Skip to content

Commit 7fa0494

Browse files
basil00basil00
committed
Various WinDivert improvements.
- Add UNBIND/DISCONNECT events to the SOCKET layer. These events can only be sniffed. - Remove the RECV_PARTIAL flag. The user application can just ignore the error code instead. - WINDIVERT_ADDRESS is now 64bytes. Some extra padding added for future-proofing. - Ignore SOCKET-layer REAUTHORIZE. - The REFLECT layer returns the filter object directly (no IPv4 "pseudo" packet).
1 parent 32c5aa9 commit 7fa0494

File tree

9 files changed

+510
-146
lines changed

9 files changed

+510
-146
lines changed

‎CHANGELOG

+19-13
Original file line numberDiff line numberDiff line change
@@ -167,10 +167,15 @@ WinDivert 2.0.0-rc
167167
deleted.
168168
* WINDIVERT_EVENT_SOCKET_BIND: (SOCKET layer) a socket bind()
169169
operation occurred.
170-
* WINDIVERT_EVENT_SOCKET_LISTEN: (SOCKET layer) a socket listen()
170+
* WINDIVERT_EVENT_SOCKET_UNBIND: (SOCKET layer) a previous binding
171+
is removed.
171172
operation occurred.
172173
* WINDIVERT_EVENT_SOCKET_CONNECT: (SOCKET layer) a socket connect()
173174
operation occurred.
175+
* WINDIVERT_EVENT_SOCKET_DISCONNECT: (SOCKET layer) a previous
176+
connection is terminated.
177+
* WINDIVERT_EVENT_SOCKET_LISTEN: (SOCKET layer) a socket listen()
178+
operation occurred.
174179
* WINDIVERT_EVENT_SOCKET_ACCEPT: (SOCKET layer) a socket accept()
175180
operation occurred.
176181
* WINDIVERT_EVENT_REFLECT_OPEN: (REFLECT layer) a WinDivertOpen()
@@ -217,28 +222,29 @@ WinDivert 2.0.0-rc
217222
packet/payload.
218223
* Negative, representing addressing from the end of the packet/payload.
219224
- The WinDivert filter language now supports several symbolic values:
220-
* ACCEPT: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_ACCEPT.
221-
* BIND: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_BIND.
222-
* CLOSE: (REFLECT layer) equal to WINDIVERT_EVENT_REFLECT_CLOSE.
223-
* DELETED: (FLOW LAYER) equal to WINDIVERT_EVENT_FLOW_DELETED.
225+
* PACKET: (NETWORK/NETWORK_FORWARD layers) equal to
226+
WINDIVERT_EVENT_NETWORK_PACKET
224227
* ESTABLISHED: (FLOW layer) equal to WINDIVERT_EVENT_FLOW_ESTABLISHED.
225-
* FLOW: (REFLECT layer) equal to WINDIVERT_LAYER_FLOW.
228+
* DELETED: (FLOW LAYER) equal to WINDIVERT_EVENT_FLOW_DELETED.
229+
* BIND: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_BIND.
230+
* UNBIND: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_UNBIND.
231+
* CONNECT: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_CONNECT.
232+
* DISCONNECT: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_DISCONNECT.
226233
* LISTEN: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_LISTEN.
227-
* NETWORK: (REFLECT layer) equal to WINDIVERT_LAYER_NETWORK.
228-
* NETWORK_FORWARD: (REFLECT layer) equal to
234+
* ACCEPT: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_ACCEPT.
229235
WINDIVERT_LAYER_NETWORK_FORWARD.
230236
* OPEN: (REFLECT layer) equal to WINDIVERT_EVENT_REFLECT_OPEN.
231-
* PACKET: (NETWORK/NETWORK_FORWARD layers) equal to
232-
WINDIVERT_EVENT_NETWORK_PACKET
233-
* REFLECT: (REFLECT layer) equal to WINDIVERT_LAYER_REFLECT.
237+
* CLOSE: (REFLECT layer) equal to WINDIVERT_EVENT_REFLECT_CLOSE.
238+
* NETWORK: (REFLECT layer) equal to WINDIVERT_LAYER_NETWORK.
239+
* NETWORK_FORWARD: (REFLECT layer) equal to
240+
* FLOW: (REFLECT layer) equal to WINDIVERT_LAYER_FLOW.
234241
* SOCKET: (REFLECT layer) equal to WINDIVERT_LAYER_SOCKET.
242+
* REFLECT: (REFLECT layer) equal to WINDIVERT_LAYER_REFLECT.
235243
- WinDivertOpen() now supports several new flags:
236244
* WINDIVERT_FLAG_RECV_ONLY/WINDIVERT_FLAG_READ_ONLY: The handle cannot
237245
be used for send operations.
238246
* WINDIVERT_FLAG_SEND_ONLY/WINDIVERT_FLAG_WRITE_ONLY: The handle cannot
239247
be used for receive operations.
240-
* WINDIVERT_FLAG_RECV_PARTIAL: The handle will support partial receives,
241-
meaning that the buffer can be smaller than the packet.
242248
* WINDIVERT_FLAG_NO_INSTALL: If the WinDivert driver is not already
243249
installed/loaded, then WinDivertOpen() will fail with an error.
244250
- WinDivertRecvEx()/WinDivertSendEx() now support a "batch" mode that

‎dll/windivert.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -365,6 +365,7 @@ extern HANDLE WinDivertOpen(const char *filter, WINDIVERT_LAYER layer,
365365
UINT obj_len;
366366
ERROR comp_err;
367367
DWORD err;
368+
BOOL sniff;
368369
HANDLE handle;
369370
SC_HANDLE service;
370371
UINT64 filter_flags;
@@ -404,7 +405,8 @@ extern HANDLE WinDivertOpen(const char *filter, WINDIVERT_LAYER layer,
404405
SetLastError(ERROR_INVALID_PARAMETER);
405406
return INVALID_HANDLE_VALUE;
406407
}
407-
filter_flags = WinDivertAnalyzeFilter(layer, object, obj_len);
408+
sniff = ((flags & WINDIVERT_FLAG_SNIFF) != 0);
409+
filter_flags = WinDivertAnalyzeFilter(layer, sniff, object, obj_len);
408410

409411
// Attempt to open the WinDivert device:
410412
handle = CreateFile(L"\\\\.\\" WINDIVERT_DEVICE_NAME,

‎dll/windivert_helper.c

+31-1
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,9 @@ typedef enum
147147
TOKEN_EVENT_ESTABLISHED,
148148
TOKEN_EVENT_DELETED,
149149
TOKEN_EVENT_BIND,
150+
TOKEN_EVENT_UNBIND,
150151
TOKEN_EVENT_CONNECT,
152+
TOKEN_EVENT_DISCONNECT,
151153
TOKEN_EVENT_LISTEN,
152154
TOKEN_EVENT_ACCEPT,
153155
TOKEN_EVENT_OPEN,
@@ -514,9 +516,15 @@ static BOOL WinDivertExpandMacro(KIND kind, WINDIVERT_LAYER layer,
514516
case TOKEN_EVENT_BIND:
515517
*val = WINDIVERT_EVENT_SOCKET_BIND;
516518
return (layer == WINDIVERT_LAYER_SOCKET);
519+
case TOKEN_EVENT_UNBIND:
520+
*val = WINDIVERT_EVENT_SOCKET_UNBIND;
521+
return (layer == WINDIVERT_LAYER_SOCKET);
517522
case TOKEN_EVENT_CONNECT:
518523
*val = WINDIVERT_EVENT_SOCKET_CONNECT;
519524
return (layer == WINDIVERT_LAYER_SOCKET);
525+
case TOKEN_EVENT_DISCONNECT:
526+
*val = WINDIVERT_EVENT_SOCKET_DISCONNECT;
527+
return (layer == WINDIVERT_LAYER_SOCKET);
520528
case TOKEN_EVENT_LISTEN:
521529
*val = WINDIVERT_EVENT_SOCKET_LISTEN;
522530
return (layer == WINDIVERT_LAYER_SOCKET);
@@ -547,6 +555,7 @@ static ERROR WinDivertTokenizeFilter(const char *filter, WINDIVERT_LAYER layer,
547555
{"CLOSE", TOKEN_EVENT_CLOSE, L____R},
548556
{"CONNECT", TOKEN_EVENT_CONNECT, L___S_},
549557
{"DELETED", TOKEN_EVENT_DELETED, L__F__},
558+
{"DISCONNECT", TOKEN_EVENT_DISCONNECT, L___S_},
550559
{"ESTABLISHED", TOKEN_EVENT_ESTABLISHED, L__F__},
551560
{"FLOW", TOKEN_FLOW, L____R},
552561
{"LISTEN", TOKEN_EVENT_LISTEN, L___S_},
@@ -556,6 +565,7 @@ static ERROR WinDivertTokenizeFilter(const char *filter, WINDIVERT_LAYER layer,
556565
{"PACKET", TOKEN_EVENT_PACKET, LNM___},
557566
{"REFLECT", TOKEN_REFLECT, L____R},
558567
{"SOCKET", TOKEN_SOCKET, L____R},
568+
{"UNBIND", TOKEN_EVENT_UNBIND, L___S_},
559569
{"and", TOKEN_AND, LNMFSR},
560570
{"event", TOKEN_EVENT, LNMFSR},
561571
{"false", TOKEN_FALSE, LNMFSR},
@@ -1968,7 +1978,7 @@ static void WinDivertEmitFilter(PEXPR *stack, UINT len, UINT16 label,
19681978
* Analyze a filter object.
19691979
*/
19701980
static UINT64 WinDivertAnalyzeFilter(WINDIVERT_LAYER layer,
1971-
PWINDIVERT_FILTER filter, UINT length)
1981+
BOOL sniff, PWINDIVERT_FILTER filter, UINT length)
19721982
{
19731983
BOOL result;
19741984
UINT64 flags = 0;
@@ -2041,9 +2051,25 @@ static UINT64 WinDivertAnalyzeFilter(WINDIVERT_LAYER layer,
20412051
result = WinDivertCondExecFilter(filter, length,
20422052
WINDIVERT_FILTER_FIELD_EVENT, WINDIVERT_EVENT_SOCKET_BIND);
20432053
flags |= (result? WINDIVERT_FILTER_FLAG_EVENT_SOCKET_BIND: 0);
2054+
if (sniff)
2055+
{
2056+
result = WinDivertCondExecFilter(filter, length,
2057+
WINDIVERT_FILTER_FIELD_EVENT,
2058+
WINDIVERT_EVENT_SOCKET_UNBIND);
2059+
flags |=
2060+
(result? WINDIVERT_FILTER_FLAG_EVENT_SOCKET_UNBIND: 0);
2061+
}
20442062
result = WinDivertCondExecFilter(filter, length,
20452063
WINDIVERT_FILTER_FIELD_EVENT, WINDIVERT_EVENT_SOCKET_CONNECT);
20462064
flags |= (result? WINDIVERT_FILTER_FLAG_EVENT_SOCKET_CONNECT: 0);
2065+
if (sniff)
2066+
{
2067+
result = WinDivertCondExecFilter(filter, length,
2068+
WINDIVERT_FILTER_FIELD_EVENT,
2069+
WINDIVERT_EVENT_SOCKET_DISCONNECT);
2070+
flags |=
2071+
(result? WINDIVERT_FILTER_FLAG_EVENT_SOCKET_DISCONNECT: 0);
2072+
}
20472073
result = WinDivertCondExecFilter(filter, length,
20482074
WINDIVERT_FILTER_FIELD_EVENT, WINDIVERT_EVENT_SOCKET_LISTEN);
20492075
flags |= (result? WINDIVERT_FILTER_FLAG_EVENT_SOCKET_LISTEN: 0);
@@ -4210,8 +4236,12 @@ static void WinDivertFormatTestExpr(PWINDIVERT_STREAM stream, PEXPR expr,
42104236
{
42114237
case WINDIVERT_EVENT_SOCKET_BIND:
42124238
WinDivertPutString(stream, "BIND"); break;
4239+
case WINDIVERT_EVENT_SOCKET_UNBIND:
4240+
WinDivertPutString(stream, "UNBIND"); break;
42134241
case WINDIVERT_EVENT_SOCKET_CONNECT:
42144242
WinDivertPutString(stream, "CONNECT"); break;
4243+
case WINDIVERT_EVENT_SOCKET_DISCONNECT:
4244+
WinDivertPutString(stream, "DISCONNECT"); break;
42154245
case WINDIVERT_EVENT_SOCKET_LISTEN:
42164246
WinDivertPutString(stream, "LISTEN"); break;
42174247
case WINDIVERT_EVENT_SOCKET_ACCEPT:

‎doc/windivert.html

+25-29
Original file line numberDiff line numberDiff line change
@@ -401,14 +401,19 @@ <h2>Table of Contents</h2>
401401
</p>
402402
<ul>
403403
<li> <code>WINDIVERT_EVENT_SOCKET_BIND</code>: A <code>bind()</code> operation.</li>
404-
<li> <code>WINDIVERT_EVENT_SOCKET_LISTEN</code>: A <code>listen()</code> operation.</li>
404+
<li> <code>WINDIVERT_EVENT_SOCKET_UNBIND</code>: A previous binding is
405+
removed.</li>
405406
<li> <code>WINDIVERT_EVENT_SOCKET_CONNECT</code>: A <code>connect()</code>
406407
operation.</li>
408+
<li> <code>WINDIVERT_EVENT_SOCKET_DISCONNECT</code>: A previous connection
409+
is terminated.</li>
410+
<li> <code>WINDIVERT_EVENT_SOCKET_LISTEN</code>: A <code>listen()</code> operation.</li>
407411
<li> <code>WINDIVERT_EVENT_SOCKET_ACCEPT</code>: An <code>accept()</code>
408412
operation.</li>
409413
</ul>
410414
<p>
411-
Socket events can be blocked but not injected.
415+
Socket events, except for <code>UNBIND</code>/<code>DISCONNECT</code>,
416+
can be blocked, and no socket event can be injected.
412417
Process ID information is available at this layer.
413418
Due to technical limitations, the
414419
<code>WINDIVERT_LAYER_SOCKET</code> layer cannot capture events that
@@ -429,8 +434,12 @@ <h2>Table of Contents</h2>
429434
Process ID information is available at this layer,
430435
meaning that it is possible to determine which (if any) process is using
431436
WinDivert.
432-
The layer also returns a <q>pseudo packet</q> that encodes the filter string
433-
associated with the event.
437+
The layer also returns an <q>object</q> representation of the filter string
438+
used to open the handle.
439+
The object representation can be converted back into a human-readable
440+
filter string using the
441+
<a href="#divert_helper_format_filter"><code>WinDivertHelperFormatFilter()</code></a>
442+
function.
434443
The <code>WINDIVERT_LAYER_REFLECT</code> layer can also capture events that
435444
occurred before the handle was opened.
436445
</p>
@@ -626,7 +635,7 @@ <h2>Table of Contents</h2>
626635
For IPv4, the <code>Socket.LocalAddr</code> and <code>Socket.RemoteAddr</code>
627636
fields will be IPv4-mapped IPv6 addresses.
628637
The <code>WINDIVERT_EVENT_SOCKET_BIND</code> and
629-
<code>WINDIVERT_EVENT_SOCKET_LISTEN</code> events will occur before a
638+
<code>WINDIVERT_EVENT_SOCKET_LISTEN</code> events can occur before a
630639
connection attempt has been made, meaning that the
631640
<code>Socket.RemoteAddr</code> and <code>Socket.RemotePort</code> fields
632641
for these events will be zero.
@@ -955,21 +964,6 @@ <h2>Table of Contents</h2>
955964
</tr>
956965
<tr>
957966
<td>
958-
<code>WINDIVERT_FLAG_RECV_PARTIAL</code>
959-
</td>
960-
<td>
961-
This flags enables <q>partial receives</q>.
962-
By default, if a packet is too big for the buffer passed to
963-
<a href="#divert_recv"><code>WinDivertRecv()</code></a>, the operation
964-
will fail with <code>ERROR_INSUFFICIENT_BUFFER</code>.
965-
This flag silences this error and only copies part of the packet
966-
up to the buffer size.
967-
The <code>WINDIVERT_FLAG_RECV_PARTIAL</code> behavior was the default
968-
on older (pre-2.0) versions of WinDivert.
969-
</td>
970-
</tr>
971-
<tr>
972-
<td>
973967
<code>WINDIVERT_FLAG_NO_INSTALL</code>
974968
</td>
975969
<td>
@@ -985,8 +979,7 @@ <h2>Table of Contents</h2>
985979
<p>
986980
Note that any combination of
987981
<code>(WINDIVERT_FLAG_SNIFF | WINDIVERT_FLAG_DROP)</code> or
988-
<code>(WINDIVERT_FLAG_RECV_ONLY | WINDIVERT_FLAG_SEND_ONLY)</code> or
989-
<code>(WINDIVERT_FLAG_RECV_PARTIAL | WINDIVERT_FLAG_SEND_ONLY)</code>
982+
<code>(WINDIVERT_FLAG_RECV_ONLY | WINDIVERT_FLAG_SEND_ONLY)</code>
990983
are considered invalid.
991984
</p>
992985
<p>
@@ -1165,10 +1158,11 @@ <h2>Table of Contents</h2>
11651158
the <code>pPacket</code> buffer.
11661159
If non-<code>NULL</code>, then the total number of bytes
11671160
written to <code>pPacket</code> will be written to <code>recvLen</code>.
1168-
Partial receives (where the packet data is truncated) is supported provided
1169-
the handle was opened with the <code>WINDIVERT_FLAG_RECV_PARTIAL</code> flag set,
1170-
otherwise the operation will fail with <code>ERROR_INSUFFICIENT_BUFFER</code>
1171-
if the <code>pPacket</code> buffer is too small.
1161+
If the <code>pPacket</code> buffer is too small, the packet will be
1162+
truncated and the operation will fail with the
1163+
<code>ERROR_INSUFFICIENT_BUFFER</code> error code.
1164+
This error can be ignored if the application only intends to receive part
1165+
of the packet, e.g., the IP headers only.
11721166
For layers that do not capture packets, the <code>pPacket</code> parameter
11731167
should be <code>NULL</code> and <code>packetLen</code> should be zero.
11741168
</p><p>
@@ -2372,8 +2366,8 @@ <h2>Table of Contents</h2>
23722366
This function is mainly useful for <q>decompiling</q> the filter object
23732367
representation back into a human-readable filter string representation.
23742368
One application is the <code>WINDIVERT_LAYER_REFLECT</code> layer,
2375-
where a <q>pseudo packet</q> containing a filter object is returned by
2376-
<a href="#divert_recv"><code>WinDivertRecv()</code></a>.
2369+
where the filter object associated with the reflection event is
2370+
returned by <a href="#divert_recv"><code>WinDivertRecv()</code></a>.
23772371
</p>
23782372
</dd></dl>
23792373

@@ -2635,9 +2629,11 @@ <h2>Table of Contents</h2>
26352629
<tr><td><code>PACKET</code></td><td>&#10004;</td><td>&#10004;</td><td></td><td></td><td></td><td><code>WINDIVERT_EVENT_NETWORK_PACKET</code></td></tr>
26362630
<tr><td><code>ESTABLISHED</code></td><td></td><td></td><td>&#10004;</td><td></td><td></td><td><code>WINDIVERT_EVENT_FLOW_ESTABLISHED</code></td></tr>
26372631
<tr><td><code>DELETED</code></td><td></td><td></td><td>&#10004;</td><td></td><td></td><td><code>WINDIVERT_EVENT_FLOW_DELETED</code></td></tr>
2638-
<tr><td><code>ACCEPT</code></td><td></td><td></td><td></td><td>&#10004;</td><td></td><td><code>WINDIVERT_EVENT_SOCKET_ACCEPT</code></td></tr>
26392632
<tr><td><code>BIND</code></td><td></td><td></td><td></td><td>&#10004;</td><td></td><td><code>WINDIVERT_EVENT_SOCKET_BIND</code></td></tr>
2633+
<tr><td><code>UNBIND</code></td><td></td><td></td><td></td><td>&#10004;</td><td></td><td><code>WINDIVERT_EVENT_SOCKET_UNBIND</code></td></tr>
26402634
<tr><td><code>CONNECT</code></td><td></td><td></td><td></td><td>&#10004;</td><td></td><td><code>WINDIVERT_EVENT_SOCKET_CONNECT</code></td></tr>
2635+
<tr><td><code>DISCONNECT</code></td><td></td><td></td><td></td><td>&#10004;</td><td></td><td><code>WINDIVERT_EVENT_SOCKET_DISCONNECT</code></td></tr>
2636+
<tr><td><code>ACCEPT</code></td><td></td><td></td><td></td><td>&#10004;</td><td></td><td><code>WINDIVERT_EVENT_SOCKET_ACCEPT</code></td></tr>
26412637
<tr><td><code>LISTEN</code></td><td></td><td></td><td></td><td>&#10004;</td><td></td><td><code>WINDIVERT_EVENT_SOCKET_LISTEN</code></td></tr>
26422638
<tr><td><code>OPEN</code></td><td></td><td></td><td></td><td></td><td>&#10004;</td><td><code>WINDIVERT_EVENT_REFLECT_OPEN</code></td></tr>
26432639
<tr><td><code>CLOSE</code></td><td></td><td></td><td></td><td></td><td>&#10004;</td><td><code>WINDIVERT_EVENT_REFLECT_CLOSE</code></td></tr>

‎examples/socketdump/socketdump.c

+13-1
Original file line numberDiff line numberDiff line change
@@ -103,22 +103,34 @@ int __cdecl main(int argc, char **argv)
103103
continue;
104104
}
105105

106-
SetConsoleTextAttribute(console, FOREGROUND_GREEN);
107106
switch (addr.Event)
108107
{
109108
case WINDIVERT_EVENT_SOCKET_BIND:
109+
SetConsoleTextAttribute(console, FOREGROUND_GREEN);
110110
printf("BIND");
111111
break;
112+
case WINDIVERT_EVENT_SOCKET_UNBIND:
113+
SetConsoleTextAttribute(console, FOREGROUND_RED);
114+
printf("UNBIND");
115+
break;
112116
case WINDIVERT_EVENT_SOCKET_LISTEN:
117+
SetConsoleTextAttribute(console, FOREGROUND_GREEN);
113118
printf("LISTEN");
114119
break;
115120
case WINDIVERT_EVENT_SOCKET_CONNECT:
121+
SetConsoleTextAttribute(console, FOREGROUND_GREEN);
116122
printf("CONNECT");
117123
break;
124+
case WINDIVERT_EVENT_SOCKET_DISCONNECT:
125+
SetConsoleTextAttribute(console, FOREGROUND_RED);
126+
printf("DISCONNECT");
127+
break;
118128
case WINDIVERT_EVENT_SOCKET_ACCEPT:
129+
SetConsoleTextAttribute(console, FOREGROUND_GREEN);
119130
printf("ACCEPT");
120131
break;
121132
default:
133+
SetConsoleTextAttribute(console, FOREGROUND_BLUE);
122134
printf("???");
123135
break;
124136
}

‎examples/windivertctl/windivertctl.c

+1-9
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,6 @@ int __cdecl main(int argc, char **argv)
173173
static UINT8 packet[MAX_PACKET];
174174
static char path[MAX_PATH+1];
175175
static char filter_str[MAX_FILTER_LEN];
176-
PVOID object;
177176
DWORD path_len;
178177
BOOL or;
179178
WINDIVERT_ADDRESS addr;
@@ -369,11 +368,6 @@ int __cdecl main(int argc, char **argv)
369368
printf("%sSEND_ONLY", (or? "|": ""));
370369
or = TRUE;
371370
}
372-
if ((addr.Reflect.Flags & WINDIVERT_FLAG_RECV_PARTIAL) != 0)
373-
{
374-
printf("%sRECV_PARTIAL", (or? "|": ""));
375-
or = TRUE;
376-
}
377371
if ((addr.Reflect.Flags & WINDIVERT_FLAG_NO_INSTALL) != 0)
378372
{
379373
printf("%sNO_INSTALL", (or? "|": ""));
@@ -389,9 +383,7 @@ int __cdecl main(int argc, char **argv)
389383
FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE);
390384
fputs(" filter=", stdout);
391385
SetConsoleTextAttribute(console, FOREGROUND_RED | FOREGROUND_GREEN);
392-
WinDivertHelperParsePacket(packet, packet_len, NULL, NULL, NULL, NULL,
393-
NULL, NULL, NULL, &object, NULL, NULL, NULL);
394-
if (WinDivertHelperFormatFilter((char *)object, addr.Reflect.Layer,
386+
if (WinDivertHelperFormatFilter((char *)packet, addr.Reflect.Layer,
395387
filter_str, sizeof(filter_str)))
396388
{
397389
printf("\"%s\"", filter_str);

0 commit comments

Comments
 (0)