WFP callout and NDIS LWF can't sit inside the same driver binary

Question

I am developing WinPcap, a NDIS Light-Weight Filter driver. In order to capturing loopback packets, I have also made a Windows Filtering Platform (WFP) callout driver. And I have integrated these two parts together in one driver binary. But the new driver cannot run when system get restarted.

For now, I just abandoned the WFP callout INF file, and only used the NDIS filter INF to install this integrated driver (I don't know how to use two INF files for one driver binary), it can be installed with no problem and works fine (I mean I can capture loopback packets via WFP). But when the system restarted, the driver won't be loaded, and when I run "net start npf" (npf is the driver service name), it says:

C:\Windows\system32>net start npf
System error 2 has occurred.

The system cannot find the file specified.

Then I commented all WFP code and lib imports (fwpkclnt.lib and uuid.lib) in my driver, the driver runs good after restarted. So the WFP callout INF missing thing should be the cause. But I don't know how to write the INF file for this new driver.

1) How to install this driver mixed with NDIS filter and WFP callout? I know that NDIS filter uses INetCfg API to install and WFP callout can be installed by right-clicking the inf file and choosing "install" (I don't know its programmatical way). These two methods seem to be different.

2) How to write the INF file, especially the Device Setup Class? NDIS filter's class is NetService, but WFP callout's is WFPCALLOUTS. Can I specify two classes in one INF file? Or I should provide two INF files? What if I don't provide the right INF file? Like I provide the INF file with NetService class only, will the WFP callout part work?

My NDIS filter INF file is like:

[version]
Signature       = "$Windows NT$"
Class           = NetService
ClassGUID       = {4D36E974-E325-11CE-BFC1-08002BE10318}
CatalogFile     = npcap.cat
Provider        = %Insecure%
DriverVer=05/15/2015,14.48.38.905

And the WFP callout is like:

[Version]
Signature = "$WINDOWS NT$"
Class = WFPCALLOUTS
ClassGuid = {57465043-616C-6C6F-7574-5F636C617373}
Provider = %LBTest%
CatalogFile = LBTest.cat
Thanks!

Yang Luo Yang Luo · Accepted Answer · 2015-12-29T16:30:24

I have solved this problem. The answer is:

provide two INFs, one for LWF and one for WFP callout.
install the same binary twice: install the binary using WFP callout way first, then install the binary using LWF way. Uninstallation should be reversed.

The code is already working, see here: https://github.com/nmap/npcap

WFP callout and NDIS LWF can't sit inside the same driver binary

1 Answers