Npcap 0.993

Installer, SDK, and debug symbols available from https://npcap.org/#download

• Complete the fix for #1398 that was only
  partially applied in Npcap 0.992. Due to this partial fix, the user-provided
  buffer was double-freed, resulting in a BAD_POOL_CALLER BSoD. This issue
  was separately reported as #1568, and has been
  issued the identifier CVE-2019-11490.

• Fix output of pcap_lib_version to again report "Npcap version 0.993, based
  on libpcap version 1.9.0" instead of "libpcap version 1.9.0 (packet.dll
  version 0.992)". Npcap 0.992 was the only version affected. Fixes
  #1566.

• Fix a regression in loopback capture that was causing the loopback adapter to
  be missing from pcap_findalldevs until the driver was manually stopped and
  restarted. Fixes #1570.

• Remove installer interface option "Automatically start the Npcap driver at
  boot time." Command-line and registry settings are still respected, but
  automatic start will be the default for all new installations, since manual
  start results in delays in network connectivity at boot. See
  #1502.

• Avoid interpreting null or uninitialized memory as out-of-band media-specific
  information for purposes of constructing the Radiotap header when capturing
  in raw 802.11 monitor mode. Fixes #1528.

• Ensure the uninstaller removes the npcapwatchdog scheduled task.

• Avoid an uninstaller failure if DLLs and executables are in use during
  uninstall by causing them to be deleted at reboot. See
  #1555.

Npcap 0.992

Installer, SDK, and debug symbols available from https://npcap.org/#download

• Update libpcap to 1.9.0. See the libpcap CHANGES
  file
  for this release and #1506.

• Fix a bug in the fix for #1406 that caused
  capture filters to reject all packets when the packet header was offset from
  the start of the kernel data structure.

• Fix a bug in the fix for #1398 that caused
  BSoD (BAD_POOL_CALLER) due to mismatch in functions used to allocate and
  free a data structure.

• Remove installer interface option "Use DLT_NULL as the loopback interface'
  link layer protocol instead of DLT_EN10MB." Command-line and registry
  settings are still respected, but DLT_NULL will be the default for all new
  installations.

• Remove installer interface option "Support 802.1Q VLAN tag when capturing and
  sending data," which was unsupported for three years. Support may be restored
  in future releases, but the option has not had any effect in earlier
  installers.

Npcap 0.991

Installer and debug symbols available from https://npcap.org/ . Note the version number structure change.

• Fix a bug in the BPF packet filter engine that caused capture filters with
  byte offsets to reject packets due to fragmentation within NET_BUFFER
  structures. See #1406 and
  #1438.

• Fix a bug that caused several network device drivers to crash when using the
  pcap_sendqueue_transmit function, due to queued network packets being
  allocated from paged memory that paged out before the drivers accessed it.
  See #1398.

• Fix a crash (SYSTEM_EXCEPTION_NOT_HANDLED_M) in WSKCloseSocket due to
  double-free, reported via Microsoft crash telemetry.

• Fix a BSOD inherited from WinPcap triggered when PacketGetStats is called
  with low system resources. See #1517.

• Properly quote the path to the CheckStatus.bat script in the
  npcapwatchdog scheduled task. See #1513.

• Fix errors when installing in WinPcap API-compatible mode over WinPcap when
  Npcap install directory does not already exist. See
  #1456.

Npcap 0.99-r9

Executable installer and debug symbols available from https://npcap.org/

• Install a scheduled task at startup to check whether the Npcap Loopback
  Adapter has been removed and restore it. Windows 10 feature updates remove
  the Adapter. See #1416.

• Package the correct driver version. On some platforms, the Npcap 0.99-r8
  installer would install the Npcap 0.99-r7 driver.

• Fix a crash (REFERENCE_BY_POINTER) in NPF_ReleaseOpenInstanceResources
  reported via Microsoft crash telemetry. See #1419.

Npcap 0.99-r8

Executable installer is available from https://npcap.org/#download

• Revert to using SERVICE_SYSTEM_START for the "Automatically start Npcap at
  boot" option. The previous value, SERVICE_AUTO_START had been introduced as
  a workaround for network interruption on Windows 7 that was finally solved in
  Npcap 0.99-r7. See #1208.

• Removed extra Registry keywords from Npcap Loopback Adapter which were
  causing it to not appear properly in Windows API calls.
  Fixes #1368.

• Detect in-use WinPcap installations before attempting to overwrite DLLs.
  Offer to terminate the processes just as we do for in-use Npcap.

• Improved documentation based on WinPcap
  documentation including updates for Npcap changes. Example code builds on
  Visual Studio 2015 and works with Npcap. Npcap SDK 1.01 includes these changes.

• Fix a crash in NPF_RegisterCallouts reported via Microsoft crash telemetry
  caused by a failure when opening the Npcap Loopback Adapter for packet
  capture.

• On Windows 8 and Server 2012, Npcap will rebind to network adapters after
  installation to ensure a more complete fix to
  #1031.

Npcap SDK 1.01

Npcap SDK 1.01 (ZIP).
This release of the Npcap SDK includes the latest headers and documentation from libpcap 1.8.1 and Npcap 0.99-r7. Software built with SDK 1.01 should be compatible with Npcap 0.10 or later.

Note: The SDK is only available on Npcap.org. The download links in this Github Release are source code only and do not contain the .lib files or the rendered HTML documentation.

Npcap 0.99-r7

Executable installer and debug symbols available at https://nmap.org/npcap/#download

• Fixed the installer so that Npcap in WinPcap API-compatible mode can do
  loopback capture. This capability is not guaranteed for future releases, but
  was only missing from 0.99-r3 to 0.99-r6. Native-mode Npcap was unaffected.
  Fixes #1213

• Added a script, FixInstall.bat, to fix common problems with installations,
  such as those caused by Windows 10 feature upgrades.
  See #1216

• Improved stability by restoring certain passthrough NDIS callbacks that are
  not used, but appear to cause connectivity problems if omitted.
  See #1208.

Npcap 0.99-r6

Installer and debug symbols available at https://nmap.org/npcap/#download

• Fixed installation on Windows 8 and Server 2012 so that Npcap is able to
  capture on adapters without requiring a reboot. Fixes
  #1031.

• Fixed loss of networking on Windows 7 when Npcap was configured to start at
  boot. Using AUTO_START instead of SYSTEM_START for the Npcap driver
  service solves the problem. Fixes #1208.

• Fixed a crash reported via Microsoft crash telemetry,
  DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_IOControl when setting
  OID_GEN_CURRENT_LOOKAHEAD. Fixes #1194.

• Fixed certain interactions between processes with open Npcap handles that
  could allow one process to stop other running captures from receiving
  packets. Fixes #1035.

Npcap 0.99-r5

Executable installer and debug symbols available at https://nmap.org/npcap/#download

• Restored installer code to silently uninstall WinPcap if silent installation
  in WinPcap API-compatible mode is needed (Npcap OEM only).

• Removed several optional passthrough driver functions that can be handled
  more efficiently by NDIS, since Npcap was not using them.

• Added validation of IRP parameters for additional security.

• Fixed a crash reported via Microsoft crash telemetry,
  DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_SendCompleteExForEachOpen when the
  system is suspended. Fixes #1193.

• Fixed a crash reported via Microsoft crash telemetry,
  DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_IOControl when setting
  OID_GEN_CURRENT_LOOKAHEAD. Fixes #1194.

• Bundle and install the correct public code signing certificate. The
  certificate used to sign Npcap was updated for Npcap 0.99-r4, but the public
  cert file included was not, leading to some unwanted publisher trust dialogs
  during installation.

Npcap 0.99-r4

Binary installer and debug symbols available from https://nmap.org/npcap/#download

• On Windows 7, if Npcap driver installation fails due to maximum NDIS filters
  installed, attempt to increase the limit. No such limit exists on other
  Windows versions. Fixes #1182.

• Avoid some cmd.exe popup windows during installation. See
  #1188.

• Improve the license to allow unlimited copies of Npcap to be used
  (removes the 5 copy limitation) if the copies are solely used for
  Nmap and/or Wireshark.