Support for Windows Vista using NDIS 5 Protocol Drivers

The primary objective of this release is migration of existing Rawether applications to Windows Vista with a minimum of effort. The development goals for this release included:

PCAUSA understands that some customers are still using Visual Studio 2003 for application development. Visual Studio 2003 is not the most desirable environment for developing applications for Windows Vista.
       This is the last Rawether release that will provide sample applications as Visual Studio 2003 projects

This release does not address:

These topics will be addressed in Rawether V6.0

Rawether NDIS Protocol Driver Bug fixes

The bug fixes incorporated into this release were initially reported by PCAUSA customers. There were two loosely related problems:

1. A crash that could occur when exiting an application that has multiple reads pending on the PcaSp50 NDIS protocol driver.

2. A crash that could occur when entering Standby.

In addition to providing fixes to these problems, a systematic review of the Rawether driver memory reference counting logic was made. The Rawether reference counting logic was replaced with components from the PCAUSA "Network Driver Framework" (NDF). The NDF reference-counted memory logic loosely parallels memory management functions provided in the Microsoft "Windows Driver Framework" (WDF). 

Visual Studio 2005 RTM Support

This release includes support for Visual Studio .NET 2005. Support includes building both 32-bit and 64-bit versions of key Rawether components including NDIScope, MPRead, HookPeek and the W32N55/W64N55 support DLL.

Rawether .NET C# sample applications and the Rawether .NET class library can also be built using VS 2005.

Window x64 (AMD64) Edition Support

Prior versions of Rawether (Build 1700) included preliminary x64 support based on the preview release of Windows XP 64-Bit Extended Edition for AMD and the Windows Server 2003 DDK AMD build tools.

The primary purpose of this of this Rawether release is to provide support for Windows x64 Edition (AMD64) as released to manufacturing.

Only minor changes to the prior Rawether Build 1700 64-bit drivers and user-mode components were actually required to accommodate the Windows x64 Edition AMD64 DDK. We did, however, change the name of the Rawether API support DLL from W64N55amd64.DLL to simply W64N55.DLL since Microsoft has dropped ia64 (Itanium) support on platforms of interest to PCAUSA. 

Rawether .NET and Visual Studio 2005 CTP Changes

Some changes were made to the C# Rawether .NET Class Libraries to deal with changes in the .NET Framework 2.0. Although VS 2005 is not a released product we are attempting to move the Rawether .NET framework along as VS 2005 evolves. In addition, most problems found this way improve the VS 2003-based product.

The bulk of these changes have no effect on current Rawether .NET users under VS 2003 on 32-bit platforms.

Bug Fix

Fixed bug in SetInformation handler that caused incorrect data lengths to be passed in some cases. Observable effects of this bug were NDIS_802_11_ENCRYPTION_STATUS and NDIS_802_11_AUTHENTICATION_MODE would fail with NDIS_STATUS_INVALID_LENGTH error.

Rawether .NET C# Programming Interface Enhancements

1.) Implemented new NDIS_NDIS_802_11_WEP class to replace NDIS structure by same name. The new class is easier to use.

2.) Implemented new NDIS_802_11_KEY class to replace NDIS structure by same name. The new class is easier to use.

3.) Extended the Internet classes to include partial implementations of these IP-related classes:

4.) Added a Rawether .NET forms-based version of NDIScope. This illustrates many of the NDIS query functions. In addition, it includes a rudimentary packet capture display facility that is loosely modeled after the Unix TcpDump utility.  

Bug Fixes in V5.5 802.11 Helper Functions

Unfortunately the initial release of Rawether V5.5 included two bugs in the 802.11 helper functions. These have been fixed in this maintenance release:

 See Detailed Release Notes.
 

Rawether .NET C# Programming Interface - Beta 1

Rawether .NET is a .NET Framework API written in C#  that provides a uniform interface between user-mode applications and PCAUSA NDIS drivers. Basically, it is a C# version of the current Rawether for Windows 'C' API - but greatly extended. Rawether .NET provides a rich, consistent NDIS user-mode .NET Framework API across the Windows ME, Windows 2000, Windows XP, Windows Server 2003 platforms.

This release of Rawether includes Beta 1 of Rawether .NET.

 See Introduction to Rawether .NET.
 

Compatibility with Prior Rawether Versions

Although there are some fairly significant changes to the Rawether runtime components, one goal has been to preserve compatibility with applications built using the prior Rawether V5.0 framework. We believe that most existing applications based on Rawether V5.0 can be adapted to use this new release by simply recompiling with the new headers and linking with the new Rawether DLL import library.

Eliminate Side-By-Side Rawether Runtime Installation Conflicts

Because of the wide acceptance and distribution of Rawether it is not uncommon to encounter situations where multiple Rawether-based applications are concurrently installed on a workstation. Unfortunately, prior versions of Rawether did not adequately support side-by-side runtime component installation and conflicts sometime occur. A major goal of this release is to address this issue.

The preferred way to resolve side-by-side runtime component conflicts is to rebuild the Rawether runtime components (DLL and drivers) using OEM-specific internal and external names and OEM copyright. However, not all PCAUSA customers have in-house resources needed to build an OEM version of these components.

Changes made in this release provide a way to create renamed versions of the Rawether Windows NT and higher NDIS protocol drivers (but NOT Windows 9X/ME drivers...) by simply renaming the driver .sys file and placing the renamed driver in the System32\Drivers folder; this eliminates Rawether driver conflicts. The Rawether DLL is moved to the OEM's Program Files folder instead of the System32 folder; this eliminates Rawether DLL conflicts.

The final piece of the conflict resolution mechanism is use of an initialization file located in the OEM's Program Files folder . The initialization file contains the OEM's names of the renamed Rawether drivers and other OEM-specific information. Information in the initialization file is used to insure that the DLL calls the OEM's copy of the Rawether NDIS protocol drivers.

Expanded Support for 802.11 Adapter Management

Rawether V5.0 has been widely used by wireless adapter vendors and wireless service vendors to manage 802.11 adapters. This release provides additional built-in support for 802.11 management operations.

Support For Windows XP 64-Bit Extended Edition

This release adds support for Windows XP 64-Bit Edition for 64-Bit Extended Systems (AMD64). Rawether supports both 32-bit and 64-bit applications on AMD64. In fact, the same 32-bit Rawether application can run on all Windows platforms from Windows 95 through Windows XP 64-bit Edition.

Rawether does NOT currently support Intel ia64 (Itanium) 64-bit platforms.

Overhaul of Rawether Win32 NDIS DLL

As part of this release the Rawether DLL has been fairly extensively overhauled. Redundant and deprecated code has been removed and important warnings uncovered by the more recent compilers have been addressed. Additional DLL modifications were made, including:

Various Driver Improvements

Including some small changes that may improve the efficiency of the multi-packet read driver. Improved reference counting associated with handling NDIS requests.

Various Improvements to Packet Collection Applications

Some improvements in detecting shutdown situations have been added to the packet collection application samples.

Rawether Runtime Component Name Changes

Of course, one of the more noticeable changes associated with this release is the changes in the stock names of the Rawether runtime components. Click here to see the V5.5 component names.

These name changes can also be seen in the Rawether V5.5 simplified block diagram.

Rawether Application Build Environment

With this release Rawether finally abandons the legacy Microsoft Visual C++ 6.0 development environment and moves to Microsoft Visual Studio .NET 2003. There is some work involved in making this transition because the more recent compilers catch errors that went unnoticed in the older environment. PCAUSA had to systematically resolve a few new warnings. If you haven't made this move yourself, then the newer compiler will probably uncover some previously undiscovered problems in your own code.

 See Detailed Release Notes.
 

Bug Fix

1. Interim bug fix release. Fixed bug introduced in V5.03.16.57. The flaw was in kernel-mode string parsing code used to extract ServiceName from the RegistryPath in DriverEntry routine.
   
   This bug has the effect of causing the creation of a bogus driver ServiceName and SymbolicLink name under some conditions. On some systems running WLANDetect the first time would succeed. However, running WLANDetect a second time would fail. Since it was a string-related bug there could have been other unpredictable problems as well.

Customers using V5.03.16.57 should upgrade to V5.03.16.58.

The next release of Rawether for Windows (Version 5.5) will introduce new features that will require your applications to be recompiled with new V5.5 header files and link with a new Rawether API DLL. Most of your existing Rawether applications will be source-compatible when rebuilt in the V5.5 environment.

 See Detailed Release Notes.
 

Bug Fixes

1. Made correct update of W32NDIS.h with OIDs and structures for Wi-Fi Protected Access (WPA). Update in V5.03.16.56 was incomplete.
    
2. Fixed bug in PCAMPR driver related to handling partial packets in ProtocolReceive handler. Bug was that offset passed to NdisTransferData was incorrect. This bug showed up primarily on some RealTek/SMC adapters. PCANDIS drivers did not have this defect.
    
3. The W32N50 DLL includes a user-mode version of the BPF filter code that can be used for testing. Modified the user-mode bpf_filter() function to correctly match the kernel-mode bpf_filter() implementation.
    

Enhancements

1. Made minor modifications needed to allow Rawether for Windows to run successfully on Windows Longhorn PDC/DevCon preview (Build 4051).
    
2. Other improvements are part of work-in-progress leading to the next major release of Rawether for Windows.

Bug Fixes

1. Fixed several bugs uncovered by PreFast tool introduced in Windows DDK Build 3790.
    
2. Fixed bug that was first identified when running Rawether over Agnitum Outpost Firewall.
   
   The cause of this bug was that under some circumstances the adapter is opened and then closed immediately. On some systems the automatic query sequence initiated within the driver has not completed when the driver was closed and some of these queries were made on an invalid adapter handle.
    
3. Fixed bug in driver BPF update logic. Improper synchronization when changing the BPF caused problems when applications changed the BPF frequently after packet reception had been started.
    
4. Additional sanity checks for adapter close in progress when handling request, send and receive IRPs.
    
5. Fixed bug where W32N_CloseAndFreeOpenContext was called at IRQL < PASSIVE_LEVEL (spin lock held) leading to an occasional bugcheck when NdisFreeSpinLock was called.
    
6. Fixed a driver bug that resulted in a rare bugcheck PROCESS_HAS_LOCKED_PAGES.
    
7. Fixed a bug that caused the MacEnum adapter list to be empty or to omit to list some adapters when running Rawether on Windows Server 2003.
    
8. Made small bug fix in C# version of NDIScope. System default exception message was (safely) displayed when adapter could not be opened. Now catch that exception and display message box.
    

Enhancements

1. Updated W32NDIS.h with OIDs and structures for Wi-Fi Protected Access (WPA).
    
2. Made changes to MPR driver to provide "better real-time responsiveness". Can now set read timeout value to lower values using the MPR_SetReadTimeout function.
    
3. Replaced use of NdisAllocateMemory with NdisAllocateMemoryWithTag.
    
4. Made changes to NDIScope application to accommodate obscure "requirement" that NDIS requests must have at least one byte in the InformationBuffer.
    
5. In driver receive indication handler now use Dpr spin lock functions since the routine is always called at IRQL DISPATCH_LEVEL.
    

Bug Fixes

Backed out fix introduced in V5.01.14.52 intended to fix a problem with some RealTek-based adapters specifically on Windows 2000. The fix made in V5.01.14.52 was not correct and inadvertently caused problems with other adapters.

Minor Functional Changes

1. Backed out another change introduced in V5.01.14.52. This change has not caused any bugs. However, it did interfere with at least one customer's miniport communication mechanism where a private NDIS set information request did double-duty and also returned information.
    
2. Modifications intended to simplify creation of OEM versions of Rawether runtime support components. Replaced several hard-coded string definitions in favor of strings defined in common header files.
    

Additional Sample Code

1. Added experimental code that illustrates use of the Microsoft .NET Framework with the WinDis 32 API. The sample is prototype implementation of the NDIScope application.
    
2. Added skeleton Notify Object that can be used when installing PCANDIS5.SYS using the Network Control Panel.

1. Added new "Multi-Packet Read" (MPR) NDIS protocol driver (PCAMPR#.SYS) that offers significant performance improvement when monitoring 100Mbps Fast Ethernet and 1000Mbps Gigabit Ethernet networks.
    
   Companion "MPRead" application, similar to HookPeek APC version, illustrates using the the MPR NDIS protocol driver.
   
   See the PCANDIS/PCAMPR Performance Comparison topic.
    
2. Major improvement to adapter enumeration API provided by W32N50 DLL. An entirely new API has been developed which includes the following features:
    
   * Uses SetupDi API instead of registry mining to establish list of adapters. Only adapters that are actually present are listed. (Windows 98/ME/2000/XP only)
   * Enumeration includes listing of NDIS IM virtual adapters when present.
   * New API includes UNICODE support.
    
3. Added new Wireless LAN Detector (WLANDetect) sample application. This illustrates using the MacEnum and Win32 NDIS API to automatically (and safely) detect the arrival and removal of a specific adapter without requiring user interaction.
    
4. Functional enhancements to NDIScope application
    
5. Fixes and workarounds for some anomalies specific to operation on Windows 98 and certain (apparently) faulty NDIS miniport drivers.
    
6. Improved documentation. The Rawether Guide (for developers) is now over 200 pages in length.
    
7. New Rawether Installation Verification utility to help debug installation problems.
    
8. Additional bug fixes, enhancement and new simplified samples. See Detailed Release Notes.
    

1. Modified HPCtrl.c HP_StartPromiscuousReception to fallback to NDIS_PACKET_TYPE_ALL_LOCAL if setting NDIS_PACKET_TYPE_PROMISCUOUS fails. This allows Rawether to support 802.3 Wireless adapters such as the LinkSys WPC11 and 3Com AirConnect Wireless LAN PC Cards.
    
   See PCAUSA KB Article KB01290101.
    
2. Fixed bug NDIScope application in handling of power broadcast messages. This bug caused NDIScope to fail with "unknown" error when operating on Windows Me with some power management BIOS implementations. The fault was specifically noted on a HP5195 notebook running Windows Me.
     
3. Fixed bug in HookPeek application that caused multiple appended BPF programs to be concatenated incorrectly. This bug could be seen by starting HookPeek from NDIScope setting Selected IP Protocols to be TCP, UDP and ICMP then starting a PING. The PING packet would not be captured.
    
   See PCAUSA KB Article KB03220101.
    
4. Accommodated a change in the query results for OID_GEN_VENDOR_DESCRIPTION when running on Windows XP Beta 2. This change in behavior caused the Description displayed by HookPeek for some adapters as "Unknown", although HookPeek operates correctly in other respects.
    
   See PCAUSA KB Article KB04040101.
    
5. Found and fixed several bugs reported by Windows XP Driver Verifier (DV). In many cases the bugs that were exposed using this tool were applicable to the Windows NT and Windows 2000 drivers and were fixed there as well. See the detailed Release Notes for a complete list of these fixes.
    
6. Made a modification to the shared memory file mapping used internally by W32N50 DLL to determine when the supporting NDIS protocol driver can be dynamically unloaded. This change adds a NULL DACL to the security descriptor for the file mapping. This fix addresses a problem associated with concurrently accessing WinDis 32 (and the shared memory) from a NT service and from a Win32 application.
    
7. Modified W32N50.DLL to use ReadFile and WriteFile instead of IOCTL_PCANDIS_PACKET_READ_EX and IOCTL_PCANDIS_BUFFER_SEND_EX DeviceIoControl calls for Windows NT and Windows 2000.
   
   This eliminates unnecessary code path in these drivers. Change tested using HookPeek "Wait" version.
    
8. Modified the "Simple" request sample. Now illustrates fetching media connect status. Other cleanup of this sample.
    
9. Other minor bug fixes and code cleanup as described in the detailed Release Notes.

Enhancements

1. W32N_IoctlNdisQueryGlobalStats – Windows NT and Windows 2000 include a facility that allows a Win32 application to use DeviceIoControl on the IOCTL_NDIS_QUERY_GLOBAL_STATS IOCTL to make some NDIS queries. The new W32N_IoctlNdisQueryGlobalStats function simplifies use of that facility. A new test application, RTPlus (Registry Test Plus) illustrates use of W32N_IoctlNdisQueryGlobalStats.
    
2. Non-Administrator User – Modifications were made to the Windows NT/Windows 2000 driver loader (in W32N50 DLL) to allow an Administrator to configure the Win32 NDIS Framework so non-Administrator users can use Win32 NDIS Framework applications.
    
3. High-Resolution Timestamps – Added optional high-resolution timestamp mode. The high-resolution timestamp is fetched using KeQueryPerformanceCounter on Windows NT/2000 and VTD_Get_Real_Time on Windows 9X and Windows Millennium.
    
4. PnP Handlers – Minimal PnP handlers were added to PCANDIS5.SYS.
    
5. Common NT/2000 Driver Source – The PCANDIS4.SYS and PCANDIS5.SYS driver sources were modified so that both drivers are built from identical source modules.

Bug Fixes

1. W32N_MakeNdisRequest has been modified to eliminate the 512-byte limit that was previously imposed on the InformationBuffer length. In the revised implementation the driver probes and locks Win32 applications InformationBuffer instead of using the fixed-size RequestBuffer field of the W32N_REQUEST structure.
    
   See PCAUSA KB Article KB10160001.
    
2. W32N_MakeNdisRequest now correctly returns the BytesNeeded information to user mode when the buffer is too short.
    
   See PCAUSA KB Article KB11049901.
    
3. Improved handling of surprise removal (e.g., PC Card eject) of adapters on Windows 2000. A page fault was generated on surprise removal without these changes.
    
4. Other minor bug fixes and code cleanup as described in the detailed Release Notes.

Note: Versions 5.00.13.47 and 5.00.13.48 were private builds used for limited external testing.

NOTE: This is a Compatibility-Level revision (12->13), meaning that previous versions of the PCANDIS drivers and the W32N50.DLL are incompatible with the components in this release. See the important change note concerning NDIS protocol driver renaming below. This will require customers to install drivers with different names for all platforms and possibly remove drivers that are no longer referenced.

1.) WinDis 32 V5.00.12.40 introduced some modifications to accommodate Windows 2000. At the time it was thought that a single NDIS protocol driver could be used for both Windows NT 4.0 and Windows 2000. This is "almost" true. The primary motivation for the change described below is that the change introduced in WinDis 32 V5.00.12.40 appears NOT to work correctly on MP machines.

At this time it appears that a better design is to provide separate drivers for Windows NT 4.0 and Windows 2000. Initially, the only difference between the two drivers is that the Windows NT 4.0 driver is built under the Windows NT 4.0 DDK and the Windows 2000 driver is built under the Windows 2000 DDK. It is expected that the code may diverge more significantly in future releases.

This version introduces the following NEW driver naming conventions:

OLD NAME      NEW NAME       PLATFORM         BUILD ENVIRONMENT
PCANDIS5.VXD  PCANDIS3.VXD   Windows 9X       VtoolsD
PCANDIS5.SYS  PCANDIS4.SYS   Windows NT 4.0   NT 4.0 DDK
- NONE -      PCANDIS5.SYS   Windows 2000     Windows 2000 DDK

This change requires an associated change to the W32N50 DLL, but does NOT change the WinDis 32 programming interface.


2.) Fixed bugs in PCANDIS5.SYS for W32N_PacketSend and W32N_PacketSendEx that resulted in a BSOD when the driver could not allocate resources required to perform the send. This bug occurs when sends are used heavily, as they were in OEM_568's product.

3.) In PCANDIS5.SYS driver, include code to conditionally use NdisSendPackets() instead of NdisSend(). Use of these NdisSendPackets/NdisSend functions can be controlled at compile time using the USE_NDIS_SEND_PACKETS preprocessor definition. Default build is to use NdisSend().


4.) Added new PCARmDrv.EXE program to be used, if necessary, during development to call the Windows NT Service Control Manager to Stop and Remove PCANDIS driver registry entries under certain unusual conditions.


5.) In PCANDIS5.SYS and PCANDIS5.VxD drivers, removed test code controlled by ALWAYS_USE_NDIS_TRANSFER_DATA preprocessor statement. This test code should never be used.