ShadowDriver

What is this?

ShadowDriver a network utitlity library that allowing user-mode application to filter link layer and network layer packet data.

How

Filtering link layer and network layer requires a kernel-mode driver. ShadowDriver is a kernel mode driver that expose an interface that accept IOCTL calls from user-mode app to control filtering process.

Progress

You can see the detail in the project page.

Windows

• Network layer and link layer packet captureing.
• IPv4 packet modification.
• IPv6 packet modification.
• IPv4 packet Injection.
• IPv6 packet Injection.
• Link layer packet modification.
• Link layer packet injection.
• Library that communicate with the kernel driver.
• System test.

Linux

• Network layer and link layer packet captureing.
• Network layer and link layer packet modification.
• Network layer and link layer packet injection.
• Library that communicate with the kernel driver.
• System test.

Features

• Windows and Linux support.
• Mutil user-mode apps support.
• Network layer and link layer packet captureing.
• Network layer and link layer packet modification.
• Network layer and link layer packet injectction.
• Provide .NET library and UWP library.

Usage example

Use warpped APIs (Recommanded)

Fill it later.

Communicate to the kernel-mode driver directly

Fill it later.

Develope jounal (Mostly in Chinese)

Open Onenote development notebook