MichaelAgarkov/WinDivert
MichaelAgarkov/WinDivert
1
Fork 0
mirror of https://github.com/basil00/WinDivert.git synced 2024-12-22 17:03:55 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity
WinDivert: Windows Packet Divert https://reqrypt.org/windivert.html
280 Commits 5 Branches 21 Tags 1.5 MiB
C 96.8%
Shell 2.1%
Batchfile 1.1%
master
Go to file
basil00 97101072db Fix previous commit 8bda0af 
Fix 

Previous commit was incomplete.
2022-04-10 06:51:38 +08:00
dll Fix filter compiler test simplification logic 2021-09-25 07:23:08 +08:00
doc windivert.html: fix 6.11 title: format not parse 2022-02-15 19:35:18 +01:00
examples Towards WinDivert version 2.1 release. 2019-08-04 08:11:43 +08:00
include Log a system event on driver (un)load. 2019-10-04 08:57:30 +08:00
inf Fix some compiler warnings. 2019-08-27 09:45:45 +08:00
sys Fix previous commit 8bda0af 2022-04-10 06:51:38 +08:00
test Fix filter compiler test simplification logic 2021-09-25 07:23:08 +08:00
CHANGELOG Log a system event on driver (un)load. 2019-10-04 08:57:30 +08:00
dirs Retire MSVC-2012 and (non-driver) WDDK builds. 2018-07-02 19:23:49 +08:00
LICENSE Version tweaks. 2018-11-15 08:24:46 +08:00
mingw-build.sh Log a system event on driver (un)load. 2019-10-04 08:57:30 +08:00
msvc-build.bat Add a Visual Studio build system (fix ). 2019-04-19 09:52:36 +08:00
README Coalesce filter interpreter implementations. 2019-08-17 09:31:46 +08:00
release-build.sh Fix 2019-04-10 07:37:45 +08:00
VERSION Implement new packet parser(s) for WinDivert. 2019-08-12 07:50:49 +08:00
wddk-build.bat Update copyright year. 2019-03-02 08:20:19 +08:00

README 

WinDivert 2.2: Windows Packet Divert
====================================

1. Introduction
---------------

Windows Packet Divert (WinDivert) is a user-mode packet interception library
for Windows 7, Windows 8 and Windows 10.

WinDivert enables user-mode capturing/modifying/dropping of network packets
sent to/from the Windows network stack.  In summary, WinDivert can:
    - capture network packets
    - filter/drop network packets
    - sniff network packets
    - (re)inject network packets
    - modify network packets
WinDivert can be used to implement user-mode packet filters, sniffers,
firewalls, NATs, VPNs, IDSs, tunneling applications, etc..

WinDivert supports the following features:
    - packet interception, sniffing, or dropping modes
    - support for loopback (localhost) traffic
    - full IPv6 support
    - network layer
    - simple yet powerful API
    - high-level filtering language
    - filter priorities
    - freely available under the terms of the GNU Lesser General Public
      License (LGPLv3)

For more information see doc/windivert.html

2. Architecture
---------------

The basic architecture of WinDivert is as follows:

                              +-----------------+
                              |                 |
                     +------->|    PROGRAM      |--------+
                     |        | (WinDivert.dll) |        |
                     |        +-----------------+        |
                     |                                   | (3) re-injected
                     | (2a) matching packet              |     packet
                     |                                   |
                     |                                   |
 [user mode]         |                                   |
 ....................|...................................|...................
 [kernel mode]       |                                   |
                     |                                   |
                     |                                   |
              +---------------+                          +----------------->
  (1) packet  |               | (2b) non-matching packet
 ------------>| WinDivert.sys |-------------------------------------------->
              |               |
              +---------------+

The WinDivert.sys driver is installed below the Windows network stack.  The
following actions occur:

(1) A new packet enters the network stack and is intercepted by WinDivert.sys
(2a) If the packet matches the PROGRAM-defined filter, it is diverted.  The
    PROGRAM can then read the packet using a call to WinDivertRecv().
(2b) If the packet does not match the filter, the packet continues as normal.
(3) PROGRAM either drops, modifies, or re-injects the packet.  PROGRAM can
    re-inject the (modified) using a call to WinDivertSend().

3. License
----------

WinDivert is dual-licensed under your choice of the GNU Lesser General Public
License (LGPL) Version 3 or the GNU General Public License (GPL) Version 2.
See the LICENSE file for more information.

4. About
--------

WinDivert was written by basil.

For further information, or bug reports, please contact:

    basil@reqrypt.org

The homepage for WinDivert is:

    https://reqrypt.org/windivert.html

The source code for WinDivert is hosted by GitHub at:

    https://github.com/basil00/Divert