wiresock / ndisapi

Windows Packet Filter library for network packet interception and manipulation, suitable for custom firewall, VPN and traffic analysis applications.
https://www.ntkernel.com/windows-packet-filter/
MIT License
289 stars 78 forks source link

Latest bin_tools dlls not working with C# #24

Closed Nuklon closed 6 months ago

Nuklon commented 6 months ago

The dlls from 3.4.8 aren't working correctly with C#'s dllimport (the previous versions were OK). All native calls return C#'s default.

wiresock commented 6 months ago

The package found at this link, which was built using Visual Studio 2012, contains the DLL that you had success with previously. It's puzzling why the DLLs built with Visual Studio 2022 do not work properly. I will need to conduct some research to pinpoint the exact problem and find a suitable solution.

Nuklon commented 6 months ago

Thanks, I'll give it a try later. Can you also add arm64 in that version? I don't understand why the VS2022 version doesn't work. Usually .NET runtime gives some error that calling failed, but it's just doing its thing and returning the default (false for bool, 0 for int, etc).

wiresock commented 6 months ago

Visual Studio 2012 lacks the capability to build ARM64 targets. The peculiar behavior of the DLL is also baffling to me. This issue might be connected to whether the Visual Studio runtime is linked dynamically or statically, but I'll need to examine it closely to understand the specifics.

Nuklon commented 6 months ago

If you have an update, I'm interested in it 😁

wiresock commented 6 months ago

The key distinction between the Visual Studio 2012 and Visual Studio 2022 projects centered around string encoding: the former utilized an ANSI string for the OpenFilterDriver parameter, while the latter required a UNICODE string. To address this incompatibility, I have enhanced the ndisapi.net project with a new optional string type parameter, which defaults to UNICODE, aligning with the modern builds of ndisapi.dll.

Nuklon commented 6 months ago

Interesting... but one question remains, why does OpenFilterDriver still return a "valid" handle with the wrong encoding? Isn't the DLL checking whether a driver with the passed in name exists?

wiresock commented 6 months ago

It returns an object that encapsulates the driver handle, irrespective of the driver's presence. To verify its validity, you can invoke the IsDriverLoaded method.

Nuklon commented 6 months ago

It returns an object that encapsulates the driver handle, irrespective of the driver's presence. To verify its validity, you can invoke the IsDriverLoaded method.

That makes little sense. OpenFilterDriver should return a valid handle only if there's a driver present with the given name. On your website: This function opens driver object, but if there's no driver, nothing can be opened?

wiresock commented 6 months ago

I don't usually use ndisapi.net in my projects, so I'm not entirely sure of the best approach. However, if you think it's more semantically appropriate to validate the OpenFilterDriver return object within the Open method itself, you're welcome to propose a change through a pull request.

Nuklon commented 6 months ago

I don't usually use ndisapi.net in my projects, so I'm not entirely sure of the best approach. However, if you think it's more semantically appropriate to validate the OpenFilterDriver return object within the Open method itself, you're welcome to propose a change through a pull request.

I mean a behavior change for the DLL, or do you mean that as well?

wiresock commented 6 months ago

The OpenFilterDriver function inside the DLL is responsible for creating a new CNdisApi object and provides an opaque pointer in return. Given that this implementation has been in place for more than a decade, revising it seems unnecessary and might introduce unforeseen issues.