WireScope — Packet Capture, Per-Process Monitor, Firewall, and Link Simulator on One Kernel Data Plane: Single native C++23 Win32 executable, NDIS 6.x lightweight filter wsddntf.sys integration via 0x9300xxxx IOCTLs, zero Npcap dependency, lock-free port-to-process attribution, offline Authenticode/catalog verification, directional firewall rule engine with kernel static filter offload, token-bucket shaper with ~1 ms waitable timer, transactional state planner with crash recovery, embedded steganographic driver carrier (LZX CAB/FDI in 24-bit BMP), Direct2D on Windows 11 Mica.

Engineering Status

WireScope.exe is a single native C++23 executable that combines Layer 2 packet capture, per-process traffic accounting, stateful firewall enforcement, network impairment simulation, and NDIS filter lifecycle management on one data plane. It communicates directly with the NDIS 6.x lightweight filter driver wsddntf.sys over the 0x9300xxxx IOCTL protocol, requiring neither Npcap nor third-party user-mode libraries. The signed driver package is embedded inside the executable as an LZX-compressed steganographic bitmap resource at WireScope.bmp and deployed on demand through the Windows SetupAPI and INetCfg COM interfaces. Verified on Windows 11 x64 across 23 network interfaces: directional firewall rules, per-application blocking, token-bucket bandwidth shaping at 512 kbit/s, 200 ms delay injection with ~1 ms timer granularity, and live filter detachment with zero ICMP packet loss.

Table of Contents

• Quick Start
  • 1. Graphical Interface
  • 2. Command Line
  • 3. Typical Workflows
• Technical Overview
• System Architecture
• The Packet Data Path
• Steganographic Driver Packaging and Deployment
  • Carrier Construction — WireScope.bmp
  • In-Memory FDI Decompression and RAII Staging
  • Comparison with MZ Header Truncation in KvcKiller
  • Mandatory Filter Semantics and Zero-Drop Detachment
• Reverse Engineering wsddntf.sys and the 0x9300xxxx IOCTL Protocol
  • 1. Binary Identity and Provenance
  • 2. PE Section Layout and Kernel Imports
  • 3. NDIS 6.x Stack Position and Hook Entry Points
  • 4. Two-Tier IRP_MJ_DEVICE_CONTROL Dispatch
  • 5. Complete 28-Code IOCTL Dispatch Table
  • 6. INTERMEDIATE_BUFFER Layout and Pointer Probing
  • 7. Static Filter ABI and Kernel Enforcement in LISTEN and TUNNEL Modes
  • 8. Clarification of 0xFCxxxxxx Constants in FilterOidRequest
• Functional Modules
  • Capture
  • Processes and Authenticode Verification
  • Firewall and Rule Language
  • Network Impairment Simulator
  • Kill Switch and Safety Mechanisms
• Command-Line Reference
  • Exit Codes
• Graphical Interface Design
• Localization
• Source Layout
• Building from Source
• License

Quick Start

WireScope.exe operates as a Direct2D desktop application when launched without arguments and as a scriptable console tool when invoked with command-line flags. Both modes drive the same TrafficController and PacketEngine.

1. Graphical Interface

1. Run WireScope.exe with administrator privileges; when started unprivileged, the header bar provides Restart as administrator.
2. If the wsddntf driver is not yet present on the machine, open the Network driver page via Ctrl+5 and click Install — WireScope unpacks the embedded signed driver package from its own resources, stages it in the Windows Driver Store, and attaches the filter.
3. Select the target network interface in the top bar; the adapter carrying the default IPv4 route is selected first.
4. Use Capture via Ctrl+1 or F5 to inspect frames, Processes via Ctrl+2 to monitor per-application bandwidth and digital signatures, Firewall via Ctrl+3 to enforce directional rules, and Simulator via Ctrl+4 to shape latency, jitter, packet loss, and throughput.

2. Command Line

:: Validate and explain firewall rules and simulator parameters without touching the driver
WireScope.exe --check --rule "block out tcp dport 443" --rule "block app discord.exe" --rate 512

:: Enforce a firewall rule set for 60 seconds, then restore the adapter state
WireScope.exe --rule "block udp rport 27015-27030" --rule "block in icmp type 8" --duration 60

:: Measure per-process network traffic over 30 seconds in non-intrusive listen mode
WireScope.exe --processes --duration 30

:: Inspect the NDIS filter component, adapter bindings, service state, and embedded package
WireScope.exe --driver status

3. Typical Workflows

• Identify active talkers and verify binary trust: open Processes, enable Count traffic per program, and sort by Download or Upload. Unsigned binaries running from user-writable directories or masquerading as Windows system binaries are flagged in red.
• Isolate a program's frames: select a row in Processes and press Show packets or Enter to filter the packet capture to that process.
• Throttle a single application: select a process and click Limit bandwidth to configure the token-bucket shaper for app <name> while leaving all other system traffic unthrottled.
• Suspend kernel filtering without dropping connections: open Network driver and click Stop. WireScope detaches the NDIS filter from every adapter via INetCfgBindingPath::Enable before stopping the wsddntf service, preserving active TCP and ICMP flows without packet loss.

Technical Overview

System Architecture

TrafficController is the sole owner of the adapter mode and the driver's global static filter table. Neither the GUI nor the CLI issues driver IOCTLs directly: they declare a desired target state — capture active, per-process counting active, firewall enabled with a rule list, simulator active with an impairment profile — and TrafficController sequences the transition so no packet traverses a partially applied configuration.

The Packet Data Path

Mode transitions execute synchronously on the PacketEngine worker thread between batch reads. Before leaving tunnel mode, TrafficController installs a quiesce filter table without FILTER_PACKET_REDIRECT entries so no new tunnelled frames enter the driver queue, drains all pending frames under the previous semantics, flushes or releases the delay line, and only then switches the adapter mode. This guarantees that no frame is re-injected twice or stranded in a queue.

Steganographic Driver Packaging and Deployment

To keep WireScope.exe a self-contained single-file executable without bundling external .sys, .cat, or .inf files on disk, the complete NDIS driver package is embedded inside the PE resource section as a 24-bit RGB bitmap at WireScope.bmp with resource identifier IDR_DRIVER_IMAGE 102.

WireScope.bmp — 112 × 105 px 24-bit RGB bitmap carrying the LZX-compressed, XOR-masked NDIS driver package, 35,334 bytes

Carrier Construction — WireScope.bmp

The build script priv/build_bmp.ps1 constructs the carrier image deterministically:

1. Neutral Slot Naming: The three package files totaling 70,691 bytes are staged with fixed timestamps 2030-01-01 00:00:00 and assigned neutral cabinet entry names 1 for wsddntf.inf, 2 for wsddntf.cat, and 3 for wsddntf.sys, ensuring that no .sys, .cat, .inf, or wsddntf strings appear in the cabinet directory header.
2. Solid LZX:21 Compression: makecab.exe compresses all three files into a single solid LZX folder with a 2 MB window, CompressionMemory=21, reducing 70,691 bytes to 35,120 bytes — 49.51% of the original size.
3. Archival Signature Masking: Bytes 0..3 of the cabinet stream — MSCF / 0x4D, 0x53, 0x43, 0x46 — are XOR-masked with 0xA5, 0x5A, 0xF0, 0x0F to produce 0xE8, 0x09, 0xB3, 0x49, removing the cabinet magic signature from static inspection.
4. 24-Bit Bitmap Encapsulation: A standard 14-byte BITMAPFILEHEADER and 40-byte BITMAPINFOHEADER for a 112 × 105 pixel, 24 bpp BI_RGB image are prepended. The exact cabinet payload length of 35,120 bytes is stored in the 32-bit field formed by bfReserved1 and bfReserved2 at file offset 0x06, while bfOffBits at offset 0x0A points to pixel offset 54.

In-Memory FDI Decompression and RAII Staging

At runtime, DriverPackage.cpp locates IDR_DRIVER_IMAGE in the module's mapped image, validates the BM magic and the masked header bytes 0xE8, 0x09, 0xB3, 0x49, and invokes the Windows Cabinet API in cabinet.dll via FDICreate and FDICopy using custom in-memory stream callbacks backed by a thread_local extraction state:

• When FdiRead reads across stream offsets 0..3, it XORs the output bytes with 0xA5, 0x5A, 0xF0, 0x0F in flight. Neither the unmasked cabinet stream nor the ASCII constant "MSCF" exists in the binary.
• FdiNotify intercepts fdintCOPY_FILE, maps slot names 1, 2, and 3 back to wsddntf.inf, wsddntf.cat, and wsddntf.sys, and decompresses each file directly into a std::vector<BYTE>.
• When DriverSetup::Query or DriverSetup::Install requires filesystem paths for SetupAPI or WinVerifyTrust, DriverPackage::StagedFolder::Create() writes the three buffers into a process-unique directory under %TEMP%, verifies the Authenticode signatures of both wsddntf.cat and wsddntf.sys, and deletes the files and directory in ~StagedFolder() as soon as the call completes.

Comparison with MZ Header Truncation in KvcKiller

This steganographic carrier builds upon the architecture introduced in KvcKiller, where kernel modules additionally have their first 128 bytes — IMAGE_DOS_HEADER and the DOS stub — stripped prior to LZX compression and reconstructed in memory at runtime by borrowing the 128-byte DOS header from C:\Windows\System32\drivers\ks.sys and patching e_lfanew at offset 0x3C.

Byte-level comparison between wsddntf.sys and ks.sys confirms that their first 128 bytes are identical across 127 bytes, differing solely at offset 0x3C, where e_lfanew is 0xE8 in wsddntf.sys and 0xF8 in ks.sys. Nevertheless, MZ header truncation is intentionally omitted in WireScope for two technical reasons:

1. WHQL Catalog Integrity across Windows Builds: In KvcKiller, header stripping suppresses static AV/EDR heuristics on standalone kernel drivers loaded directly via CreateServiceW. In contrast, wsddntf.sys is a WHQL and DigiCert signed NDIS filter installed through SetupCopyOEMInfW, which validates the SHA-256 file digest recorded inside wsddntf.cat signed by Microsoft Windows Hardware Compatibility Publisher. Preserving the complete file inside the LZX stream guarantees that SetupCopyOEMInfW never depends on the local ks.sys binary having an identical DOS stub on future Windows builds.
2. Solid LZX Entropy: Because wsddntf.inf and wsddntf.cat precede wsddntf.sys inside the solid LZX:21 compression window, the MZ and PE\0\0 headers of wsddntf.sys are compressed against the preceding dictionary and do not appear as plaintext byte sequences anywhere in WireScope.bmp.

Mandatory Filter Semantics and Zero-Drop Detachment

In wsddntf.inf, the NDIS filter is declared with FilterRunType = 1, designating a mandatory filter. Under the NDIS 6.x specification, a mandatory filter must be running and bound before any upper protocol driver such as tcpip.sys can send or receive frames across the underlying miniport. Stopping the service directly with sc stop wsddntf while the filter remains bound to adapters leaves the bindings intact and halts all IP traffic on those interfaces.

DriverSetup.cpp manages the full driver lifecycle through native Windows APIs — SetupCopyOEMInfW, SetupUninstallOEMInfW, INetCfg, INetCfgLock, INetCfgClassSetup, INetCfgComponentBindings, INetCfgBindingPath, and the Service Control Manager — without spawning netcfg.exe, pnputil.exe, or sc.exe:

• Zero-Drop Stop via DriverSetup::Stop: Iterates over every binding path of nt_wsddntf via INetCfgComponentBindings, calls INetCfgBindingPath::Enable(FALSE), and commits the binding change with INetCfg::Apply(). NDIS unhooks the filter from the data path via FilterDetach in microseconds without resetting the physical link or dropping active TCP or ICMP traffic. Only after all adapters are detached does WireScope stop the wsddntf service.
• Transactional Install with Rollback via DriverSetup::Install: Stages wsddntf.inf into the Driver Store, installs component nt_wsddntf via INetCfgClassSetup::Install, and polls \\.\wsddntf. If the control device fails to answer within 15 seconds, Install() invokes Uninstall() to roll back the filter and restore adapter connectivity.

Reverse Engineering wsddntf.sys and the 0x9300xxxx IOCTL Protocol

To build a reliable user-mode data plane without proprietary SDK libraries, wsddntf.sys was statically reverse-engineered using IDA Pro 9.4 x64, Capstone 5.x, and pefile, and verified dynamically against the running driver via --firewall-selftest.

1. Binary Identity and Provenance

2. PE Section Layout and Kernel Imports

The binary imports 54 symbols: 27 from ntoskrnl.exe — including ExAllocatePoolWithTag with tag NdRd, KeAcquireSpinLockRaiseToDpc, ProbeForRead, ProbeForWrite, __C_specific_handler, IoAllocateMdl, MmProbeAndLockPages, and ObReferenceObjectByHandle — and 27 from NDIS.SYS — including NdisFRegisterFilterDriver, NdisRegisterDeviceEx, NdisFSendNetBufferLists, NdisFIndicateReceiveNetBufferLists, and NdisFOidRequest. It imports no process-termination or physical-memory mapping routines; ZwTerminateProcess, ZwOpenProcess, and MmMapIoSpace are absent.

3. NDIS 6.x Stack Position and Hook Entry Points

wsddntf.sys registers as a modifying NDIS 6.x Lightweight Filter with FilterClass = compression, FilterType = 2, FilterRunType = 1, and instance GUID {D84D0128-AE2D-4E27-800A-E030D4EF692D}, exposing device object \Device\wsddntf and symbolic link \DosDevices\wsddntf (\\.\wsddntf):

• TX Hook — FilterSendNetBufferLists at 0x140003EA0: Validates adapter state atomically via lock cmpxchg on [ctx+0x60]. If the adapter mode at [ctx+0x2B8] is 0, representing bypass mode, the NET_BUFFER_LIST chain is forwarded directly to NdisFSendNetBufferLists. When filtering or tunnelling is active, each frame is parsed by sub_140005500: frames matching a DROP rule are completed via NdisFSendNetBufferListsComplete, while frames selected for user-mode inspection are copied into the adapter queue at [ctx+0x2A8] under spinlock [ctx+0x298] and signaled via KeSetEvent.
• RX Hook — FilterReceiveNetBufferLists at 0x140004080: Inspects inbound NET_BUFFER_LIST chains via sub_140004ECC. Passed frames are indicated up the stack via NdisFIndicateReceiveNetBufferLists; blocked or queued frames are returned to the miniport via NdisFReturnNetBufferLists.
• OID Hook — FilterOidRequest at 0x140005B70: Clones and forwards NDIS OID requests, adjusting reported MTU when HKLM\SYSTEM\CurrentControlSet\Services\wsddntf\Parameters\MTUDecrement is non-zero.

4. Two-Tier IRP_MJ_DEVICE_CONTROL Dispatch

User-mode communication over \\.\wsddntf is handled by a two-stage dispatch architecture:

1. Primary Dispatcher sub_140003600 at 0x140003600: Registered in the NDIS device characteristics for IRP_MJ_DEVICE_CONTROL. It intercepts three high-frequency control codes on a fast path:
   • 0x930024E0 — fast single-packet send to adapter at 0x140003830
   • 0x930024E4 — fast single-packet send to tcpip.sys at 0x140003830
   • 0x93002520 — shared-memory Fast I/O initialization at 0x1400036B3
2. Secondary Dispatcher sub_140001D38 at 0x140001D38: Handles the remaining 25 control codes covering adapter enumeration, batch packet reads and writes, event registration, adapter modes, and static filter tables.

5. Complete 28-Code IOCTL Dispatch Table

Every control code is constructed as CTL_CODE(0x9300, Function, METHOD_BUFFERED, FILE_ANY_ACCESS):

6. INTERMEDIATE_BUFFER Layout and Pointer Probing

Although all 28 IOCTLs use METHOD_BUFFERED, ETH_REQUEST and ETH_M_REQUEST pass user-mode virtual pointers referencing INTERMEDIATE_BUFFER structures of size 0x61E — 1,566 bytes, consisting of a 0x34-byte header followed by a 0x5EA-byte Ethernet frame buffer. Before dereferencing any embedded user pointer, wsddntf.sys invokes ProbeForRead or ProbeForWrite with length 0x61E and alignment 1 inside a structured __try / __except block guarded by __C_specific_handler.

Disassembly and live testing established two ABI details enforced in DriverBridge.h and PacketEngine.cpp:

• Packet Direction Field: The direction flag — PACKET_FLAG_ON_SEND = 0x01, PACKET_FLAG_ON_RECEIVE = 0x02 — resides in INTERMEDIATE_BUFFER::m_dwDeviceFlags at offset 0x10, whereas m_Flags at offset 0x18 carries NDIS NET_BUFFER_LIST flags. Reading m_Flags for direction misclassifies outbound frames as inbound and injects them into tcpip.sys instead of the miniport.
• Adapter Mode Lifetime: Closing the file handle that issued IOCTL_NDISRD_SET_ADAPTER_MODE resets the adapter mode in the driver's cleanup routine.

7. Static Filter ABI and Kernel Enforcement in LISTEN and TUNNEL Modes

Disassembly of IOCTL_NDISRD_SET_PACKET_FILTERS at 0x140002481, the table allocator sub_140001C18, and the per-packet filter evaluator sub_140001150 established the exact binary layout expected by wsddntf.sys:

• 4-Byte Table Header: At 0x140002481, the driver validates InputBufferLength >= 0xB9 — 185 bytes — and computes the required buffer size as m_TableSize * 0xB5 + 4. STATIC_FILTER_TABLE_HEADER is a single 4-byte DWORD m_TableSize with no alignment padding; the first STATIC_FILTER entry begins at table offset +0x04. Adding an 8-byte header shifts every entry by 4 bytes, placing the upper 32 bits of m_Adapter into m_dwDirectionFlags at table + 0x0C so test [rsi+0x10], eax at 0x140001253 evaluates to zero and skips every rule.
• 181-Byte STATIC_FILTER Entry Layout: Each entry occupies 0xB5 = 181 bytes under #pragma pack(push, 1):

• Kernel-Mode Enforcement in Both MODE_LISTEN and MODE_TUNNEL: Disassembly of the TX filter wrapper sub_140002E90 at 0x140002ECE: test cl, 5 — testing MSTCP_FLAG_SENT_TUNNEL | MSTCP_FLAG_SENT_LISTEN — and the RX filter wrapper sub_140002DC3 at 0x140002E05: test cl, 0xA — testing MSTCP_FLAG_RECV_TUNNEL | MSTCP_FLAG_RECV_LISTEN — proves that wsddntf.sys invokes sub_140001150 in both MODE_TUNNEL 0x03 and MODE_LISTEN 0x0C:
  • FILTER_ACTION_DROP 2 drops the NET_BUFFER_LIST directly in the kernel at DISPATCH_LEVEL in both modes without queuing to user space.
  • FILTER_ACTION_PASS 1 forwards the frame in the kernel in both modes without queuing to user space.
  • FILTER_ACTION_REDIRECT 3 queues the original frame for user-mode inspection in MODE_TUNNEL, whereas in MODE_LISTEN at 0x140002F0A and 0x140002E6E it returns 4 PASS_RDR, forwarding the original frame through the NDIS stack at line rate while cloning a read-only copy to the user-mode queue.

TrafficController exploits this dual-mode hardware evaluation: when kernel offload covers all active firewall rules — i.e., no rule requires user-mode process attribution via app or ICMP type inspection — and the link simulator is off, WireScope places the adapter in MODE_LISTEN 0x0C. Blocked packets are discarded in ring 0 at DISPATCH_LEVEL, and allowed packets traverse the NDIS stack without waiting for user-mode re-injection: FILTER_ACTION_PASS when capture and process monitoring are off, or FILTER_ACTION_REDIRECT when capture or process monitoring is active. When a rule specifies app <name>, all preceding L2/L3/L4 rules remain offloaded in the kernel table while a FILTER_ACTION_REDIRECT entry hands the remaining traffic to PacketEngine in MODE_TUNNEL.

8. Clarification of 0xFCxxxxxx Constants in FilterOidRequest

Automated scanners sometimes misidentify three 32-bit constants in sub_140005B70 — 0xFC01020B, 0xFC01020C, and 0xFC030201 — as METHOD_NEITHER IOCTL codes. Disassembly of sub_140005B70, which is the NDIS FilterOidRequest handler at 0x140005B70, proves that rdx is a PNDIS_OID_REQUEST and [rdx+0x20] is DATA.QUERY_INFORMATION.Oid. Those constants are standard Microsoft NDIS Object Identifiers: OID_TCP_OFFLOAD_CURRENT_CONFIG, OID_TCP_OFFLOAD_PARAMETERS, and OID_TCP_CONNECTION_OFFLOAD_PARAMETERS, not IOCTL codes.

Functional Modules

Capture

• Virtual List Rendering: Handles tens of thousands of frames at 60 fps; auto-scrolls when pinned to the bottom and locks position when a frame is inspected.
• Protocol Dissection: Decodes Ethernet II, IEEE 802.1Q VLAN tags, ARP, IPv4, IPv6 with extension headers, TCP, UDP, ICMP, ICMPv6, DNS queries, TLS ClientHello SNI, and HTTP request lines.
• Fate and Process Attribution: Displays both the engine's action — +120 ms, SIM DROP, BLOCKED, KILLED — and the owning process next to every frame.
• Wireshark .pcap Export: Writes standard libpcap 2.4 files with microsecond timestamps via --pcap or Ctrl+S, either for the full capture or for selected rows.

Processes and Authenticode Verification

The Processes page, accessible via Ctrl+2 or --processes, correlates Layer 4 ports with user-mode processes and verifies binary authenticity on a background thread:

From any row in Processes, one click creates a firewall block rule — block app <name> or block app "<full path>" when disambiguating duplicate names — applies a per-application token-bucket bandwidth limit, opens the simulator with that application pre-selected, or filters the capture view.

Firewall and Rule Language

One unified grammar drives the firewall, the simulator traffic selector, and rule files:

[allow|block]  [in|out|both]  [ip4|ip6]  [tcp|udp|icmp|proto N]
               [from|to|remote|local ADDR]  [sport|dport|rport|lport|port P]  [type N]  [app NAME|PATH]

ADDR  1.2.3.4   1.2.3.0/24   10.0.0.1-10.0.0.50   2001:db8::/32
P     443   27015-27030
NAME  discord.exe            PATH  "C:\Tools\custom client.exe"

• Directional Semantics: remote/local and rport/lport follow the frame direction: for outbound packets remote matches the destination address, while for inbound packets remote matches the source address.
• Range Decomposition: Arbitrary IPv4 address ranges such as 10.0.0.1-10.0.0.50 are decomposed into minimal exact CIDR prefixes for kernel static filter compilation.
• Lock-Out Protection: Before applying a rule set, Safety.cpp evaluates the rules against the machine's active DNS resolvers, outbound HTTPS on port 443, and inbound Remote Desktop on port 3389. Rule sets that sever connectivity require confirmation and revert after 20 seconds unless kept.

Network Impairment Simulator

The Simulator page renders three 60-second real-time Direct2D charts sampled at 100 ms intervals: Added Delay in ms, Drops per second, and Throughput in kbps.

Kill Switch and Safety Mechanisms

• 20-Second Automatic Revert: Engaging the Kill Switch via Ctrl+Shift+K or applying a locking firewall configuration starts a 20-second countdown banner; if Keep is not pressed before expiry, the previous configuration is restored.
• Crash Recovery Record: Before switching an adapter out of bypass mode or writing static filters, TrafficController records the adapter identity, original foreign filters, and OS boot time in HKCU\Software\WireScope\DataPlaneRecovery. If WireScope.exe is terminated forcibly, the next invocation of either the GUI or any CLI command restores the adapter to bypass mode and reinstates foreign filters.
• Cross-Process Data-Plane Mutex: Global\WireScope.DataPlane ensures only one instance modifies adapter traffic at a time while allowing secondary read-only diagnostic commands.

Command-Line Reference

Information & Diagnostics
  -i, --info                        Driver connection state, version, and static filter table count
  -l, --list, --adapters            Network adapters with GUID, MAC, MTU, kernel handle, and default route
      --driver status               Full engineering report: INetCfg bindings, service, driver store, package
      --driver install [inf]        Install the embedded or specified driver package; requires --force
      --driver uninstall            Remove the NDIS filter and purge staged copies from the driver store; --force
      --driver start | stop         Start+attach or detach+stop the driver without dropping connections; --force
      --driver attach | detach      Enable or disable NDIS bindings across all adapters; --force
      --driver start-type <type>    Set service start type: system, automatic, manual, disabled; --force
      --firewall-show               Decode and print the driver's active STATIC_FILTER_TABLE
      --firewall-selftest           Prove the 181-byte STATIC_FILTER ABI via write/read-back verification
      --firewall-reset              Clear all static filters from the driver; requires --force
      --rules-help                  Print the rule and traffic selector grammar reference
      --trust <file>                Verify Authenticode, catalog, or MSIX signature and path heuristics
      --check                       Validate and explain rules and simulator options without applying them
      --lng-export <file>           Export the built-in English string table as a translation template
      --lng-check [<file>]          Validate language files for coverage, unknown IDs, and {placeholders}

Live Sessions — combinable; terminate with Ctrl+C, --duration, or --count
  -s, --sniff [index]               Capture packets live       -c, --count <N>   -w, --pcap <file>   -f, --filter <text>
  -F, --firewall                    Enforce firewall rules     -r, --rule "<r>"  -R, --rules <file>  --policy allow|block
                                                               --kernel-filters
  -S, --impair                      Run link simulator         --latency <ms>    --jitter <ms>       --loss <percent>
                                                               --rate <kbps>     --dir in|out|both   --match "<selector>"
                                                               --reorder
      --processes                   List active network processes; with --duration or a session, measure per-app traffic
  -a, --adapter <index>             Target adapter index; defaults to the interface with the default route
  -t, --duration <seconds>          Stop session after N seconds and restore the network

Exit Codes

Graphical Interface Design

• Per-Monitor V2 DPI Awareness: All layout metrics, DirectWrite typography, stroke widths, and Segoe Fluent glyphs scale dynamically on WM_DPICHANGED.
• Direct2D on Windows 11 Mica: The client surface renders into a premultiplied 32-bit DIB section via ID2D1DCRenderTarget and composites onto the DWM Mica backdrop via DWMWA_SYSTEMBACKDROP_TYPE, preserving per-pixel alpha across translucent cards, badges, and charts.
• Accessible Owner-Drawn Controls: Buttons, toggle switches, segmented selectors, sliders, virtual lists, and popup menus are custom-rendered in Direct2D while remaining native Win32 child windows with full Tab focus traversal and keyboard shortcuts: F5, Ctrl+1..5, Ctrl+F, Ctrl+N, Ctrl+S, and Ctrl+Shift+K.

Localization

English is compiled directly into WireScope.exe via src/resources/lang/en.rc. External translations reside in language\<code>.lng next to the executable as UTF-8 key-value files generated and validated from a single schema in tools/strings.py. Any missing key or mismatched format placeholder falls back individually to the built-in English string.

Supported localization set — 381 strings per language, matching the Linux Live localization architecture:

• English — built-in
• Polish — pl, Polski
• German — de, Deutsch
• Spanish — es, Español
• French — fr, Français
• Italian — it, Italiano
• Russian — ru, Русский
• Japanese — ja, 日本語
• Simplified Chinese — zh-cn, 简体中文
• Arabic — ar, العربية
• Portuguese — pt, Português
• Ukrainian — uk, Українська
• Turkish — tr, Türkçe
• Korean — ko, 한국어
• Dutch — nl, Nederlands
• Czech — cs, Čeština
• Traditional Chinese — zh-tw, 繁體中文
• Indonesian — id, Bahasa Indonesia
• Vietnamese — vi, Tiếng Việt
• Persian — fa, فارسی
• Hindi — hi, हिन्दी

python tools\strings.py                        :: Regenerate resource.h, lang/en.rc, and language/pl.lng
WireScope.exe --lng-export language\de.lng     :: Export English template for a translation
WireScope.exe --lng-check                      :: Verify coverage and format placeholders across language\*.lng

Source Layout

src/
  app/          main.cpp — GUI/CLI entry, Cli.cpp, CliOptions.cpp, CliSession.cpp, CliProcesses.cpp,
                CliDriver.cpp, CliTools.cpp, Console.cpp — VT sequences and parent console attachment
  core/         DriverBridge.h/.cpp      IOCTL 0x9300xxxx transport and read-back verified static filters
                DriverPackage.h/.cpp     Steganographic WireScope.bmp parser, in-memory FDI, RAII staging
                DriverSetup.h/.cpp       SetupAPI & INetCfg COM installer, zero-drop detach/stop, report
                PacketEngine.h/.cpp      Worker thread, batch I/O, firewall, delay line, per-app counters
                TrafficController.h/.cpp Transactional mode planner, crash recovery record, global mutex
                ProcessMapper.h/.cpp     250 ms IPv4/IPv6 TCP & UDP socket table snapshots
                ProcessTrust.h/.cpp      WinVerifyTrust, catalog hash lookup, MSIX parser, path heuristics
                Rules.h/.cpp             Rule & selector parser, CIDR range decomposition, L3/L4/app matcher
                RuleCompiler.h/.cpp      Compiles user rules into 181-byte STATIC_FILTER entries
                Impairment.h/.cpp        Latency, jitter, loss, token-bucket rate shaper, delay queue
                FrameView.h/.cpp         Zero-copy L2/L3/L4 frame header inspection
                PacketParser.h/.cpp      Deep protocol dissection: DNS, TLS SNI, HTTP, ARP, ICMPv6
                PcapWriter.h/.cpp        libpcap 2.4 writer with microsecond timestamps
                Safety.h/.cpp            DNS, HTTPS, and Remote Desktop lock-out analyzer
                FilterAbi.h              181-byte STATIC_FILTER ABI definitions and static_asserts
  gui/          MainWindow.cpp, MainWindowLayout.cpp, MainWindowState.cpp, MainWindowCommands.cpp,
                MainWindowMenus.cpp, MainWindowProcesses.cpp, MainWindowDriver.cpp,
                PacketList.cpp, PacketListPaint.cpp, PacketDetails.cpp, ProcessList.cpp, RuleList.cpp,
                Theme.cpp — Direct2D/DirectWrite on Mica, Widgets.cpp, Dialogs.cpp, Menus.cpp
  support/      Handle.h — RAII kernel/GDI/SCM handles, Common.cpp, Text.cpp, Settings.cpp, Language.cpp
  resources/    app.rc, resource.h, WireScope.bmp — stego driver carrier, icon.ico, app.manifest,
                lang/en.rc, language/pl.lng
tools/          strings.py, sync-project.py, check-english.py, compile.ps1, WireScopeUi.psm1,
                screenshots.ps1, test-simulator.ps1, test-auto-undo.ps1

Building from Source

pwsh -File .\build.ps1                  # Release x64 build + SHA-256 build receipt
pwsh -File .\build.ps1 -Rebuild         # Full clean rebuild
pwsh -File .\build.ps1 -Configuration Debug
pwsh -File .\build.ps1 -Clean

build.ps1 locates the newest Visual Studio instance providing MSBuild, the v145 toolset, and the x64 cl.exe compiler alongside the newest complete Windows 10/11 SDK. Every translation unit is compiled under C++23 with /std:c++latest /W4 /WX /sdl /guard:cf /CETCompat /Brepro and zero warnings. The build produces bin\WireScope.exe — ~1.40 MB, statically linked with /MT and zero external DLL dependencies — along with bin\language\*.lng and bin\build-receipt.json recording the SHA-256 digest of every source input and binary output.

License

MIT — see LICENSE.md.

The wsddntf.sys NDIS lightweight filter driver is third-party software developed by NT Kernel Resources and signed by TPZ Soluções Digitais Ltda and Microsoft Windows Hardware Compatibility Publisher.

Add a comment

Name (optional)

Email (optional, never published)

Comment *

Type the characters from the image *

Submit