;------------------------------------------------------------------------- ; NPCAP.INF -- Npcap NDIS 6.x LightWeight Filter Driver ; ; Copyright (c) 2021, Insecure.Com LLC. All rights reserved. ;------------------------------------------------------------------------ [version] Signature = "$Windows NT$" Class = NetService ClassGUID = {4D36E974-E325-11CE-BFC1-08002BE10318} CatalogFile = %NPF_DriverName%.cat Provider = %Insecure% DriverVer = 11/29/2021,10.59.20.482 PnpLockDown=1 [Manufacturer] %Insecure%=Insecure,NTx86,NTARM64,NTamd64 [Insecure.NTx86] %NPF_Desc_Standard%=FilterStandard, INSECURE_NPCAP %NPF_Desc_WiFi%=FilterWiFi, INSECURE_NPCAP_WIFI [Insecure.NTARM64] %NPF_Desc_Standard%=FilterStandard, INSECURE_NPCAP %NPF_Desc_WiFi%=FilterWiFi, INSECURE_NPCAP_WIFI [Insecure.NTamd64] %NPF_Desc_Standard%=FilterStandard, INSECURE_NPCAP %NPF_Desc_WiFi%=FilterWiFi, INSECURE_NPCAP_WIFI ;------------------------------------------------------------------------- ; Installation Section ;------------------------------------------------------------------------- [FilterStandard] NetCfgInstanceId="{7daf2ac8-e9f6-4765-a842-f1f5d2501341}" Copyfiles = npf.copyfiles.sys Characteristics=0x40000 AddReg=FilterStandard.reg [FilterWiFi] NetCfgInstanceId="{7daf2ac8-e9f6-4765-a842-f1f5d2501351}" Characteristics=0x40000 AddReg=FilterWiFi.reg [SourceDisksNames] 1=%NPF_Desc_Standard%,"",, [SourceDisksFiles] npcap.sys=1 [DestinationDirs] DefaultDestDir=12 npf.copyfiles.sys=12 [npf.copyfiles.sys] %NPF_DriverName%.sys,,,2 ;------------------------------------------------------------------------- ; Ndi installation support for the standard filter ;------------------------------------------------------------------------- [FilterStandard.reg] HKR, Ndi,Service,,%NPF_Filter_Name_Standard% HKR, Ndi,CoServices,0x00010000,%NPF_Filter_Name_Standard% HKR, Ndi,HelpText,,%NPF_HelpText_Standard% HKR, Ndi,FilterClass,, compression ; For a Monitoring filter, use this: ; HKR, Ndi,FilterType,0x00010001, 1 ; Monitoring filter ; For a Modifying filter, use this: ; HKR, Ndi,FilterType,0x00010001, 2 ; Modifying filter HKR, Ndi,FilterType,0x00010001,2 HKR, Ndi\Interfaces,UpperRange, , noupper HKR, Ndi\Interfaces,LowerRange, , "nolower, ndis5" ; TODO: Ensure that the list of media types below is correct. Typically, ; filters include "ethernet". Filters may also include "ppip" to include ; native WWAN stacks, but you must be prepared to handle the packet framing. ; Possible values are listed on MSDN, but common values include: ; ethernet, wan, ppip, wlan HKR, Ndi\Interfaces, FilterMediaTypes,,"ethernet, fddi, wan, ppip, wlan, bluetooth, ndis5, vwifi, flpp4, flpp6, vchannel, nolower" ; For a Mandatory filter, use this: ; HKR, Ndi,FilterRunType,0x00010001, 1 ; Mandatory filter ; For an Optional filter, use this: ; HKR, Ndi,FilterRunType,0x00010001, 2 ; Optional filter HKR, Ndi,FilterRunType,0x00010001, 2 ; Optional filter ; By default, Mandatory filters unbind all protocols when they are ; installed/uninstalled, while Optional filters merely pause the stack. If you ; would like to override this behavior, you can include these options. These ; options only take effect with 6.30 filters on Windows "8" or later. ; To prevent a full unbind, and merely pause/restart protocols: ; HKR, Ndi,UnbindOnAttach,0x00010001, 0 ; Do not unbind during FilterAttach ; HKR, Ndi,UnbindOnDetach,0x00010001, 0 ; Do not unbind during FilterDetach ; To force a full unbind/bind (which includes pause/restart, of course): ; HKR, Ndi,UnbindOnAttach,0x00010001, 1 ; Unbind during FilterAttach ; HKR, Ndi,UnbindOnDetach,0x00010001, 1 ; Unbind during FilterDetach ; ;------------------------------------------------------------------------- ; Ndi installation support for the WiFi filter ;------------------------------------------------------------------------- [FilterWiFi.reg] HKR, Ndi,Service,,%NPF_Filter_Name_WiFi% HKR, Ndi,CoServices,0x00010000,%NPF_Filter_Name_WiFi% HKR, Ndi,HelpText,,%NPF_HelpText_WiFi% HKR, Ndi,FilterClass,, ms_medium_converter_128 ; For a Monitoring filter, use this: ; HKR, Ndi,FilterType,0x00010001, 1 ; Monitoring filter ; For a Modifying filter, use this: ; HKR, Ndi,FilterType,0x00010001, 2 ; Modifying filter HKR, Ndi,FilterType,0x00010001,2 HKR, Ndi\Interfaces,UpperRange, , noupper HKR, Ndi\Interfaces,LowerRange, , nolower ; TODO: Ensure that the list of media types below is correct. Typically, ; filters include "ethernet". Filters may also include "ppip" to include ; native WWAN stacks, but you must be prepared to handle the packet framing. ; Possible values are listed on MSDN, but common values include: ; ethernet, wan, ppip, wlan HKR, Ndi\Interfaces, FilterMediaTypes,,"wlan" ; For a Mandatory filter, use this: ; HKR, Ndi,FilterRunType,0x00010001, 1 ; Mandatory filter ; For an Optional filter, use this: ; HKR, Ndi,FilterRunType,0x00010001, 2 ; Optional filter HKR, Ndi,FilterRunType,0x00010001, 2 ; Optional filter ; By default, Mandatory filters unbind all protocols when they are ; installed/uninstalled, while Optional filters merely pause the stack. If you ; would like to override this behavior, you can include these options. These ; options only take effect with 6.30 filters on Windows "8" or later. ; To prevent a full unbind, and merely pause/restart protocols: ; HKR, Ndi,UnbindOnAttach,0x00010001, 0 ; Do not unbind during FilterAttach ; HKR, Ndi,UnbindOnDetach,0x00010001, 0 ; Do not unbind during FilterDetach ; To force a full unbind/bind (which includes pause/restart, of course): ; HKR, Ndi,UnbindOnAttach,0x00010001, 1 ; Unbind during FilterAttach ; HKR, Ndi,UnbindOnDetach,0x00010001, 1 ; Unbind during FilterDetach ; ;------------------------------------------------------------------------- ; Service installation support ;------------------------------------------------------------------------- [FilterStandard.Services] AddService=%NPF_Filter_Name_Standard%,,FilterStandard.svc [FilterWiFi.Services] AddService=,2 [FilterStandard.svc] DisplayName = %NPF_Desc_Standard% ServiceType = 1 ;SERVICE_KERNEL_DRIVER StartType = 1 ;SERVICE_SYSTEM_START ErrorControl = 1 ;SERVICE_ERROR_NORMAL ServiceBinary = %12%\%NPF_DriverName%.sys LoadOrderGroup = NDIS Description = %NPF_Desc_Standard% AddReg = NpcapConfig.reg, Common.Params.reg, NdisImPlatformBindingOptions.reg [FilterStandard.Remove.Services] DelService=%NPF_Filter_Name_Standard%,0x200 ; SPSVCINST_STOPSERVICE [FilterWiFi.Remove.Services] DelService=%NPF_Filter_Name_WiFi%,0x200 ; SPSVCINST_STOPSERVICE [NpcapConfig.reg] HKR, Parameters, LoopbackSupport, 0x00010001, 1 HKR, Parameters, DltNull, 0x00010001, 1 ; These parameters may be overwritten by the installer HKR, Parameters, Edition, , "Npcap" HKR, Parameters, AdminOnly, 0x00010001, 0 HKR, Parameters, Dot11Support, 0x00010001, 0 ; Historical, not used ; HKR, Parameters, VlanSupport, 0x00010001, 0 [Common.Params.reg] [NdisImPlatformBindingOptions.reg] ; By default, when an LBFO team or Bridge is created, all filters will be ; unbound from the underlying members and bound to the TNic(s). This keyword ; allows a component to opt out of the default behavior ; To prevent binding this filter to the TNic(s): ; HKR, Parameters, NdisImPlatformBindingOptions,0x00010001,1 ; Do not bind to TNic ; To prevent unbinding this filter from underlying members: ; HKR, Parameters, NdisImPlatformBindingOptions,0x00010001,2 ; Do not unbind from Members ; To prevent both binding to TNic and unbinding from members: ; HKR, Parameters, NdisImPlatformBindingOptions,0x00010001,3 ; Do not bind to TNic or unbind from Members HKR, Parameters, NdisImPlatformBindingOptions,0x00010001,0 ; Subscribe to default behavior [Strings] NPF_DriverName = "npcap" NPF_Filter_Name_Standard = "npcap" NPF_Filter_Name_WiFi = "npcap_wifi" Insecure = "Nmap Project" NPF_Desc_Standard = "Npcap Packet Driver (NPCAP)" NPF_Desc_WiFi = "Npcap Packet Driver (NPCAP) (Wi-Fi)" NPF_HelpText_Standard = "A NDIS 6 filter driver & WFP callout driver to support packet capturing and sending under Windows 7, 8 & 10" NPF_HelpText_WiFi = "A NDIS 6 filter driver & WFP callout driver (Wi-Fi) to support packet capturing and sending under Windows 7, 8 & 10"