0

Is it possible to implement user mode callouts in WFP (Windows Filtering Platform)? If so please share some related links or sample code.

2 Answers 2

2

No it is not possible at this time. Although much of the Windows Filtering Platform (WFP) API is available in user mode you will trip over a version of this API call when you attempt to register a callout:

FwpsCalloutRegister3(
   _Inout_ void* deviceObject,
   _In_ const FWPS_CALLOUT3* callout,
   _Out_opt_ UINT32* calloutId
   );

It's the only way to register your classify/notify functions with WFP and if you're not a kernel device driver then you will not have a deviceObject to pass to this API call.

1

From MSDN:

User Mode vs. Kernel Mode

If the desired filtering can be done by using the standard filtering functionality that is built in to the Windows Filtering Platform, independent software vendors (ISVs) should write user-mode management applications to configure the filter engine instead of writing kernel-mode callout drivers. A kernel-mode callout driver should only be written when you must process the network data in ways that cannot be handled by the standard, built-in filtering functionality. For information about how to write a user-mode Windows Filtering Platform management application, see the Windows Filtering Platform documentation in the Microsoft Windows SDK.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.