technikempire/windivertsharp

A minimal .NET binding over WinDivert

WinDivertSharp

A minimal .NET binding over WinDivert.

Available on Nuget.

windivertsharp's Issues

Update sample code

Sandbox code is out of sync with the latest version.

Send fake ACK

Hello!
Currently working on sending fake AKC using WinDivertSharp.

Exactly I want to kill sending all packets and then send the fake ACK.

I create WinDivertParseResult to which I assign data, but later I need to convert it to WinDivertBuffer to send it using WinDivert.WinDivertSendEx(). I just don't know how to make this transformation.

My code:

                        WinDivertParseResult ack = WinDivert.WinDivertHelperParsePacket(packet, readLength);
                        bool used = false;
                        uint size = 0;

                        if(result.IPv4Header != null) {
                            used = true;

                            ack.IPv4Header->SrcAddr = result.IPv4Header->DstAddr;
                            ack.IPv4Header->DstAddr = result.IPv4Header->SrcAddr;

                            size = (uint)sizeof(IPv4Header);

                        } else if(result.IPv6Header != null) {
                            used = true;

                            ack.IPv6Header->SrcAddr = result.IPv6Header->DstAddr;
                            ack.IPv6Header->DstAddr = result.IPv6Header->SrcAddr;

                            size = (uint)sizeof(IPv6Header);
                        }

                        if(used) {
                            ack.TcpHeader->Ack = 1;
                            ack.TcpHeader->Syn = 0;
                            ack.TcpHeader->Rst = 0;
                            ack.TcpHeader->Psh = 0;
                            ack.TcpHeader->Fin = 0;

                            ack.TcpHeader->SrcPort = result.TcpHeader->DstPort;
                            ack.TcpHeader->DstPort = result.TcpHeader->SrcPort;

                            ack.TcpHeader->Window = result.TcpHeader->Window;

                            ack.TcpHeader->SeqNum = ((result.TcpHeader->Ack > 0) ? result.TcpHeader->AckNum : 0);
                            ack.TcpHeader->AckNum = (
                                (result.TcpHeader->Syn > 0) ?
                                (uint)IPAddress.HostToNetworkOrder(IPAddress.NetworkToHostOrder(result.TcpHeader->SeqNum) + 1) :
                                (uint)IPAddress.HostToNetworkOrder(IPAddress.NetworkToHostOrder(result.TcpHeader->SeqNum) + result.PacketPayloadLength)
                            );

                            WinDivertAddress ackAddress = new WinDivertAddress();

                            ackAddress.Flow = address.Flow;
                            ackAddress.Impostor = address.Impostor;
                            ackAddress.IPChecksum = address.IPChecksum;
                            ackAddress.IPv6 = address.IPv6;
                            ackAddress.Loopback = address.Loopback;
                            ackAddress.Network = address.Network;
                            ackAddress.Reflect = address.Reflect;
                            ackAddress.Sniffed = address.Sniffed;
                            ackAddress.Socket = address.Socket;
                            ackAddress.TCPhecksum = address.TCPhecksum;
                            ackAddress.UDPChecksum = ackAddress.UDPChecksum;

                            ackAddress.Outbound = !address.Outbound;
                            
                            //I don't know how to do it here
                            WinDivertBuffer ackBuffer = new WinDivertBuffer();

                            if(!WinDivert.WinDivertSendEx(handle, ackBuffer, size, 0, ref ackAddress)) {
                                int errorCode = Marshal.GetLastWin32Error();
                                Console.WriteLine(string.Format("Unknown IO error ID {0} while awaiting overlapped result.", errorCode));
                                continue;
                            } else {
                                Console.WriteLine("Sended ACK!");
                            }

I can use a completely different solution to send this ACK because I just want it to work.

Question - How can I use this package to drop packets according to a filter?

Hi,
I've been using Clumsy for some time to perform manual testing against a WebRTC implementation. Running these tests each release has now become a big slow down in our release process so I'm investigating whether I can use a package like this one in conjunction with Selenium to simulate a user with an inconsistent local network.

I've been playing around with the sandbox example as well as other projects you've linked which use this package but I cannot get my head around where I am going wrong- I feel I must be fundamentally misunderstanding at least part of the implementation. When debugging, it appears that WinDivertSharp is not sniffing any traffic (hence, when I try to drop traffic nothing is dropped). I've included my approach below, do you have any pointers or are there any further examples/documents I can review to further my understanding?

    public static IntPtr BlockTraffic()
    {
        string filter = "tcp";
        Console.WriteLine("About to start blocking traffic");
        var handle = WinDivert.WinDivertOpen(filter, WinDivertLayer.Network, 0 , WinDivertOpenFlags.Drop);
        return handle;
    }

    public static void UnblockTraffic(IntPtr handle)
    {
        Console.WriteLine("About to stop blocking traffic");
        WinDivert.WinDivertClose(handle);
    }

Update readme

The readme says this library is "safe", but we recently reintroduced raw pointer access into the public api. Need to ditch this word now.

WinDivertAddress problems

Would seem that modification causes us some issues. The Pinvoke assistant generated some bad code.

Other issues with checksums too apparently

Related to #1

Solution is to ditch all the ref Struct? Val instances for headers and safely wrap the pointers in a return class instance instead.

Handle is always null.

When opening a WinDivert handle it is always null, code used is :
var WinDivertHandle = WinDivert.WinDivertOpen("tcp", WinDivertLayer.Network, 0, WinDivertOpenFlags.None);
I check if it is an IntPtr equal to 0 and it is, as well as when I run it it returns an error which is 6 (handle is invalid). I'm wondering if it comes from the library or me misusing it.

Missing Send only mode

As the title suggests Send only mode is missing. Is there any way to use it?

Crash within WinDivertParseResult initializer

2018-08-17 19:14:32.404 -05:00 [Error] Could not load type 'WinDivertParseResult' from assembly 'WinDivertSharp, Version=1.4.3.2, Culture=neutral, PublicKeyToken=null'.   at CitadelCore.Windows.Diversion.WindowsDiverter.RunDiversion()
   at CitadelCore.Windows.Diversion.WindowsDiverter.<Start>b__26_0()
	 From WindowsDiverter.cs::Start() #261
2018-08-17 19:14:32.404 -05:00 [Error] Could not load type 'WinDivertParseResult' from assembly 'WinDivertSharp, Version=1.4.3.2, Culture=neutral, PublicKeyToken=null'.   at CitadelCore.Windows.Diversion.WindowsDiverter.RunDiversion()
   at CitadelCore.Windows.Diversion.WindowsDiverter.<Start>b__26_0()
	 From WindowsDiverter.cs::Start() #261
2018-08-17 19:14:32.404 -05:00 [Error] Could not load type 'WinDivertParseResult' from assembly 'WinDivertSharp, Version=1.4.3.2, Culture=neutral, PublicKeyToken=null'.   at CitadelCore.Windows.Diversion.WindowsDiverter.RunDiversion()
   at CitadelCore.Windows.Diversion.WindowsDiverter.<Start>b__26_0()
	 From WindowsDiverter.cs::Start() #261
2018-08-17 19:14:32.404 -05:00 [Error] Could not load type 'WinDivertParseResult' from assembly 'WinDivertSharp, Version=1.4.3.2, Culture=neutral, PublicKeyToken=null'.   at CitadelCore.Windows.Diversion.WindowsDiverter.RunDiversion()
   at CitadelCore.Windows.Diversion.WindowsDiverter.<Start>b__26_0()
	 From WindowsDiverter.cs::Start() #261

How do I use this?

I'm trying to understand how I can set this up but I have no clue, I have tried to open it in the Rider and VS, and it just flashes with red errors everywhere.
I have looked on all of these:
https://github.com/TechnikEmpire/WinDivertSharp
https://github.com/TechnikEmpire/DivertPInvoke
https://github.com/TechnikEmpire/Divert.Net

What do I need to set this up and get it running?
I'm currently using this in a python project https://github.com/ffalcinelli/pydivert which was no problem to setup.

Port/SeqNum have bytes reversed

I have to reverse the byes in these values in order to use them properly. I feel like the library should be the one handling this.

How would I use this tool to filter/drop packets in a C# Ui

WinDivert 2.0 support

Any plans to support the new version of WinDivert?

WinDivertRecv read length incorrect in windivert 2.2.2

When updating Windivert from 1.4 to 2.2.2, I noticed the read length of WinDivertRecv is not correct. I looked a bit and found out that the read length can be retrieved by getting the timestamp field of the address. Can this mapping be fixed (if you are still active in this repository)?

Issue while sending my own packet

Hi,
I'm trying to send my own packet via udp but when sending it I get error code 87. It should be bad parameter err. but I'm providing the correct params...

Here's the code

`
var buffer1 = StringToByteArray("HEX STUFF");
WinDivertBuffer buff1 = new WinDivertBuffer(buffer1);

var checksum = WinDivert.WinDivertHelperCalcChecksums(packet, (uint)packet.Length, ref addr, WinDivertChecksumHelperParam.All);

uint length = (uint) i;

if (!WinDivert.WinDivertSend(handle, buff1, (uint)packet.Length, ref addr, ref length))
{
Console.WriteLine("Write Err: {0}", Marshal.GetLastWin32Error());
}
`

Lowering Latency

Hello! I'm back again with more attempted work with WinDivert and as usual I'm loving the C# binding / wrapper.

I was wondering if there are any parameters or practices that help lower latency to it's absolute minimum? The usage of WinDivert here is for latency-sensitive games. I've already tried Overlapping I/O (RecvEx / SendEx) and Multi-Threading.

Right now for each packet that passes through with a TCP ping test, modifying and re-injecting only adds 0.1ms of latency per packet, pinged every second. However, this builds up as packets flow through like crazy in games and is extremely noticeable, causing network stutters / jitters in-game.

I currently have WinDivert redirect all game packets to a local proxy that then forwards them to the final destination. I have already ruled out the local proxy being a cause of extra latency.

I'm not sure if this problem has to do with WinDivert not able to redirect packets instantly as they come (like TCP_NODELAY, causing them to build up latency), or if it's because WinDivert is queueing the packets in any way. I feel like if it was the first reasoning, Overlapping / async I/O should've fixed it, but it makes no noticeable impact.

If you need any examples of my code or it would be better for me to ask questions via. Email or Discord, etc, please let me know!

Thank you for your time ^^.