Windows Filtering
Platform (WFP) Sampler

The WFPSampler is a fully functional firewall comprised of
the following binaries:

v
WFPSampler.exe

v
WFPSamplerService.Exe

v
WFPSamplerCalloutDriver.Sys

v
WFPSamplerProxyService.Exe

WFPSampler.Exe

Usage:

This executable is the command-line interface used by the
user to define the policy.

“WFPSampler.exe -?”
provides output of valid parameters to pass.

“WFPSampler.exe -s
<SCENARIO> -?” provides output of valid parameters pertaining to that
scenario.

Source:

The executable is located under exe and is comprised of the
following files:

v
Framework_RPCClientInterface.CPP

v
Framework_RPCClientInterface.H

v
Framework_WFPSampler.CPP

v
Framework_WFPSampler.H

v
Framework_WFPSampler.rc

v
HelperFunctions_CommandLine.CPP

v
HelperFunctions_CommandLine.H

v
Scenarios_AppContainers.CPP

v
Scenarios_AppContainers.H

v
Scenarios_BasicAction.CPP

v
Scenarios_BasicAction.H

v
Scenarios_BasicPacketExamination.CPP

v
Scenarios_BasicPacketExamination.H

v
Scenarios_BasicPacketInjection.CPP

v
Scenarios_BasicPacketInjection.H

v
Scenarios_BasicPacketModification.CPP

v
Scenarios_BasicPacketModification.H

v
Scenarios_BasicStreamInjection.CPP

v
Scenarios_BasicStreamInjection.H

v
Scenarios_FastPacketInjection.CPP

v
Scenarios_FastPacketInjection.H

v
Scenarios_FastStreamInjection.CPP

v
Scenarios_FastStreamInjection.H

v
Scenarios_FlowAssociation.CPP

v
Scenarios_FlowAssociation.H

v
Scenarios_Include.H

v
Scenarios_PendAuthorization.CPP

v
Scenarios_PendAuthorization.H

v
Scenarios_PendEndpointClosure.CPP

v
Scenarios_PendEndpointClosure.H

v
Scenarios_Proxy.CPP

v
Scenarios_Proxy.H

and links with lib\WFPSampler.lib.

The Framework_*
files contain functions for creating and maintaining the executable such as wmain.  These are
relatively safe to ignore if you are only concerned with WFP functionality.

The HelperFunctions_CommandLine.*
are files which assist with parsing of the command line parameters passed.  This has the building blocks for the
FWPM_FILTER and FWPM_PROVIDER_CONTEXT that the WFPSamplerService.Exe uses for
defining policy.

The Scenarios_*
are files which gather and package all the data required by the
WFPSamplerService.Exe.  The packaged data
is sent to the WFPSamplerService.Exe via local RPC interfaces exposed by the
service.

Figure A.   Interaction between modules

WFPSamplerService.Exe

Usage:

This is the service which instructs BFE to add or remove
policies.

“WFPSamplerService.Exe
-i“ installs the
service.  While installed, the service is
under the control of the Service Control Manager (as WFPSampler).  The service is set to autostart
and depends on BFE.

“WFPSamplerService.Exe
-u“ uninstalls the service.

Source:

The executable is located under svc and is comprised of the
following files:

v
Framework_ActionCenter.CPP *

v
Framework_ActionCenter.H
*

v
Framework_Include.H

v
Framework_RPCServerInterface.CPP

v
Framework_RPCServerInterface.H

v
Framework_WFPSamplerService.CPP

v
Framework_WFPSamplerService.H

v
Framework_WFPSamplerService.RC

v
Framework_WFPSamplerService_Msg.MC

v
Framework_WindowsFirewall.CPP

v
Framework_WindowsFirewall.H

v
Scenarios_AppContainers.CPP

v
Scenarios_BasicAction.CPP

v
Scenarios_BasicPacketExamination.CPP

v
Scenarios_BasicPacketInjection.CPP

v
Scenarios_BasicPacketModification.CPP

v
Scenarios_BasicStreamInjection.CPP

v
Scenarios_FastPacketInjection.CPP

v
Scenarios_FastStreamInjection.CPP

v
Scenarios_FlowAssociation.CPP

v
Scenarios_PendAuthorization.CPP

v
Scenarios_PendEndpointClosure.CPP

v
Scenarios_Proxy.CPP

*Available
only under Non Disclosure Agreement (NDA)

and links with lib\WFPSampler.lib.

The Framework_*
files contain functions for creating and maintaining the service such as ServiceMain.  These
are relatively safe to ignore if you are only concerned with WFP functionality
with the following exceptions:  Framework_WindowsFirewall.CPP
demonstrates how to properly disable Microsoft Windows Firewall, and if you
have a signed NDA agreement, Framework_ActionCenter.CPP
demonstrates how to register with Microsoft Windows Action Center.

The Scenarios_*
files finish creating the filters and provider contexts required by each
scenario.  These are then added to the
system using Fwpm Management calls.

WFPSamplerCalloutDriver.Sys

Usage:

This is the driver which houses the various callout
functions.

Source:

This driver is located under sys and is comprised of the
following files:

v
ClassifyFunctions_BasicActionCallouts.CPP

v
ClassifyFunctions_BasicActionCallouts.H

v
ClassifyFunctions_BasicPacketExaminationCallouts.CPP

v
ClassifyFunctions_BasicPacketExaminationCallouts.H

v
ClassifyFunctions_BasicPacketInjectionCallouts.CPP

v
ClassifyFunctions_BasicPacketInjectionCallouts.H

v
ClassifyFunctions_BasicPacketModificationCallouts.CPP

v
ClassifyFunctions_BasicPacketModificationCallouts.H

v
ClassifyFunctions_BasicStreamInjectionCallouts.CPP

v
ClassifyFunctions_BasicStreamInjectionCallouts.H

v
ClassifyFunctions_FastPacketInjectionCallouts.CPP

v
ClassifyFunctions_FastPacketInjectionCallouts.H

v
ClassifyFunctions_FastStreamInjectionCallouts.CPP

v
ClassifyFunctions_FastStreamInjectionCallouts.H

v
ClassifyFunctions_Include.H

v
ClassifyFunctions_PendAuthorizationCallouts.CPP

v
ClassifyFunctions_PendAuthorizationCallouts.H

v
ClassifyFunctions_PendEndpointClosureCallouts.CPP

v
ClassifyFunctions_PendEndpointClosureCallouts.H

v
ClassifyFunctions_ProxyCallouts.CPP

v
ClassifyFunctions_ProxyCallouts.H

v
CompletionFunctions_BasicPacketInjectionCallouts.CPP

v
CompletionFunctions_BasicPacketInjectionCallouts.H

v
CompletionFunctions_BasicPacketModificationCallouts.CPP

v
CompletionFunctions_BasicPacketModificationCallouts.H

v
CompletionFunctions_BasicStreamInjectionCallouts.CPP

v
CompletionFunctions_BasicStreamInjectionCallouts.H

v
CompletionFunctions_FastPacketInjectionCallouts.CPP

v
CompletionFunctions_FastPacketInjectionCallouts.H

v
CompletionFunctions_FastStreamInjectionCallouts.CPP

v
CompletionFunctions_FastStreamInjectionCallouts.H

v
CompletionFunctions_Include.H

v
CompletionFunctions_PendAuthorizationCallouts.CPP

v
CompletionFunctions_PendAuthorizationCallouts.H

v
CompletionFunctions_ProxyCallouts.CPP

v
CompletionFunctions_ProxyCallouts.H

v
Framework_Events.CPP

v
Framework_Events.H

v
Framework_Include.H

v
Framework_PowerStates.CPP

v
Framework_PowerStates.H

v
Framework_WFPSamplerCalloutDriver.CPP

v
Framework_WFPSamplerCalloutDriver.H

v
Framework_WFPSamplerCalloutDriver.rc

v
HelperFunctions_ExposedCallouts.CPP

v
HelperFunctions_ExposedCallouts.H

v
NotifyFunctions_BasicCallouts.CPP

v
NotifyFunctions_BasicCallouts.H

v
NotifyFunctions_FastCallouts.CPP

v
NotifyFunctions_FastCallouts.H

v
NotifyFunctions_FlowDelete.CPP

v
NotifyFunctions_FlowDelete.H

v
NotifyFunctions_Include.H

v
NotifyFunctions_PendCallouts.CPP

v
NotifyFunctions_PendCallouts.H

v
NotifyFunctions_ProxyCallouts.CPP

v
NotifyFunctions_ProxyCallouts.H

v
SubscriptionFunctions_BFEState.CPP

v
SubscriptionFunctions_BFEState.H

v
SubscriptionFunctions_Include.H

v
WFPSamplerCalloutDriver.InX

and links with SysLib\WFPSamplerSys.Lib.

The Framework_* files
contain functions for creating and maintaining a filter driver using the
Microsoft Windows Driver Foundation.
These are relatively safe to ignore if you are only concerned with WFP
functionality.

HelperFunctions_ExposedCallouts.CPP
contains functions used to register and unregister the various callouts exposed
by this driver.  While the methodology of
creating the array of the various callouts is inconsequential,   it does demonstrate proper use of filling
out the FWPS_CALLOUT object and calling FwpsCalloutRegister
and FwpsCalloutUnregisterByKey.

The ClassifyFunctions_*are files which contain the various
FWPS_CALLOUT_CLASSIFY_FN and the work they perform.  The classifyFns are
all laid out the same:

·
Classify*
functions are the initial classify.  This
function will see if any further processing is needed, and if so, which Trigger
function to call (inline (synchronous) or out of band (asynchronous)).

·
Trigger* are
functions which packages the data of the initial classify and either send it to
the appropriate Perform function or to the WorkItemRoutine,
DeferredProcedureCall, or TDeferredProcedureCall.

·
*WorkItemRoutine are functions
which finish packaging the necessary data, and queues a WorkItem
for asynchronous processing at PASSIVE_LEVEL.

·
*DeferredProcedureCall are
functions which finish packaging the necessary data, and queuesa
DPC for asynchronous processing at PASSIVE_LEVEL.  This is the default out of band method.

·
*Perform
are functions which do the actual processing desired by the callout.

The CompletionFunctions_* are files which contain the various
FWPS_INJECT_COMPLETE.

The NotifyFunctions_* are files which contain the various
FWPS_CALLOUT_NOTIFY_FN and FWPS_CALLOUT_FLOW_DELETE_NOTIFY_FN.

The SubscriptionFunctions_* are files which contain the various
callbacks used by subscriptions.

WFPSamplerCalloutDriver.InX
is a file used in creation of the Inf
used to install the driver.

Figure B.   Packet Traversal

WFPSamplerProxyService.Exe

Usage:

This is the service which listens for connections to proxy.

“WFPSamplerProxyService.Exe
-i“  will install the service.  While installed, the service is under the
control of the Service Control Manager (as WFPSamplerProxy).  The service is set to autostart.

“WFPSamplerProxyService.Exe
-u“ will uninstall the service.

Source:

The executable is located under ProxySvc
and is comprised of the following files:

v
Framework_ProxySvc.CPP

v
Framework_ProxySvc.H

v
Framework_ProxySvc.RC

v
Framework_ProxySvc_Msg.MC

v
ThreadRoutines_Include.H

v
ThreadRoutines_TCPListener.CPP

v
ThreadRoutines_TCPListener.H

v
ThreadRoutines_UDPListener.CPP

v
ThreadRoutines_UDPListener.H

The Framework_*
files contain functions for creating and maintaining the service such as ServiceMain.  These
are relatively safe to ignore if you are only concerned with WFP functionality.

The ThreadRoutines_*files contain functions for
maintaining the proxy.  These are
relatively safe to ignore if you are only concerned with WFP functionality.

WFPSampler.Lib

Usage:

This is a library of user mode helper functions used
throughout the project.

Source:

This library is located under Lib and is comprised of the
following files:

v
HelperFunctions_FwpmCallout.CPP

v
HelperFunctions_FwpmCallout.H

v
HelperFunctions_FwpmEngine.CPP

v
HelperFunctions_FwpmEngine.H

v
HelperFunctions_FwpmFilter.CPP

v
HelperFunctions_FwpmFilter.H

v
HelperFunctions_FwpmLayer.CPP

v
HelperFunctions_FwpmLayer.H

v
HelperFunctions_FwpmProvider.CPP

v
HelperFunctions_FwpmProvider.H

v
HelperFunctions_FwpmProviderContext.CPP

v
HelperFunctions_FwpmProviderContext.H

v
HelperFunctions_FwpmSubLayer.CPP

v
HelperFunctions_FwpmSubLayer.H

v
HelperFunctions_FwpmTransaction.CPP

v
HelperFunctions_FwpmTransaction.H

v
HelperFunctions_GUID.CPP

v
HelperFunctions_GUID.H

v
HelperFunctions_Include.H

v
HelperFunctions_IPAddress.CPP

v
HelperFunctions_IPAddress.H

v
HelperFunctions_Log.CPP

v
HelperFunctions_Log.H

v
HelperFunctions_MACAddress.CPP

v
HelperFunctions_MACAddress.H

v
HelperFunctions_Macros.H

v
HelperFunctions_Process.CPP

v
HelperFunctions_Process.H

v
HelperFunctions_Registry.CPP

v
HelperFunctions_Registry.H

v
HelperFunctions_Service.CPP

v
HelperFunctions_Service.H

v
HelperFunctions_SID.CPP

v
HelperFunctions_SID.H

v
HelperFunctions_Strings.CPP

v
HelperFunctions_Strings.H

v
HelperFunctions_ThreadPools.CPP

v
HelperFunctions_ThreadPools.H

v
HelperFunctions_ThreadsAndEvents.CPP

v
HelperFunctions_ThreadsAndEvents.H

v
HelperFunctions_WinSock.CPP

v
HelperFunctions_WinSock.H

If you are interested only in the WFP functionality, then
most attention should be with the HelperFunctions_Fwpm*
and HelperFunctions_WinSock.CPP.

WFPSamplerSys.Lib

Usage:

This is a library of kernel mode helper functions used
throughout the project.

Source:

This library is located under SysLib
and is comprised of the following files:

v
HelperFunctions_ClassifyData.CPP

v
HelperFunctions_ClassifyData.H

v
HelperFunctions_DeferredProcedureCalls.CPP

v
HelperFunctions_DeferredProcedureCalls.H

v
HelperFunctions_FlowContext.CPP

v
HelperFunctions_FlowContext.H

v
HelperFunctions_FwpObjects.CPP

v
HelperFunctions_FwpObjects.H

v
HelperFunctions_Headers.CPP

v
HelperFunctions_Headers.H

v
HelperFunctions_ICMPMessages.H

v
HelperFunctions_Include.H

v
HelperFunctions_InjectionData.CPP

v
HelperFunctions_InjectionData.H

v
HelperFunctions_Macros.H

v
HelperFunctions_NDIS.CPP

v
HelperFunctions_NDIS.H

v
HelperFunctions_NetBuffer.CPP

v
HelperFunctions_NetBuffer.H

v
HelperFunctions_NotifyData.H

v
HelperFunctions_PendData.CPP

v
HelperFunctions_PendData.H

v
HelperFunctions_RedirectData.CPP

v
HelperFunctions_RedirectData.H

v
HelperFunctions_WorkItems.CPP

v
HelperFunctions_WorkItems.H

If you are interested only in the WFP functionality, then
most attention should be with HelperFunctions_FwpObjects.CPP.

Miscellaneous

HCK

Usage:

This directory contains an answer and info file that can be
used in conjunction with the Windows Hardware Certification Kit.  To validate that the WFPSampler is fully WHCK
compliant, you can install the WFPSampler on a WHCK client machine, and run the
WindowsFilteringPlatform_Tests.  When prompted by the test to populate the
info file, copy these files to %WinDir%\System32\WFPLogo.Answer and %WinDir%\System32\WFPLogo.Info.  Exit
out of the WFPLogo.Info that is currently displayed
(without saving). Press “OK” to have the test continue.

Source:

v
WFPLogo_WFPSampler.Answer

v
WFPLogo_WFPSampler.Info

IDL

Usage:

This directory contains files used by the MIDL compiler to
create the RPC interface between WFPSampler.Exe and WFPSamplerService.Exe

Source:

v
WFPSamplerRPC.ACF

v
WFPSamplerRPC.IDL

Scripts

Usage:

This directory contains scripts used to install and
uninstall the WFPSampler.

Sources:

v
WFPSamplerInstall.cmd

“WFPSamplerInstall.cmd“ will copy the necessary binaries to their appropriate
location, and install each component.

“WFPSamplerInstall.cmd
-r “ will uninstall each component and remove the binaries
from the appropriate location.