Local Proxy Server and NDIS+TDI

[yduuz]

Some antiviruses and firewals work as “Local Proxy” (ex ESET Smart Security), so using your NDIS and TDI libraries I can’t determine which application a packet belongs to.
Is there a way to defeat that?

[Vadim Smirnov]

Transparent local proxy? If you can’t intercept application network activity on the TDI level then probably mentioned antiviruses use Layered Service Provider (LSP) to redirect the connection to the local proxy and thus it does reach TDI only from the name of local proxy, not in the context of the calling application. If this is really so you have to create your own LSP and layer it just above AV LSP to get connection first.

[yduuz]

As I see on your site you don’t have an LSP solution. Do you plan to make one in the near future?

[Vadim Smirnov]

LSP sample is available in WIndows SDK. Personally I don’t like LSP, its implementation in Windows wishes better.

[Author]

Posts