A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #21279  by ithurricane
 Wed Oct 30, 2013 1:16 am
Hello to all.
Newbie question:

I am working on TDI Filter network firewall.
Not long ago I make the test on Windows 8.1,
and my TDI Filter work well on firefox and chrome,
but TDI Filter can't capture TDI_CONNECT event in IE11...

so i wonder that how to capture TDI_CONNECT in IE11 on Windows 8.1?
How to solve this problem?
 #21361  by Dmitry Varshavsky
 Thu Nov 07, 2013 4:20 pm
ithurricane wrote:Hello to all.
Newbie question:

I am working on TDI Filter network firewall.
Not long ago I make the test on Windows 8.1,
and my TDI Filter work well on firefox and chrome,
but TDI Filter can't capture TDI_CONNECT event in IE11...

so i wonder that how to capture TDI_CONNECT in IE11 on Windows 8.1?
How to solve this problem?
The first thing is that TDI filtering is deprecated in Windows Vista and later. Why don't you use a WFP ?
Also, I didn't completely understand what do you mean by TDI_CONNECT event ?
Your TDI filter migth catch TDI_CONNECT IoControlCode in both IRP_MJ_DEVICE_CONTROL and IRP_MJ_INTERNAL_DEVICE_CONTROL handlers AND you might be also interested in intercepting of setting of TDI_EVENT_CONNECT handler in TDI_SET_EVENT_HANDLER.
What actually did you implement?
 #21384  by ithurricane
 Wed Nov 13, 2013 1:36 am
Dmitry Varshavsky wrote:
ithurricane wrote:Hello to all.
Newbie question:

I am working on TDI Filter network firewall.
Not long ago I make the test on Windows 8.1,
and my TDI Filter work well on firefox and chrome,
but TDI Filter can't capture TDI_CONNECT event in IE11...

so i wonder that how to capture TDI_CONNECT in IE11 on Windows 8.1?
How to solve this problem?
The first thing is that TDI filtering is deprecated in Windows Vista and later. Why don't you use a WFP ?
Also, I didn't completely understand what do you mean by TDI_CONNECT event ?
Your TDI filter migth catch TDI_CONNECT IoControlCode in both IRP_MJ_DEVICE_CONTROL and IRP_MJ_INTERNAL_DEVICE_CONTROL handlers AND you might be also interested in intercepting of setting of TDI_EVENT_CONNECT handler in TDI_SET_EVENT_HANDLER.
What actually did you implement?

Thank you, I will use WFP to solve it:-)