appropriate callout driver function. This filter will have no conditions, so it will act on all traffic seen at this layer. + +Start a logging session in TraceView +------------------------------------ + +On the target computer, open TraceView.exe as Administrator. On the **File** menu, choose **Create New Log Session**. Click **Add Provider**. Select **PDB (Debug Information File)**, and enter the path to your PDB file, WFPSamplerCalloutDriver.pdb. Click **OK** and click **Next**. Click the **\>\>** button next to **Set Flags and Level**, double-click the **L** button next to **Level**, and set the **Level** to **Information**. Click **OK** and click **Finish**. + +If you want to test whether your TraceView.exe session is working, you can enter the following commands and see what the trace output looks like: + +- **net stop WFPSamplerCallouts** +- **net start WFPSamplerCallouts** + +For more information, see [Creating a Trace Session with a PDB File](http://msdn.microsoft.com/en-us/library/windows/hardware/ff543582). + +Tracing for the sample driver can be started at any time before the driver is started or while the driver is already running. + diff --git a/network/trans/ReadMe.md b/network/trans/ReadMe.md deleted file mode 100644 index d23c2554..00000000 --- a/network/trans/ReadMe.md +++ /dev/null @@ -1,181 +0,0 @@ -Windows Filtering Platform Sample -================================= - -The WFPSampler sample driver is a sample firewall. It has a command-line interface which allows adding filters at various WFP layers with a wide variety of conditions. Additionally it exposes callout functions for injection, basic action, proxying, and stream inspection. - -WFPSampler.Exe is the command-line interface used by the user to define the policy. - -WFPSamplerService.Exe is the service which instructs BFE to add or remove policies. - -WFPSamplerCalloutDriver.Sys is the driver which houses the various callout functions. - -WFPSamplerProxyService.Exe is the service which listens for connections to proxy. - -WFPSampler.Lib is a library of user mode helper functions used throughout the project. - -WFPSamplerSys.Lib is a library of kernel mode helper functions used throughout the project. - -"WFPSamplerInstall.cmd" will copy the necessary binaries to their appropriate location, and install each component. - -"WFPSamplerInstall.cmd -r" will uninstall each component and remove the binaries from the appropriate location. - -Once you have downloaded the sample, the .mht files in the sample's docs directory describe the various WFP filtering scenarios that you can try. - -For more information about WFP callout drivers, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). - - -Open the driver solution in Visual Studio ------------------------------------------ - -Navigate to the folder that contains the sample. Double click the solution file, WFPSampler.sln. In Visual Studio, locate Solution Explorer. (If this is not already open, choose **Solution Explorer** from the **View** menu.) In Solution Explorer, you can see one solution that has these projects: - -- a user-mode application project named **WFPSampler** (under the **Exe** node) -- a user-mode library project named **WFPSampler** (under the **Lib** node) -- a user-mode service project named **WFPSamplerService** (under the **Svc** node) -- a driver project named **WFPSamplerCalloutDriver** (under the **Sys** node) -- a kernel-mode library project named **WFPSampler** (under the **Syslib** node) - -Set the configuration and platform in Visual Studio ---------------------------------------------------- - -In Visual Studio, in Solution Explorer, right click **Solution 'WFPSampler' (5 projects)**, and choose **Configuration Manager**. Set the configuration and the platform. Make sure that the configuration and platform are the same for all projects. Do not check the **Deploy** boxes. - -Set the runtime library for the user-mode application, library, and service ---------------------------------------------------------------------------- - -In Solution Explorer, right-click the **WFPSampler** user-mode application project (under the **Exe** node), and choose **Properties.** Navigate to **Configuration Properties \> C/C++ \> Code Generation**. For **Runtime Library**, select **Multi-threaded Debug (/MTd)**. Click **OK**. - -Repeat this process for the **WFPSampler** user-mode library (under the **Lib** node) and the **WFPSampler** user-mode service (under the **Svc** node). - -Edit the restart setting in the sample installation script ----------------------------------------------------------- - -Open the WfpSamplerInstall.cmd file (in the scripts folder) in Visual Studio. - -Change this line: - -`RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 131 %WinDir%\System32\Drivers\WFPSamplerCalloutDriver.Inf` - -to this: - -`RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 132 %WinDir%\System32\Drivers\WFPSamplerCalloutDriver.Inf` - -For more information about this setting, see the Remarks section for the [**InstallHinfSection**](http://msdn.microsoft.com/en-us/library/windows/hardware/aa376957) function. - -Build the sample using Visual Studio ------------------------------------- - -In Visual Studio, on the **Build** menu, choose **Build Solution**. - -For more information about using Microsoft Visual Studio to build a driver package, see [Building a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554644). - -Locate the built driver package -------------------------------- - -In File Explorer, navigate to the folder that contains your built driver package. The location of this folder varies depending on what you set for configuration and platform. For example, if your settings are Debug and x64, the driver is in your sample folder under **\\Debug**. - -The driver folder contains these files: - -File | Description ------|------------ -wfpsamplercalloutdriver.cat | A signed catalog file, which serves as the signature for the entire package. -WFPSamplerCalloutDriver.inf | An information (INF) file that contains information needed to install the driver. -WFPSamplerCalloutDriver.sys | The WFPSampler driver. - -**Note** The build process might also put WdfCoinstaller010*xx*.dll in the driver folder, but this file is not really part of the driver package. The INF file does not reference any coinstallers. - -Because the package does not contain a KMDF coinstaller, it is important that you set the KMDF minor version according to your target operating system when you built the driver. - -Locate the symbol file (PDB) for the driver -------------------------------------------- - -In **File Explorer**, locate the symbol file, WFPSamplerCalloutDriver.pdb. The location of this file varies depending on what you set for configuration and platform. For example, if your settings are Debug and Win32, the PDB file is in your sample folder under sys\\Debug. - -Locate the user-mode application and its symbol file (PDB) ----------------------------------------------------------- - -In **File Explorer**, locate the user-mode application (WFPSampler.exe) and its symbol file (WFPSampler.pdb). The location of these files varies depending on what you set for configuration and platform. For example, if your settings are Debug and x64, WFPSampler.exe and WFPSampler.pdb are in your sample folder under exe\\Debug. - -Locate the kernel-mode service and its symbol file (PDB) --------------------------------------------------------- - -In **File Explorer**, locate the kernel-mode library, WFPSamplerService.exe. The location of this file varies depending on what you set for configuration and platform. For example, if your settings are Debug and x64, WFPSamplerService.exe and WFPSamplerService.pdb are in your sample folder under svc\\Debug. - -Run the sample --------------- - -The computer where you install the driver is called the *target computer* or the *test computer*. Typically this is a separate computer from where you develop and build the driver package. The computer where you develop and build the driver is called the *host computer*. - -The process of moving the driver to the target computer and installing the driver is called *deploying the driver*. You can deploy the Windows Filtering Platform Sample driver automatically or manually. - -Automatic deployment --------------------- - -Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: - -1. On the host computer, in Visual Studio, in Solution Explorer, right-click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. -2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. -3. In the **Build** menu, choose **Build Solution**. -4. Copy the following files to the DriverTest\\Drivers folder on the target computer: - - The user-mode application (WFPSampler.exe) file - - The kernel-mode service (WFPSamplerService.exe) file - -Manual deployment ------------------ - -Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, copy the following files to a folder on the target computer (for example, c:\\WFPSamplerSamplePackage): - -- The 4 files in your driver package folder -- The user-mode application (WFPSampler.exe) file -- The kernel-mode service (WFPSamplerService.exe) file - -Copy additional files to the target computer --------------------------------------------- - -Copy the driver's PDB file (WFPSamplerCalloutDriver.pdb), the user-mode service's PDB file (WFPSamplerService.pdb) and the user-mode application's PDB file (WFPSampler.pdb) to a folder on the target computer (for example, c:\\Symbols). - -Copy the [**TraceView**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553872) and [**SignTool**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff551778) tools to a folder on the target computer (for example c:\\Tools). - -- [**TraceView**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553872) comes with the WDK. You can find it in your WDK installation folder under Tools (for example, c:\\Program Files (x86)\\Windows Kits\\10\\Tools\\x64\\TraceView.exe). -- [**SignTool**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff551778) also comes with the WDK. You can find it in your WDK installation folder under bin (for example, c:\\Program Files (x86)\\Windows Kits\\10\\bin\\x64\\SignTool.exe). - -Installing the driver ---------------------- - -1. On the target computer, open a Command Prompt window as Administrator. Navigate to the folder that contains the installation script: - - For manual deployment, this will be the folder that you copied the driver page files into (for example, c:\\WFPSamplerSamplePackage). - - For automatic deployment, this will be DriverTest\\Drivers. - -2. Enter **WFPSamplerInstall.cmd** to run the installation script. - - **Note** If you need to uninstall a previous version of the driver, enter **WFPSamplerInstall.cmd -r**. - -Running the user-mode application ---------------------------------- - -On the target computer, open a Command Prompt window as Administrator. - -If you just want to see whether you can run the application, enter **WFPSampler.exe -?**. - -The .mht files in the docs directory describe the various WFP filtering scenarios that you can try. - -For example, you can test the basic packet examination scenario by using the following command line: - -**WFPSampler.exe -s BASIC\_PACKET\_EXAMINATION -l FWPM\_LAYER\_INBOUND\_IPPACKET\_V4 -v** - -This command line adds a dynamic filter (-v) at the FWPM\_LAYER\_INBOUND\_IPPACKET\_V4 layer (-l) which references the appropriate callout driver function. This filter will have no conditions, so it will act on all traffic seen at this layer. - -Start a logging session in TraceView ------------------------------------- - -On the target computer, open TraceView.exe as Administrator. On the **File** menu, choose **Create New Log Session**. Click **Add Provider**. Select **PDB (Debug Information File)**, and enter the path to your PDB file, WFPSamplerCalloutDriver.pdb. Click **OK** and click **Next**. Click the **\>\>** button next to **Set Flags and Level**, double-click the **L** button next to **Level**, and set the **Level** to **Information**. Click **OK** and click **Finish**. - -If you want to test whether your TraceView.exe session is working, you can enter the following commands and see what the trace output looks like: - -- **net stop WFPSamplerCallouts** -- **net start WFPSamplerCallouts** - -For more information, see [Creating a Trace Session with a PDB File](http://msdn.microsoft.com/en-us/library/windows/hardware/ff543582). - -Tracing for the sample driver can be started at any time before the driver is started or while the driver is already running. - diff --git a/network/trans/ddproxy/README.md b/network/trans/ddproxy/README.md new file mode 100644 index 00000000..a9e1d427 --- /dev/null +++ b/network/trans/ddproxy/README.md @@ -0,0 +1,66 @@ +Windows Filtering Platform Packet Modification Sample +===================================================== + +The sample driver demonstrates the packet modification capabilities of the Windows Filtering Platform (WFP). + +## Universal Windows Driver Compliant +This sample builds a Universal Windows Driver. It uses only APIs and DDIs that are included in OneCoreUAP. + +Run the sample +-------------- + +The computer where you install the driver is called the *target computer* or the *test computer*. Typically this is a separate computer from where you develop and build the driver package. The computer where you develop and build the driver is called the *host computer*. + +The process of moving the driver package to the target computer and installing the driver is called *deploying the driver*. You can deploy the Windows Filtering Platform Packet Modification Sample driver automatically or manually. + +Automatic deployment +-------------------- + +Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: + +1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. +2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. +3. On the **Build** menu, choose **Build Solution**. +4. On the target computer, navigate to DriverTest\\Drivers, and locate the file ddproxy.inf. Right click ddproxy.inf, and choose **Install**. + +Manual deployment +----------------- + +Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, continue with these steps: + +1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpPacketModificationSamplePackage). +2. On the target computer, navigate to your driver package folder. Right click ddproxy.inf, and choose **Install** + +Create Registry values +---------------------- + +1. On the target computer, open Regedit, and navigate to this key: + + **HKLM**\\**System**\\**CurrentControlSet**\\**Services**\\**ddproxy**\\**Parameters** + +2. Create a REG\_SZ entry named **DestinationAddressToIntercept** and set it's value to an IPV4 or IPV6 address (example: 10.0.0.1). + +3. Create a REG\_SZ entry named **NewDestinationAddress**, and set it's value to an IPV4 or IPV6 address (example: 10.0.0.2). + +You can also create and set values for the following registry entries. + +- **InspectUdp** (REG\_DWORD type): 0 for ICMP and 1 for UDP (default) +- **DestinationPortToIntercept** (REG\_DWORD type): UDP port number (applicable if InspectUdp is set to 1) +- **NewDestinationPort** (REG\_DWORD type): UDP port number (applicable if InspectUdp is set to 1) + +Start the ddproxy service +------------------------- + +On the target computer, open a Command Prompt window as Administrator, and enter **net start ddproxy**. (To stop the driver, enter **net stop ddproxy**.) + +Remarks +------- + +This sample driver consists of a kernel-mode Windows Filtering Platform (WFP) callout driver (Ddproxy.sys) that intercepts User Datagram Protocol (UDP) and nonerror Internet Control Message Protocol (ICMP) traffic of interest and acts as a redirector. For outbound traffic, Ddproxy.sys redirects the traffic to a new destination address and, for UDP, a new UDP port. For inbound traffic, Ddproxy.sys redirects the traffic back to the original address and UDP port values. This redirection is transparent to the application. + +Packet modification is done out-of-band by a system worker thread by using the reference-drop-clone-modify-reinject mechanism. Therefore, the sample can serve as a basis for scenarios in which the filtering/modification decision cannot be made within the `classifyFn()` callout, but instead must be made, for example, by a user-mode application. + +Ddproxy.sys acts as a redirector for both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) traffic. + +For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). + diff --git a/network/trans/ddproxy/ReadMe.md b/network/trans/ddproxy/ReadMe.md deleted file mode 100644 index a9e1d427..00000000 --- a/network/trans/ddproxy/ReadMe.md +++ /dev/null @@ -1,66 +0,0 @@ -Windows Filtering Platform Packet Modification Sample -===================================================== - -The sample driver demonstrates the packet modification capabilities of the Windows Filtering Platform (WFP). - -## Universal Windows Driver Compliant -This sample builds a Universal Windows Driver. It uses only APIs and DDIs that are included in OneCoreUAP. - -Run the sample --------------- - -The computer where you install the driver is called the *target computer* or the *test computer*. Typically this is a separate computer from where you develop and build the driver package. The computer where you develop and build the driver is called the *host computer*. - -The process of moving the driver package to the target computer and installing the driver is called *deploying the driver*. You can deploy the Windows Filtering Platform Packet Modification Sample driver automatically or manually. - -Automatic deployment --------------------- - -Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: - -1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. -2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. -3. On the **Build** menu, choose **Build Solution**. -4. On the target computer, navigate to DriverTest\\Drivers, and locate the file ddproxy.inf. Right click ddproxy.inf, and choose **Install**. - -Manual deployment ------------------ - -Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, continue with these steps: - -1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpPacketModificationSamplePackage). -2. On the target computer, navigate to your driver package folder. Right click ddproxy.inf, and choose **Install** - -Create Registry values ----------------------- - -1. On the target computer, open Regedit, and navigate to this key: - - **HKLM**\\**System**\\**CurrentControlSet**\\**Services**\\**ddproxy**\\**Parameters** - -2. Create a REG\_SZ entry named **DestinationAddressToIntercept** and set it's value to an IPV4 or IPV6 address (example: 10.0.0.1). - -3. Create a REG\_SZ entry named **NewDestinationAddress**, and set it's value to an IPV4 or IPV6 address (example: 10.0.0.2). - -You can also create and set values for the following registry entries. - -- **InspectUdp** (REG\_DWORD type): 0 for ICMP and 1 for UDP (default) -- **DestinationPortToIntercept** (REG\_DWORD type): UDP port number (applicable if InspectUdp is set to 1) -- **NewDestinationPort** (REG\_DWORD type): UDP port number (applicable if InspectUdp is set to 1) - -Start the ddproxy service -------------------------- - -On the target computer, open a Command Prompt window as Administrator, and enter **net start ddproxy**. (To stop the driver, enter **net stop ddproxy**.) - -Remarks -------- - -This sample driver consists of a kernel-mode Windows Filtering Platform (WFP) callout driver (Ddproxy.sys) that intercepts User Datagram Protocol (UDP) and nonerror Internet Control Message Protocol (ICMP) traffic of interest and acts as a redirector. For outbound traffic, Ddproxy.sys redirects the traffic to a new destination address and, for UDP, a new UDP port. For inbound traffic, Ddproxy.sys redirects the traffic back to the original address and UDP port values. This redirection is transparent to the application. - -Packet modification is done out-of-band by a system worker thread by using the reference-drop-clone-modify-reinject mechanism. Therefore, the sample can serve as a basis for scenarios in which the filtering/modification decision cannot be made within the `classifyFn()` callout, but instead must be made, for example, by a user-mode application. - -Ddproxy.sys acts as a redirector for both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) traffic. - -For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). - diff --git a/network/trans/inspect/README.md b/network/trans/inspect/README.md new file mode 100644 index 00000000..4f28598c --- /dev/null +++ b/network/trans/inspect/README.md @@ -0,0 +1,55 @@ +Windows Filtering Platform Traffic Inspection Sample +==================================================== + +This sample driver demonstrates the traffic inspection capabilities of the Windows Filtering Platform (WFP). + +The sample driver consists of a kernel-mode Windows Filtering Platform (WFP) callout driver (Inspect.sys) that intercepts all transport layer traffic (for example, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and nonerror Internet Control Message Protocol (ICMP)) sent to or received from a configurable remote peer and queues then to a worker thread for out-of-band processing. + +Inspect.sys inspects inbound and outbound connections and all packets that belong to those connections. Additionally, Inspect.sys demonstrates the special considerations that are required to be compatible with Internet Protocol security (IPsec). + +Inspect.sys implements the `ClassifyFn` callout functions for the ALE Connect, Recv-Accept, and Transport callouts. In addition, the system worker thread that performs the actual packet inspection is also implemented along with the event mechanisms that are shared between the Classify function and the worker thread. + +Connect/Packet inspection is done out-of-band by a system worker thread by using the reference-drop-clone-reinject mechanism as well as the ALE pend/complete mechanism. Therefore, the sample can serve as a basis for scenarios in which a filtering decision cannot be made within the `classifyFn()` callout and instead must be made, for example, by a user-mode application. + +## Universal Windows Driver Compliant +This sample builds a Universal Windows Driver. It uses only APIs and DDIs that are included in OneCoreUAP. + +Automatic deployment +-------------------- + +Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: + +1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. +2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. +3. On the **Build** menu, choose **Build Solution**. +4. On the target computer, navigate to DriverTest\\Drivers, and locate the file inspect.inf. Right click inspect.inf, and choose **Install**. + +Manual deployment +----------------- + +Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, continue with these steps: + +1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpTrafficInspectionSamplePackage). +2. On the target computer, navigate to your driver package folder. Right click inspect.inf, and choose **Install** + +Create Registry values +---------------------- + +1. On the target computer, open Regedit, and navigate to this key: + + **HKLM**\\**System**\\**CurrentControlSet**\\**Services**\\**inspect**\\**Parameters** + +2. Create a REG\_DWORD entry named **BlockTraffic** and set it's value to 0 for permit or 1 to block. + +3. Create a REG\_SZ entry named **RemoteAddressToInspect**, and set it's value to an IPV4 or IPV6 address (example: 10.0.0.2). + +Start the inspect service +------------------------- + +On the target computer, open a Command Prompt window as Administrator, and enter **net start inspect**. (To stop the driver, enter **net stop inspect**.) + +Remarks +------- + +For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). + diff --git a/network/trans/inspect/ReadMe.md b/network/trans/inspect/ReadMe.md deleted file mode 100644 index 4f28598c..00000000 --- a/network/trans/inspect/ReadMe.md +++ /dev/null @@ -1,55 +0,0 @@ -Windows Filtering Platform Traffic Inspection Sample -==================================================== - -This sample driver demonstrates the traffic inspection capabilities of the Windows Filtering Platform (WFP). - -The sample driver consists of a kernel-mode Windows Filtering Platform (WFP) callout driver (Inspect.sys) that intercepts all transport layer traffic (for example, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and nonerror Internet Control Message Protocol (ICMP)) sent to or received from a configurable remote peer and queues then to a worker thread for out-of-band processing. - -Inspect.sys inspects inbound and outbound connections and all packets that belong to those connections. Additionally, Inspect.sys demonstrates the special considerations that are required to be compatible with Internet Protocol security (IPsec). - -Inspect.sys implements the `ClassifyFn` callout functions for the ALE Connect, Recv-Accept, and Transport callouts. In addition, the system worker thread that performs the actual packet inspection is also implemented along with the event mechanisms that are shared between the Classify function and the worker thread. - -Connect/Packet inspection is done out-of-band by a system worker thread by using the reference-drop-clone-reinject mechanism as well as the ALE pend/complete mechanism. Therefore, the sample can serve as a basis for scenarios in which a filtering decision cannot be made within the `classifyFn()` callout and instead must be made, for example, by a user-mode application. - -## Universal Windows Driver Compliant -This sample builds a Universal Windows Driver. It uses only APIs and DDIs that are included in OneCoreUAP. - -Automatic deployment --------------------- - -Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: - -1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. -2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. -3. On the **Build** menu, choose **Build Solution**. -4. On the target computer, navigate to DriverTest\\Drivers, and locate the file inspect.inf. Right click inspect.inf, and choose **Install**. - -Manual deployment ------------------ - -Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, continue with these steps: - -1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpTrafficInspectionSamplePackage). -2. On the target computer, navigate to your driver package folder. Right click inspect.inf, and choose **Install** - -Create Registry values ----------------------- - -1. On the target computer, open Regedit, and navigate to this key: - - **HKLM**\\**System**\\**CurrentControlSet**\\**Services**\\**inspect**\\**Parameters** - -2. Create a REG\_DWORD entry named **BlockTraffic** and set it's value to 0 for permit or 1 to block. - -3. Create a REG\_SZ entry named **RemoteAddressToInspect**, and set it's value to an IPV4 or IPV6 address (example: 10.0.0.2). - -Start the inspect service -------------------------- - -On the target computer, open a Command Prompt window as Administrator, and enter **net start inspect**. (To stop the driver, enter **net stop inspect**.) - -Remarks -------- - -For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). - diff --git a/network/trans/msnmntr/README.md b/network/trans/msnmntr/README.md new file mode 100644 index 00000000..fcc9c420 --- /dev/null +++ b/network/trans/msnmntr/README.md @@ -0,0 +1,79 @@ +Windows Filtering Platform MSN Messenger Monitor Sample +======================================================= + +This sample application and driver demonstrate the stream inspection capabilities of the Windows Filtering Platform (WFP). + +The sample consists of a user mode application (Monitor.exe) that registers traffic of interest. In this case, all Transmission Control Protocol (TCP) data segments that are sent and received by an application of your choice. + +**Note** Originally this sample was written to monitor the MSN Messenger application. Now it can monitor any application that you specify. + +Monitor.exe adds filters and callouts to Windows through the Windows Filtering Platform (WFP) Win32 API. A kernel-mode WFP callout driver (Msnmntr.sys) intercepts TCP traffic and parses out communication patterns. Monitor.exe controls the operations of the callout driver through I/O controls (IOCTLs). + +The filters and callouts added by Monitor.exe are persistent across system restarts and removed only by Monitor.exe. Adding filters and callouts requires administrator privileges. Therefore, Monitor.exe must be run from an elevated command prompt. + +Msnmntr.sys registers itself at two different WFP layers: FLOW-ESTABLISHED and STREAM. For simplicity, only Internet Protocol version 4 (IPv4) traffic is inspected. Msnmntr.sys registers at the FLOW-ESTABLISHED layer to associate a callout driver-specific data structure with application identity (that is, path) recorded such that the STREAM layer will only be invoked if traffic is sent or received from that particular application. + +After the filters and callouts are in place and registered, WFP indicates TCP data segments to the Msnmntr.sys for inspection. As the data flows through Msnmntr.sys, it copies them (described by a chain of NET\_BUFFER\_LIST structures) to a flat buffer, parses out the communication patterns (such as client-to-server/client-to-client), and sends them to the Windows Software Trace Preprocessor (WPP) for tracing. + +Automatic deployment +-------------------- + +Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: + +1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. +2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. +3. On the **Build** menu, choose **Build Solution**. +4. On the target computer, navigate to DriverTest\\Drivers, and locate the file msnmntr.inf. Right click msnmntr.inf, and choose **Install**. + +Manual deployment +----------------- + +Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, continue with these steps: + +1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpMsnMessengerMonitorSamplePackage). +2. On the target computer, navigate to your driver package folder. Right click msnmntr.inf, and choose **Install** + +Copy additional files to the target computer +-------------------------------------------- + +Copy the user-mode application, monitor.exe to a folder on the target computer (for example, c:\\WfpMsnMessengerMonitorSampleApp). + +Copy the PDB file, msnmntr.pdb to a folder on the target computer (for example, c:\\Symbols). + +Copy the tool TraceView.exe to a folder on the target computer (for example c:\\Tools). TraceView.exe comes with the WDK. You can find it in your WDK installation folder under Tools (for example, c:\\Program Files (x86)\\Windows Kits\\10\\Tools\\x64\\TraceView.exe). + +Start the msnmntr service +------------------------- + +On the target computer, open a Command Prompt window as Administrator, and enter **net start msnmntr**. (To stop the driver, enter **net stop msnmntr**.) + +Running the user-mode application +--------------------------------- + +On the target computer, open a Command Prompt window as Administrator, and navigate to the folder that contains monitor.exe. Enter **monitor.exe addcallouts**. Then enter **monitor.exe monitor** *TargetAppPath*, where *TargetAppPath* is the path to the application that you want to monitor. Here is an example that initiates monitoring of Internet Explorer. + +``` +monitor.exe addcallouts +monitor.exe monitor "C:\Program Files (x86)\Internet Explorer\iexplore.exe" +``` + +Start a logging session in TraceView +------------------------------------ + +On the target computer, open TraceView.exe as Administrator. On the **File** menu, choose **Create New Log Session**. Click **Add Provider**. Select **PDB (Debug Information File)**, and enter the path to your PDB file, msnmntr.pdb. Click **OK**, and finish working through the setup procedure. Open Internet Explorer, and watch the communication patterns being displayed in the Traceview.exe tool. + +Tracing for the sample driver can be started at any time before the driver is started or while the driver is already running. + +For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). + +Using MSBuild +------------- + +As an alternative to building the WFP MSN Messenger Monitor Sample in Visual Studio, you can build it in a Visual Studio Command Prompt window. In Visual Studio, on the **Tools** menu, choose **Visual Studio Command Prompt**. In the Visual Studio Command Prompt window, navigate to the folder that has the solution file, msnmntr.sln. Use the [MSBuild](http://go.microsoft.com/fwlink/p/?linkID=262804) command to build the solution. Here are some examples: + +**msbuild /p:configuration="Debug" /p:platform="x64" msnmntr.sln** + +**msbuild /p:configuration="Release" /p:platform="Win32" msnmntr.sln** + +For more information about using [MSBuild](http://go.microsoft.com/fwlink/p/?linkID=262804) to build a driver package, see [Building a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554644). + diff --git a/network/trans/msnmntr/ReadMe.md b/network/trans/msnmntr/ReadMe.md deleted file mode 100644 index fcc9c420..00000000 --- a/network/trans/msnmntr/ReadMe.md +++ /dev/null @@ -1,79 +0,0 @@ -Windows Filtering Platform MSN Messenger Monitor Sample -======================================================= - -This sample application and driver demonstrate the stream inspection capabilities of the Windows Filtering Platform (WFP). - -The sample consists of a user mode application (Monitor.exe) that registers traffic of interest. In this case, all Transmission Control Protocol (TCP) data segments that are sent and received by an application of your choice. - -**Note** Originally this sample was written to monitor the MSN Messenger application. Now it can monitor any application that you specify. - -Monitor.exe adds filters and callouts to Windows through the Windows Filtering Platform (WFP) Win32 API. A kernel-mode WFP callout driver (Msnmntr.sys) intercepts TCP traffic and parses out communication patterns. Monitor.exe controls the operations of the callout driver through I/O controls (IOCTLs). - -The filters and callouts added by Monitor.exe are persistent across system restarts and removed only by Monitor.exe. Adding filters and callouts requires administrator privileges. Therefore, Monitor.exe must be run from an elevated command prompt. - -Msnmntr.sys registers itself at two different WFP layers: FLOW-ESTABLISHED and STREAM. For simplicity, only Internet Protocol version 4 (IPv4) traffic is inspected. Msnmntr.sys registers at the FLOW-ESTABLISHED layer to associate a callout driver-specific data structure with application identity (that is, path) recorded such that the STREAM layer will only be invoked if traffic is sent or received from that particular application. - -After the filters and callouts are in place and registered, WFP indicates TCP data segments to the Msnmntr.sys for inspection. As the data flows through Msnmntr.sys, it copies them (described by a chain of NET\_BUFFER\_LIST structures) to a flat buffer, parses out the communication patterns (such as client-to-server/client-to-client), and sends them to the Windows Software Trace Preprocessor (WPP) for tracing. - -Automatic deployment --------------------- - -Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: - -1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. -2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. -3. On the **Build** menu, choose **Build Solution**. -4. On the target computer, navigate to DriverTest\\Drivers, and locate the file msnmntr.inf. Right click msnmntr.inf, and choose **Install**. - -Manual deployment ------------------ - -Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, continue with these steps: - -1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpMsnMessengerMonitorSamplePackage). -2. On the target computer, navigate to your driver package folder. Right click msnmntr.inf, and choose **Install** - -Copy additional files to the target computer --------------------------------------------- - -Copy the user-mode application, monitor.exe to a folder on the target computer (for example, c:\\WfpMsnMessengerMonitorSampleApp). - -Copy the PDB file, msnmntr.pdb to a folder on the target computer (for example, c:\\Symbols). - -Copy the tool TraceView.exe to a folder on the target computer (for example c:\\Tools). TraceView.exe comes with the WDK. You can find it in your WDK installation folder under Tools (for example, c:\\Program Files (x86)\\Windows Kits\\10\\Tools\\x64\\TraceView.exe). - -Start the msnmntr service -------------------------- - -On the target computer, open a Command Prompt window as Administrator, and enter **net start msnmntr**. (To stop the driver, enter **net stop msnmntr**.) - -Running the user-mode application ---------------------------------- - -On the target computer, open a Command Prompt window as Administrator, and navigate to the folder that contains monitor.exe. Enter **monitor.exe addcallouts**. Then enter **monitor.exe monitor** *TargetAppPath*, where *TargetAppPath* is the path to the application that you want to monitor. Here is an example that initiates monitoring of Internet Explorer. - -``` -monitor.exe addcallouts -monitor.exe monitor "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -``` - -Start a logging session in TraceView ------------------------------------- - -On the target computer, open TraceView.exe as Administrator. On the **File** menu, choose **Create New Log Session**. Click **Add Provider**. Select **PDB (Debug Information File)**, and enter the path to your PDB file, msnmntr.pdb. Click **OK**, and finish working through the setup procedure. Open Internet Explorer, and watch the communication patterns being displayed in the Traceview.exe tool. - -Tracing for the sample driver can be started at any time before the driver is started or while the driver is already running. - -For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). - -Using MSBuild -------------- - -As an alternative to building the WFP MSN Messenger Monitor Sample in Visual Studio, you can build it in a Visual Studio Command Prompt window. In Visual Studio, on the **Tools** menu, choose **Visual Studio Command Prompt**. In the Visual Studio Command Prompt window, navigate to the folder that has the solution file, msnmntr.sln. Use the [MSBuild](http://go.microsoft.com/fwlink/p/?linkID=262804) command to build the solution. Here are some examples: - -**msbuild /p:configuration="Debug" /p:platform="x64" msnmntr.sln** - -**msbuild /p:configuration="Release" /p:platform="Win32" msnmntr.sln** - -For more information about using [MSBuild](http://go.microsoft.com/fwlink/p/?linkID=262804) to build a driver package, see [Building a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554644). - diff --git a/network/trans/stmedit/README.md b/network/trans/stmedit/README.md new file mode 100644 index 00000000..e6f48340 --- /dev/null +++ b/network/trans/stmedit/README.md @@ -0,0 +1,60 @@ +Windows Filtering Platform Stream Edit Sample +============================================= + +This sample driver demonstrates replacing a string pattern for a Transmission Control Protocol (TCP) connection using the Windows Filtering Platform (WFP). + +## Universal Windows Driver Compliant +This sample builds a Universal Windows Driver. It uses only APIs and DDIs that are included in OneCoreUAP. + +The sample consists of a kernel-mode Windows Filtering Platform (WFP) callout driver (Stmedit.sys) that can operate in one of the following modes: + +- Inline editing where all modification is done within the `ClassifyFn` callout function. +- Out-of-band editing where all modification is done by a worker thread (the default). + +The sample performs inspection for both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) traffic. + +Before experimenting with the sample, add an exception for the InspectionPort to your host firewall. + +Automatic deployment +-------------------- + +Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: + +1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. +2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. +3. On the **Build** menu, choose **Build Solution**. +4. On the target computer, navigate to DriverTest\\Drivers, and locate the file stmedit.inf. Right click stmedit.inf, and choose **Install**. + +Manual deployment +----------------- + +Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, continue with these steps: + +1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpStreamEditSamplePackage). +2. On the target computer, navigate to your driver package folder. Right click stmedit.inf, and choose **Install** + +Create Registry values +---------------------- + +- On the target computer, open Regedit, and navigate to this key: + + **HKLM**\\**System**\\**CurrentControlSet**\\**Services**\\**strmedit**\\**Parameters** + +You can create and set values for the following registry entries. + +- **EditInline** (REG\_DWORD type): 1 for inline editing, 0 for out-of-band editing (the default) +- **StringToFind** (REG\_SZ type): default = "rainy" +- **StringToReplace** (REG\_SZ type): default = "sunny" +- **InspectionPort** (REG\_DWORD type): TCP port (default = 5001) +- **InspectOutbound** (REG\_DWORD type): TCP port (default = 0) + +Start the stmedit service +------------------------- + +On the target computer, open a Command Prompt window as Administrator, and enter **net start stmedit**. (To stop the driver, enter **net stop stmedit**.) + +Remarks +------- + +For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). + diff --git a/network/trans/stmedit/ReadMe.md b/network/trans/stmedit/ReadMe.md deleted file mode 100644 index e6f48340..00000000 --- a/network/trans/stmedit/ReadMe.md +++ /dev/null @@ -1,60 +0,0 @@ -Windows Filtering Platform Stream Edit Sample -============================================= - -This sample driver demonstrates replacing a string pattern for a Transmission Control Protocol (TCP) connection using the Windows Filtering Platform (WFP). - -## Universal Windows Driver Compliant -This sample builds a Universal Windows Driver. It uses only APIs and DDIs that are included in OneCoreUAP. - -The sample consists of a kernel-mode Windows Filtering Platform (WFP) callout driver (Stmedit.sys) that can operate in one of the following modes: - -- Inline editing where all modification is done within the `ClassifyFn` callout function. -- Out-of-band editing where all modification is done by a worker thread (the default). - -The sample performs inspection for both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) traffic. - -Before experimenting with the sample, add an exception for the InspectionPort to your host firewall. - -Automatic deployment --------------------- - -Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Configuring a Computer for Driver Deployment, Testing, and Debugging](http://msdn.microsoft.com/en-us/library/windows/hardware/). After you have provisioned the target computer, continue with these steps: - -1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**. -2. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**. -3. On the **Build** menu, choose **Build Solution**. -4. On the target computer, navigate to DriverTest\\Drivers, and locate the file stmedit.inf. Right click stmedit.inf, and choose **Install**. - -Manual deployment ------------------ - -Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544707) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](http://msdn.microsoft.com/en-us/library/windows/hardware/dn265571). After you have prepared the target computer for manual deployment, continue with these steps: - -1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpStreamEditSamplePackage). -2. On the target computer, navigate to your driver package folder. Right click stmedit.inf, and choose **Install** - -Create Registry values ----------------------- - -- On the target computer, open Regedit, and navigate to this key: - - **HKLM**\\**System**\\**CurrentControlSet**\\**Services**\\**strmedit**\\**Parameters** - -You can create and set values for the following registry entries. - -- **EditInline** (REG\_DWORD type): 1 for inline editing, 0 for out-of-band editing (the default) -- **StringToFind** (REG\_SZ type): default = "rainy" -- **StringToReplace** (REG\_SZ type): default = "sunny" -- **InspectionPort** (REG\_DWORD type): TCP port (default = 5001) -- **InspectOutbound** (REG\_DWORD type): TCP port (default = 0) - -Start the stmedit service -------------------------- - -On the target computer, open a Command Prompt window as Administrator, and enter **net start stmedit**. (To stop the driver, enter **net stop stmedit**.) - -Remarks -------- - -For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](http://msdn.microsoft.com/en-us/library/windows/hardware/ff571068). - -- cgit v1.3.1