Solved bug in using port number ranges

[davidxanatos]

Solved bug in using port number ranges

[SnikoLoft]

Hello David,

now I managed the compilation of the project.
But there is a problem with the source files: there is something is missing:

I think, you made some quick additions to the NuGet files of 'boost' and/or 'MS.O365' packages,
to get some information about the UDP traffic, similar to the TCPIP traffic.

File: PrivateWin10\Core\NetworkMonitors.cs
Function is missing:
Microsoft.O365.Security.ETW.Kernel.NetworkUdpipProvider udpProvider;
udpProvider = new Microsoft.O365.Security.ETW.Kernel.NetworkUdpipProvider();

Missing folder: "..\krabs\packages\boost.1.68.0.0\build\boost.targets"
default folder for the boost package is "..\packages\boost.1.68.0.0\build\boost.targets"

Sniko

[DavidXanatos]

Hello, Thanks :-)

I will spin up a fresh VM and go through setting up the build and look for potential issues and post a short how to.

Cheers

[SnikoLoft]

Hello David,

I think, you add 'NetworkUdpipProvider' to the (not in git included) file 'ETW\O365.Security.Native.ETW\Kernel\KernelProviders.hpp', similar to 'NetworkTcpipProvider'.

Only this function is missing, after loading three packages via NuGet (I used updated versions for testing):
boost V1.72.0.0
Microsoft.O365.Security.Native.ETW V4.1.12
Mono.Cecil V0.11.2

Greetings
Sniko

[DavidXanatos]

Yes you are right,
I have just pushed a commit with the missing changed.

thanks

Cheers
David X.

[SnikoLoft]

In the last hours I learned a lot of compiling your project.

In my last posts I wrote something about package downloads via NuGet,
because I got the error message "package boost 1.68 not found, use NuGet to download".

Now I looked in the solution file and saw, that you manually moved the complete folder "\packages\boost.1.68.0.0" into "\ETW\krabs\packages\boost.1.68.0.0". And this folder is missing in git.
So I downloaded the boost package and moved it into "\ETW\krabs" too. And now I can compile the whole project without any changes.

[SnikoLoft]

Here is a similar error like in my first post (a random find):

Source file: PrivateWin10\Core\WindowsFirewall\FirewallRules.cs

Function: public static bool MatchPort(UInt16 numPort, string strPorts)

OldLine 454:
if (UInt16.TryParse(strTemp[0], out beginPort) && UInt16.TryParse(strTemp[0], out endPort))
NewLine 454:
if (UInt16.TryParse(strTemp[0], out beginPort) && UInt16.TryParse(strTemp[1], out endPort))

I think, it's time for me to get familar with the git program...

Cheers
Sniko

[DavidXanatos]

I'm not a fan of NuGet or packet managers in general, for me that only means if the internet fails nothing works anymore. So wherever possible I got for local copies.

Thanks for the find, great!

You don't necessarily need git, you can also use SVN with Github, and for that there are really nice clients like TortoiseSVN

[SnikoLoft]

First I don't understood the function of NuGet. I'm sceptical to these kind of online things, too.
But first I get a message "boost missing, please download" and after downloading it was still missing... and today I was surprised about the fully automatic downloading of packages...

I'm a practical programmer: give me the sourcecode, a compiler and show me the button to create the exe file, don't need much more info... my tummy shows me the way...

Yes, now I remember. In my office (6 years ago) I used TortoiseSVN to copy my source code changes onto the server, my workmate shows me the right buttons...

[DavidXanatos]

fixed in the 0.82 build