Win10Pcap is a new WinPcap-based Ethernet packet capture library. Win10Pcap is compatible with the NDIS 6.x driver model to work stably with Windows 10. Win10Pcap also supports capturing IEEE802.1Q VLAN tags.It has binary compatibility with the original WinPcap DLLs. You can run Wireshark or other WinPcap-compatible applications with Win10Pcap by simply installing Win10Pcap DLLs, instead of the original WinPcap.
v10.2 [Oct 9, 2015]
Added the security check code on the read/write/ioctl procedures on the Win10Pcap kernel-mode driver. In the previous version of Win10Pcap, the kernel-mode driver did not check the virtual addresses which are passed from the user-mode. A local user was able to exploit this to read or write data bytes in the kernel-space memory. This had a risk to allow a local user to gain the escalated privilege on the local system. This security check code is to prevent such as illegal access from a local user.
