https://github.com/wiresock/wfpcalloutexplorer
Simple command line tool to enumerate loaded WFP callout drivers
https://github.com/wiresock/wfpcalloutexplorer
callout drivers filtering platform windows
Last synced: 2 months ago
JSON representation
Simple command line tool to enumerate loaded WFP callout drivers
- Host: GitHub
- URL: https://github.com/wiresock/wfpcalloutexplorer
- Owner: wiresock
- Created: 2023-09-04T12:45:28.000Z (almost 2 years ago)
- Default Branch: master
- Last Pushed: 2024-02-02T11:30:23.000Z (over 1 year ago)
- Last Synced: 2025-03-21T09:35:17.883Z (3 months ago)
- Topics: callout, drivers, filtering, platform, windows
- Language: C++
- Homepage:
- Size: 23.4 KB
- Stars: 7
- Watchers: 4
- Forks: 4
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# WFPCalloutExplorer
`WFPCalloutExplorer` is a specialized tool meticulously designed to identify currently loaded Windows Filtering Platform (WFP) callout filter drivers. It achieves this objective by scrutinizing whether these drivers import the vital `FWPKCLNT!FwpsCalloutRegister` function.
## Prerequisites
- Visual Studio 2022.
- Dependency on `pe-parse`. You can easily install it using `vcpkg` with the following commands:
```bash
vcpkg install pe-parse:x64-windows pe-parse:x86-windows pe-parse:arm64-windows pe-parse:x64-windows-static pe-parse:x86-windows-static pe-parse:arm64-windows-static
```
## Usage
1. Build the `WFPCalloutExplorer` project using Visual Studio 2022.
2. Run the executable. The program will dynamically load the `ntdll.dll`, query system modules, and inspect each module to determine if it is a WFP callout filter driver.
Alternatively, precompiled binaries for `x86`, `x64`, and `arm64` platforms are available in the [Releases section](https://github.com/wiresock/WFPCalloutExplorer/releases) of this repository.
## Functionality
- Dynamically retrieves system modules using the `NtQuerySystemInformation` function.
- Translates the path of system modules to ensure correct file paths.
- Parses the PE headers of modules to identify if they link against the `FWPKCLNT.SYS` library and import the `FwpsCalloutRegister` function.
## Output
The program outputs the names of drivers that are highly likely to be WFP callout filters based on their imports.