Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Attaching an NDIS LWF to a Virtual Adapter with a nolower LowerRange?

Michael_VincentMichael_Vincent Member Posts: 5

Hi,

We have an NDIS LWF, and recently we noticed that some Virtual Adapters (mostly VPNs, such as KerioControl VPN client) have Ndi\Interfaces,LowerRange,,"nolower" In their INF, therefore causing us to not attach to them because we didn't have nolower in our FilterMediaTypes inside our INF.

So we thought surely adding nolower to FilterMediaTypes will make us attach to these virtual adapters, but the results were interesting:

On Windows 7 machines, adding nolower to the FilterMediaTypes worked just fine and we attached to it, but the weird part is that on Windows 10+ machines, adding nolower to FilterMediaTypes has no effect! And the only way to attach to these virtual adapters in Windows 10 is to add ndis5 to our ndi\Interfaces,LowerRange, which previously only had nolower in it.

So my questions are:

  1. Why is it that on windows 10 machines we have to add ndis5 to our LowerRange and adding nolower to FilterMediaTypes has no effect, unlike windows 7? Is this a bug or intended?

  2. Is it safe to do this? Meaning adding ndis5 to our LowerRange (for windows 10+) and adding nolower to our FilterMediaTypes (for windows 7)?

  3. If its not safe, then what are the side effects? For example is there any possibility of BSOD? And then what is the optimal solution then in order to attach to these virtual adapters? (Other than asking their vendor to change their INF)

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online
Writing WDF Drivers 12 September 2022 Live, Online