1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
---
page_type: sample
description: "Demonstrates replacing a string pattern for a Transmission Control Protocol (TCP) connection using the Windows Filtering Platform (WFP)."
languages:
- cpp
products:
- windows
- windows-wdk
---
# Windows Filtering Platform Stream Edit Sample
This sample driver demonstrates replacing a string pattern for a Transmission Control Protocol (TCP) connection using the Windows Filtering Platform (WFP).
## Universal Windows Driver Compliant
This sample builds a Universal Windows Driver. It uses only APIs and DDIs that are included in OneCoreUAP.
The sample consists of a kernel-mode Windows Filtering Platform (WFP) callout driver (Stmedit.sys) that can operate in one of the following modes:
- Inline editing where all modification is done within the `ClassifyFn` callout function.
- Out-of-band editing where all modification is done by a worker thread (the default).
The sample performs inspection for both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) traffic.
Before experimenting with the sample, add an exception for the InspectionPort to your host firewall.
## Automatic deployment
Before you automatically deploy a driver, you must provision the target computer. For instructions, see [Provision a computer for driver deployment and testing](https://docs.microsoft.com/windows-hardware/drivers/gettingstarted/provision-a-target-computer-wdk-8-1).
After you have provisioned the target computer, continue with these steps:
1. On the host computer, in Visual Studio, in Solution Explorer, right click **package** (lower case), and choose **Properties**. Navigate to **Configuration Properties \> Driver Install \> Deployment**.
1. Check **Enable deployment**, and check **Remove previous driver versions before deployment**. For **Target Computer Name**, select the name of a target computer that you provisioned previously. Select **Do not install**. Click **OK**.
1. On the **Build** menu, choose **Build Solution**.
1. On the target computer, navigate to DriverTest\\Drivers, and locate the file stmedit.inf. Right click stmedit.inf, and choose **Install**.
## Manual deployment
Before you manually deploy a driver, you must turn on test signing and install a certificate on the target computer. You also need to copy the [DevCon](https://docs.microsoft.com/windows-hardware/drivers/devtest/devcon) tool to the target computer. For instructions, see [Preparing a Computer for Manual Driver Deployment](https://docs.microsoft.com/windows-hardware/drivers/develop/preparing-a-computer-for-manual-driver-deployment).
After you have prepared the target computer for manual deployment, continue with these steps:
1. Copy all of the files in your driver package to a folder on the target computer (for example, c:\\WfpStreamEditSamplePackage).
1. On the target computer, navigate to your driver package folder. Right click stmedit.inf, and choose **Install**
## Create Registry values
- On the target computer, open Regedit, and navigate to this key:
**HKLM**\\**System**\\**CurrentControlSet**\\**Services**\\**strmedit**\\**Parameters**
You can create and set values for the following registry entries.
- **StringToFind** (REG_SZ, default = "rainy")
- **StringX** (REG_SZ, default = "cloudy")
- **StringToReplace** (REG_SZ, default = "sunny")
- **InspectionLocalPort** (REG_DWORD, default = 8888)
- **InspectionRemotePort** (REG_DWORD, default = 0)
> [!NOTE]
> For this sample, a local or remote port is mandatory. Both cannot be zero.
- **InspectioDirection** (REG_DWORD, default = 2) Possible values : 2 (inbound + outbound), 0 (FWP_DIRECTION_OUTBOUND), 1 (FWP_DIRECTION_INBOUND)
- **MultipleCallouts** (REG_DWORD, default = true/1) Controls registration of multiple callouts. Set 0 for false, other for TRUE
- **BusyThreshold** (REG_DWORD, default = 16KB) BusyThreshold value is in KBs (e.g. a value of 5 means 5KB)
## Start the stmedit service
On the target computer, open a Command Prompt window as Administrator, and enter **net start stmedit**. (To stop the driver, enter **net stop stmedit**.)
## Remarks
For more information on creating a Windows Filtering Platform Callout Driver, see [Windows Filtering Platform Callout Drivers](https://docs.microsoft.com/windows-hardware/drivers/network/windows-filtering-platform-callout-drivers2).
|
