Hi, everyone.
I try to bypass TDI/TDX filter without remove, is there any way to realize that?
I try to bypass TDI/TDX filter without remove, is there any way to realize that?
A forum for reverse engineering, OS internals and malware analysis
Vrtule wrote:If you wish to bypass it from kernelmode, try to use Winsock Kernel (WskXxx routines). MSDN says that TDI on Vista and newer systems is implemented via WSK (sbecause it is deprecated), so I expect that Wsk routines do not pass data through TDI.Thanks for your reply. I try to bypass TDI/TDX filter for all programs. It means that "TDI/TDX filter is exist but not take effect".
I actually do not know how TDI filters work. But if they only attach their devices itno device stacks of the TDI driver \Driver\tdix), passing your TDI IRPs directly to the TDI devices should do the job.