Windows Filt= ering Platform (WFP) Sampler

The WFPSampler is a fully functional firewall comprise= d of the following binaries:

v WFPSampler.exe

v WFPSamplerService.Exe

v WFPSamplerCalloutDriver= .Sys

v WFPSamplerProxyService.Exe

WFPSampler.Exe

Usage:

This executable is the command-line interface used by = the user to define the policy.

“WFPSampler.e= xe -?” provides output of valid parameters to pass.

“WFPSampler.e= xe -s <SCENARIO> -?” provides output of valid parameters pertaining to = that scenario.

Source:

The executable is located under exe and is comprised o= f the following files:

v Framework_RPCClientInterface.CPP

v Framework_RPCClientInte= rface.H

v Framework_WFPSampler.CPP

v Framework_WFPSampler.H<= /span>

v Framework_WFPSampler.rc=

v HelperFunctions_CommandLine.CPP

v HelperFunctions_Command= Line.H

v Scenarios_AppContainers.CPP

v Scenarios_AppContainers= .H

v Scenarios_BasicAction.CPP

v Scenarios_BasicAction.H=

v Scenarios_BasicPacketExamination.CPP

v Scenarios_BasicPacketEx= amination.H

v Scenarios_BasicPacketInjection.CPP

v Scenarios_BasicPacketIn= jection.H

v Scenarios_BasicPacketModification.CPP

v Scenarios_BasicPacketMo= dification.H

v Scenarios_BasicStreamInjection.CPP

v Scenarios_BasicStreamIn= jection.H

v Scenarios_FastPacketInjection.CPP

v Scenarios_FastPacketInj= ection.H

v Scenarios_FastStreamInjection.CPP=

v Scenarios_FastStreamInj= ection.H

v Scenarios_FlowAssociation.CPP

v Scenarios_FlowAssociati= on.H

v Scenarios_Include.H

v Scenarios_PendAuthorization.CPP

v Scenarios_PendAuthoriza= tion.H

v Scenarios_PendEndpointClosure.CPP=

v Scenarios_PendEndpointC= losure.H

v Scenarios_Proxy.CPP

v Scenarios_Proxy.H

and links with lib\WFPSampl= er.lib.

The Framework= _* files contain functions for creating and maintaining the executable such as= wmain. These= are relatively safe to ignore if you are only concerned with WFP functionality.=

The HelperFun= ctions_CommandLine.* are files which assist with parsing of the command line parameters passed.<= span style=3D'mso-spacerun:yes'> This has the building blocks for the FWPM_FILTER and FWPM_PROVIDER_CONTEXT that the WFPSamplerService.Exe uses f= or defining policy.

The Scenarios= _* are files which gather and package all the data required by the WFPSamplerService.Exe. The package= d data is sent to the WFPSamplerService.Exe via local RPC interfaces exposed by the service.

<= ![endif]>

Figure A. Interaction between modules=

WFPSamplerService.Exe

Usage:

This is the service which instructs BFE to add or remo= ve policies.

“WFPSamplerSe= rvice.Exe -i“ installs the service. While installed, the serv= ice is under the control of the Service Control Manager (as WFPSampler). The service is set to autostart and depends on BFE.

“WFPSamplerSe= rvice.Exe -u“ uninstalls the service.

Source:

The executable is located under svc and is comprised o= f the following files:

v Framework_ActionCenter.CPP *

v Framework_ActionCenter.= H *

v Framework_Include.H

v Framework_RPCServerInterface.CPP

v Framework_RPCServerInte= rface.H

v Framework_WFPSamplerService.CPP

v Framework_WFPSamplerSer= vice.H

v Framework_WFPSamplerSer= vice.RC

v Framework_WFPSamplerService_Msg.MC

v Framework_WindowsFirewall.CPP

v Framework_WindowsFirewa= ll.H

v Scenarios_AppContainers.CPP

v Scenarios_BasicAction.CPP

v Scenarios_BasicPacketExamination.CPP

v Scenarios_BasicPacketInjection.CPP

v Scenarios_BasicPacketModification.CPP

v Scenarios_BasicStreamInjection.CPP

v Scenarios_FastPacketInjection.CPP

v Scenarios_FastStreamInjection.CPP=

v Scenarios_FlowAssociation.CPP

v Scenarios_PendAuthorization.CPP

v Scenarios_PendEndpointClosure.CPP=

v Scenarios_Proxy.CPP

*Avai= lable only under Non Disclosure Agreement (NDA)<= /o:p>

and links with lib\WFPSampl= er.lib.

The Framework= _* files contain functions for creating and maintaining the service such as ServiceMain. These are relatively safe to ignore if you are only concerned with WFP functional= ity with the following exceptions: Framework_WindowsFirewall.CPP demonstrates how to properly disable Microsoft Windows Firewall, and if you have a signed NDA agreement, Frame= work_ActionCenter.CPP demonstrates how to register with Microsoft Windows Action Center.

The Scenarios= _* files finish creating the filters and provider contexts required by each scenario. These are then added to = the system using Fwpm Management calls.

WFPSamplerCalloutDriver.Sys

Usage:

This is the driver which houses the various callout functions.

Source:

This driver is located under sys and is comprised of t= he following files:

v ClassifyFunctions_BasicActionCallouts.CPP

v ClassifyFunctions_Basic= ActionCallouts.H

v ClassifyFunctions_BasicPacketExaminationCall= outs.CPP

v ClassifyFunctions_Basic= PacketExaminationCallouts.H

v ClassifyFunctions_BasicPacketInjectionCallou= ts.CPP

v ClassifyFunctions_Basic= PacketInjectionCallouts.H

v ClassifyFunctions_BasicPacketModificationCal= louts.CPP

v ClassifyFunctions_Basic= PacketModificationCallouts.H

v ClassifyFunctions_BasicStreamInjectionCallou= ts.CPP

v ClassifyFunctions_Basic= StreamInjectionCallouts.H

v ClassifyFunctions_FastPacketInjectionCallout= s.CPP

v ClassifyFunctions_FastP= acketInjectionCallouts.H

v ClassifyFunctions_FastStreamInjectionCallout= s.CPP

v ClassifyFunctions_FastS= treamInjectionCallouts.H

v ClassifyFunctions_Inclu= de.H

v ClassifyFunctions_PendAuthorizationCallouts.= CPP

v ClassifyFunctions_PendA= uthorizationCallouts.H

v ClassifyFunctions_PendEndpointClosureCallout= s.CPP

v ClassifyFunctions_PendE= ndpointClosureCallouts.H

v ClassifyFunctions_ProxyCallouts.CPP

v ClassifyFunctions_Proxy= Callouts.H

v CompletionFunctions_BasicPacketInjectionCall= outs.CPP

v CompletionFunctions_Bas= icPacketInjectionCallouts.H

v CompletionFunctions_BasicPacketModificationC= allouts.CPP

v CompletionFunctions_Bas= icPacketModificationCallouts.H

v CompletionFunctions_BasicStreamInjectionCall= outs.CPP

v CompletionFunctions_Bas= icStreamInjectionCallouts.H

v CompletionFunctions_FastPacketInjectionCallo= uts.CPP

v CompletionFunctions_Fas= tPacketInjectionCallouts.H

v CompletionFunctions_FastStreamInjectionCallo= uts.CPP

v CompletionFunctions_Fas= tStreamInjectionCallouts.H

v CompletionFunctions_Inc= lude.H

v CompletionFunctions_PendAuthorizationCallout= s.CPP

v CompletionFunctions_Pen= dAuthorizationCallouts.H

v CompletionFunctions_ProxyCallouts.CPP

v CompletionFunctions_Pro= xyCallouts.H

v Framework_Events.CPP

v Framework_Events.H

v Framework_Include.H

v Framework_PowerStates.CPP

v Framework_PowerStates.H=

v Framework_WFPSamplerCalloutDriver.CPP

v Framework_WFPSamplerCal= loutDriver.H

v Framework_WFPSamplerCal= loutDriver.rc

v HelperFunctions_ExposedCallouts.CPP

v HelperFunctions_Exposed= Callouts.H

v NotifyFunctions_BasicCallouts.CPP

v NotifyFunctions_BasicCa= llouts.H

v NotifyFunctions_FastCallouts.CPP<= /p>

v NotifyFunctions_FastCal= louts.H

v NotifyFunctions_FlowDelete.CPP

v NotifyFunctions_FlowDel= ete.H

v NotifyFunctions_Include= .H

v NotifyFunctions_PendCallouts.CPP

v NotifyFunctions_PendCal= louts.H

v NotifyFunctions_ProxyCallouts.CPP

v NotifyFunctions_ProxyCa= llouts.H

v SubscriptionFunctions_BFEState.CPP

v SubscriptionFunctions_B= FEState.H

v SubscriptionFunctions_I= nclude.H

v WFPSamplerCalloutDriver= .InX

and links with SysLib\WFPSamplerSys.Lib.

The Framework= _* files contain functions for creating and maintaining a filter driver using the Microsoft Windows Driver Foundation. These are relatively safe to ignore if you are only concerned with W= FP functionality.

HelperFunctio= ns_ExposedCallouts.CPP contains functions used to register and unregister the various callouts exp= osed by this driver. While the methodol= ogy of creating the array of the various callouts is inconsequential, it does demonstrate proper use of fill= ing out the FWPS_CALLOUT object and calling FwpsCalloutReg= ister and FwpsCalloutUnregisterByKey.

The ClassifyFunctions_*are files which contain the var= ious FWPS_CALLOUT_CLASSIFY_FN and the work they perform. The classifyFns are all laid out the same:

· Cla= ssify* functions are the initial classify. This function will see if any further processing is needed, and if so, which Tri= gger function to call (inline (synchronous) or out of band (asynchronous)).

· Tri= gger* are functions which packages the data of the initial classify and either send i= t to the appropriate Perform function or to the WorkItemRou= tine, DeferredProcedureCall, or = TDeferredProcedureCall.

· *WorkItemRoutine are fu= nctions which finish packaging the necessary data, and queues a WorkItem for asynchronous processing at PASSIVE_LEVEL.

· *DeferredProcedureCall are functions which finish packaging the necessary data, and queuesa DPC for asynchronous processing at PASSIVE_LEVEL. This is the default out of band method.=

· *Pe= rform are functions which do the actual processing desired by the callout.

<= ![endif]>

The CompletionFunctions_* are files which contain the va= rious FWPS_INJECT_COMPLETE.

The NotifyFunctions_* are files which contain the va= rious FWPS_CALLOUT_NOTIFY_FN and FWPS_CALLOUT_FLOW_DELETE_NOTIFY_FN.

The SubscriptionFunctions_* are files which contain the va= rious callbacks used by subscriptions.

WFPSamplerCalloutDriver.InX is a file used in creation of the = Inf used to install the driver.

<= ![endif]>

Figure B. Packet Traversal=

WFPSamplerProxyService.Exe

Usage:

This is the service which listens for connections to p= roxy.

“WFPSamplerPr= oxyService.Exe -i“ will install the service. While installed, the service is under t= he control of the Service Control Manager (as WFPSamplerP= roxy). The service is set to autostart.

“WFPSamplerPr= oxyService.Exe -u“ will uninstall the service.

Source:

The executable is located under P= roxySvc and is comprised of the following files:

v Framework_ProxySvc.CPP

v Framework_ProxySvc.H

v Framework_ProxySvc.RC

v Framework_ProxySvc_Msg.MC

v ThreadRoutines_Include.= H

v ThreadRoutines_TCPListener.CPP

v ThreadRoutines_TCPListe= ner.H

v ThreadRoutines_UDPListener.CPP

v ThreadRoutines_UDPListe= ner.H

The Framework= _* files contain functions for creating and maintaining the service such as ServiceMain. These are relatively safe to ignore if you are only concerned with WFP functional= ity.

The ThreadRoutines_*files contain functions for maintaining the proxy. These are relatively safe to ignore if you are only concerned with WFP functionality.=

WFPSampler.Lib

Usage:

This is a library of user mode helper functions used throughout the project.

Source:

This library is located under Lib and is comprised of = the following files:

v HelperFunctions_FwpmCallout.CPP

v HelperFunctions_FwpmCal= lout.H

v HelperFunctions_FwpmEngine.CPP

v HelperFunctions_FwpmEng= ine.H

v HelperFunctions_FwpmFilter.CPP

v HelperFunctions_FwpmFil= ter.H

v HelperFunctions_FwpmLayer.CPP

v HelperFunctions_FwpmLay= er.H

v HelperFunctions_FwpmProvider.CPP

v HelperFunctions_FwpmPro= vider.H

v HelperFunctions_FwpmProviderContext.CPP

v HelperFunctions_FwpmPro= viderContext.H

v HelperFunctions_FwpmSubLayer.CPP

v HelperFunctions_FwpmSub= Layer.H

v HelperFunctions_FwpmTransaction.CPP

v HelperFunctions_FwpmTra= nsaction.H

v HelperFunctions_GUID.CPP

v HelperFunctions_GUID.H<= /span>

v HelperFunctions_Include= .H

v HelperFunctions_IPAddress.CPP

v HelperFunctions_IPAddre= ss.H

v HelperFunctions_Log.CPP

v HelperFunctions_Log.H

v HelperFunctions_MACAddress.CPP

v HelperFunctions_MACAddr= ess.H

v HelperFunctions_Macros.= H

v HelperFunctions_Process.CPP

v HelperFunctions_Process= .H

v HelperFunctions_Registry.CPP

v HelperFunctions_Registr= y.H

v HelperFunctions_Service.CPP

v HelperFunctions_Service= .H

v HelperFunctions_SID.CPP

v HelperFunctions_SID.H

v HelperFunctions_Strings.CPP

v HelperFunctions_Strings= .H

v HelperFunctions_ThreadPools.CPP

v HelperFunctions_ThreadP= ools.H

v HelperFunctions_ThreadsAndEvents.CPP

v HelperFunctions_Threads= AndEvents.H

v HelperFunctions_WinSock.CPP

v HelperFunctions_WinSock= .H

If you are interested only in the WFP functionality, t= hen most attention should be with the HelperFunctions_Fwpm= * and HelperFunctions_WinSock.CPP.

WFPSamplerSys.Lib

Usage:

This is a library of kernel mode helper functions used throughout the project.

Source:

This library is located under Sys= Lib and is comprised of the following files:

v HelperFunctions_ClassifyData.CPP

v HelperFunctions_Classif= yData.H

v HelperFunctions_DeferredProcedureCalls.CPP

v HelperFunctions_Deferre= dProcedureCalls.H

v HelperFunctions_FlowContext.CPP

v HelperFunctions_FlowCon= text.H

v HelperFunctions_FwpObjects.CPP

v HelperFunctions_FwpObje= cts.H

v HelperFunctions_Headers.CPP

v HelperFunctions_Headers= .H

v HelperFunctions_ICMPMes= sages.H

v HelperFunctions_Include= .H

v HelperFunctions_InjectionData.CPP

v HelperFunctions_Injecti= onData.H

v HelperFunctions_Macros.= H

v HelperFunctions_NDIS.CPP

v HelperFunctions_NDIS.H<= /span>

v HelperFunctions_NetBuffer.CPP

v HelperFunctions_NetBuff= er.H

v HelperFunctions_NotifyD= ata.H

v HelperFunctions_PendData.CPP

v HelperFunctions_PendDat= a.H

v HelperFunctions_RedirectData.CPP

v HelperFunctions_Redirec= tData.H

v HelperFunctions_WorkItems.CPP

v HelperFunctions_WorkIte= ms.H

If you are interested only in the WFP functionality, t= hen most attention should be with HelperFunctions_FwpObjects.CPP.

Miscellaneous

HCK

Usage:

This directory contains an answer and info file that c= an be used in conjunction with the Windows Hardware Certification Kit. To validate that the WFPSampler is full= y WHCK compliant, you can install the WFPSampler on a WHCK client machine, and run= the WindowsFilteringPlatform_Tests. When prompted by the test to populate t= he info file, copy these files to %WinDir%\System3= 2\WFPLogo.Answer and %WinDir%\System32\WFPLogo.Info. Exit out of the WFPLogo.Info that is currently displ= ayed (without saving). Press “OK” to have the test continue<= /span>.

Source:

v WFPLogo_WFPSampler.Answ= er

v WFPLogo_WFPSampler.Info=

IDL

Usage:

This directory contains files used by the MIDL compile= r to create the RPC interface between WFPSampler.Exe and WFPSamplerService.Exe

Source:

v WFPSamplerRPC.ACF

v WFPSamplerRPC.IDL

Scripts

Usage:

This directory contains scripts used to install and uninstall the WFPSampler.

Sources:

v WFPSamplerInstall.cmd

“WFPSamplerIn= stall.cmd“ will copy the necessary binaries to their appropriate location, and install each component.

“WFPSamplerIn= stall.cmd -r “ will uninstall each component and remov= e the binaries from the appropriate location.