A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #27059  by Vrtule
 Mon Oct 26, 2015 4:16 pm
If you wish to bypass it from kernelmode, try to use Winsock Kernel (WskXxx routines). MSDN says that TDI on Vista and newer systems is implemented via WSK (sbecause it is deprecated), so I expect that Wsk routines do not pass data through TDI.

I actually do not know how TDI filters work. But if they only attach their devices itno device stacks of the TDI driver \Driver\tdix), passing your TDI IRPs directly to the TDI devices should do the job.
 #27060  by fsdhook
 Mon Oct 26, 2015 4:32 pm
Vrtule wrote:If you wish to bypass it from kernelmode, try to use Winsock Kernel (WskXxx routines). MSDN says that TDI on Vista and newer systems is implemented via WSK (sbecause it is deprecated), so I expect that Wsk routines do not pass data through TDI.

I actually do not know how TDI filters work. But if they only attach their devices itno device stacks of the TDI driver \Driver\tdix), passing your TDI IRPs directly to the TDI devices should do the job.
Thanks for your reply. I try to bypass TDI/TDX filter for all programs. It means that "TDI/TDX filter is exist but not take effect".