search

zodiacon / WFPExplorer

Windows Filtering Platform Explorer
MIT License
213 stars 38 forks source link

How to display FWPS_RIGHT_ACTION_WRITE flag ? #4

Open little-kawa opened 1 year ago

little-kawa commented 1 year ago

Hey, Thank you for this useful tool. Is there any way to differentiate soft/hard permits and soft/hard blocks (I'm not sure that the flag we see in filters is related to FWPS_RIGHT_ACTION_WRITE flag) ? My goal is to identify sub-layers that configured soft blocks so they can be bypassed by an hard permit in another lower priority sub-layer. (https://learn.microsoft.com/en-us/windows/win32/fwp/filter-arbitration) Thank you.

zodiacon commented 1 year ago

I don't think so, as it's a runtime flag.