merge upstream v4.19-9599-beta

src/Cedar/Cedar.h

@@ -138,7 +138,7 @@
 #define	CEDAR_VER					419
 
 // Build Number
-#define	CEDAR_BUILD					9582
+#define	CEDAR_BUILD					9599
 
 // Beta number
 //#define	BETA_NUMBER					3
@@ -159,10 +159,10 @@
 // Specifies the build date
 #define	BUILD_DATE_Y		2015
 #define	BUILD_DATE_M		10
-#define	BUILD_DATE_D		6
-#define	BUILD_DATE_HO		14
-#define	BUILD_DATE_MI		56
-#define	BUILD_DATE_SE		30
+#define	BUILD_DATE_D		19
+#define	BUILD_DATE_HO		20
+#define	BUILD_DATE_MI		9
+#define	BUILD_DATE_SE		5
 
 // Tolerable time difference
 #define	ALLOW_TIMESTAMP_DIFF		(UINT64)(3 * 24 * 60 * 60 * 1000)

src/Cedar/Command.c

@@ -2392,10 +2392,12 @@ UINT PtTrafficServer(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 	LIST *o;
 	UINT ret = ERR_NO_ERROR;
 	UINT port;
+	bool nohup;
 	TTS *tts;
 	PARAM args[] =
 	{
 		{"[port]", NULL, NULL, NULL, NULL},
+		{"NOHUP", NULL, NULL, NULL, NULL},
 	};
 
 	// Get the parameter list
@@ -2411,8 +2413,18 @@ UINT PtTrafficServer(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		port = TRAFFIC_DEFAULT_PORT;
 	}
 
+	nohup = GetParamYes(o, "nohup");
+
 	tts = NewTts(port, c, PtTrafficPrintProc);
 
+	if (nohup)
+	{
+		while (true)
+		{
+			SleepThread(10000);
+		}
+	}
+
 	c->Write(c, _UU("TTS_ENTER_TO_EXIT"));
 
 	Free(c->ReadLine(c, L"", true));
@@ -14974,6 +14986,7 @@ UINT PsAccessAddEx(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		{"DELAY", CmdPrompt, _UU("CMD_AccessAddEx_Prompt_DELAY"), CmdEvalMinMax, &minmax_delay},
 		{"JITTER", CmdPrompt, _UU("CMD_AccessAddEx_Prompt_JITTER"), CmdEvalMinMax, &minmax_jitter},
 		{"LOSS", CmdPrompt, _UU("CMD_AccessAddEx_Prompt_LOSS"), CmdEvalMinMax, &minmax_loss},
+		{"REDIRECTURL", NULL, NULL, NULL, NULL},
 	};
 
 	// If virtual HUB is not selected, it's an error
@@ -15017,6 +15030,7 @@ UINT PsAccessAddEx(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 	a->Delay = GetParamInt(o, "DELAY");
 	a->Jitter = GetParamInt(o, "JITTER");
 	a->Loss = GetParamInt(o, "LOSS");
+	StrCpy(a->RedirectUrl, sizeof(a->RedirectUrl), GetParamStr(o, "REDIRECTURL"));
 
 	// RPC call
 	ret = ScAddAccess(ps->Rpc, &t);
@@ -15178,6 +15192,7 @@ UINT PsAccessAddEx6(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		{"DELAY", CmdPrompt, _UU("CMD_AccessAddEx6_Prompt_DELAY"), CmdEvalMinMax, &minmax_delay},
 		{"JITTER", CmdPrompt, _UU("CMD_AccessAddEx6_Prompt_JITTER"), CmdEvalMinMax, &minmax_jitter},
 		{"LOSS", CmdPrompt, _UU("CMD_AccessAddEx6_Prompt_LOSS"), CmdEvalMinMax, &minmax_loss},
+		{"REDIRECTURL", NULL, NULL, NULL, NULL},
 	};
 
 	// If virtual HUB is not selected, it's an error
@@ -15233,6 +15248,7 @@ UINT PsAccessAddEx6(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 	a->Delay = GetParamInt(o, "DELAY");
 	a->Jitter = GetParamInt(o, "JITTER");
 	a->Loss = GetParamInt(o, "LOSS");
+	StrCpy(a->RedirectUrl, sizeof(a->RedirectUrl), GetParamStr(o, "REDIRECTURL"));
 
 	// RPC call
 	ret = ScAddAccess(ps->Rpc, &t);

src/Cedar/SeLowUser.c

@@ -126,15 +126,57 @@
 #include <Mayaqua/Mayaqua.h>
 #include <Cedar/Cedar.h>
 
+// Load the drivers hive
+bool SuLoadDriversHive()
+{
+	wchar_t config_dir[MAX_PATH];
+	wchar_t filename[MAX_PATH];
+	if (MsIsWindows10() == false)
+	{
+		return false;
+	}
+
+	MsEnablePrivilege(SE_RESTORE_NAME, true);
+	MsEnablePrivilege(SE_BACKUP_NAME, true);
+
+	CombinePathW(config_dir, sizeof(config_dir), MsGetSystem32DirW(), L"config");
+	CombinePathW(filename, sizeof(filename), config_dir, L"DRIVERS");
+
+	return MsRegLoadHive(REG_LOCAL_MACHINE, L"DRIVERS", filename);
+}
+
+// Unload the drivers hive
+bool SuUnloadDriversHive()
+{
+	// todo: always failed.
+	if (MsIsWindows10() == false)
+	{
+		return false;
+	}
+
+	return MsRegUnloadHive(REG_LOCAL_MACHINE, L"DRIVERS");
+}
+
 // Delete garbage inf files
 void SuDeleteGarbageInfs()
 {
 	void *wow;
+	bool load_hive = false;
+	Debug("SuDeleteGarbageInfs()\n");
 
 	wow = MsDisableWow64FileSystemRedirection();
 
+	load_hive = SuLoadDriversHive();
+	Debug("SuLoadDriversHive: %u\n", load_hive);
+
 	SuDeleteGarbageInfsInner();
 
+	/*
+	if (load_hive)
+	{
+		Debug("SuUnloadDriversHive: %u\n", SuUnloadDriversHive());
+	}*/
+
 	MsRestoreWow64FileSystemRedirection(wow);
 }
 void SuDeleteGarbageInfsInner()
@@ -343,7 +385,7 @@ bool SuInstallDriverInner(bool force)
 			Debug("InstallNdisProtocolDriver Ok.\n");
 
 			// Copy manually because there are cases where .sys file is not copied successfully for some reason
-			FileCopyW(src_sys, sys_fullpath);
+			Debug("SuCopySysFile from %S to %s: ret = %u\n", src_sys, sys_fullpath, SuCopySysFile(src_sys, sys_fullpath));
 
 			ret = true;
 
@@ -372,6 +414,64 @@ bool SuInstallDriverInner(bool force)
 	return ret;
 }
 
+// Copy a sys file
+bool SuCopySysFile(wchar_t *src, wchar_t *dst)
+{
+	wchar_t dst_rename[MAX_PATH];
+	UINT i;
+	if (src == NULL || dst == NULL)
+	{
+		return false;
+	}
+	if (FileCopyW(src, dst))
+	{
+		for (i = 1;i <= 100;i++)
+		{
+			UniFormat(dst_rename, sizeof(dst_rename), L"%s.old%u", dst, i);
+
+			FileDeleteW(dst_rename);
+		}
+
+		return true;
+	}
+
+	for (i = 1;;i++)
+	{
+		UniFormat(dst_rename, sizeof(dst_rename), L"%s.old%u", dst, i);
+
+		if (IsFileExistsW(dst_rename) == false)
+		{
+			break;
+		}
+
+		if (i >= 100)
+		{
+			return false;
+		}
+	}
+
+	if (MoveFileW(dst, dst_rename) == false)
+	{
+		return false;
+	}
+
+	if (FileCopyW(src, dst))
+	{
+		for (i = 1;i <= 100;i++)
+		{
+			UniFormat(dst_rename, sizeof(dst_rename), L"%s.old%u", dst, i);
+
+			FileDeleteW(dst_rename);
+		}
+
+		return true;
+	}
+
+	MoveFileW(dst_rename, dst);
+
+	return false;
+}
+
 // Get whether the current OS is supported by SeLow
 bool SuIsSupportedOs(bool on_install)
 {

src/Cedar/SeLowUser.h

@@ -173,9 +173,12 @@ int SuCmpAdaterList(void *p1, void *p2);
 bool SuInstallDriver(bool force);
 bool SuInstallDriverInner(bool force);
 bool SuIsSupportedOs(bool on_install);
+bool SuCopySysFile(wchar_t *src, wchar_t *dst);
 
 void SuDeleteGarbageInfs();
 void SuDeleteGarbageInfsInner();
+bool SuLoadDriversHive();
+bool SuUnloadDriversHive();
 
 #endif	// SELOWUSER_H
 

src/CurrentBuild.txt

@@ -1,4 +1,4 @@
-BUILD_NUMBER 9582
+BUILD_NUMBER 9599
 VERSION 419
 BUILD_NAME beta
-BUILD_DATE 20151006_145630
+BUILD_DATE 20151019_200905

src/Mayaqua/Microsoft.c

@@ -12609,6 +12609,14 @@ NT_API *MsLoadNtApiFunctions()
 		(BOOL (__stdcall *)(HANDLE,DWORD,LPWSTR,PDWORD))
 		GetProcAddress(nt->hKernel32, "QueryFullProcessImageNameW");
 
+	nt->RegLoadKeyW =
+		(LSTATUS (__stdcall *)(HKEY,LPCWSTR,LPCWSTR))
+		GetProcAddress(nt->hAdvapi32, "RegLoadKeyW");
+
+	nt->RegUnLoadKeyW =
+		(LSTATUS (__stdcall *)(HKEY,LPCWSTR))
+		GetProcAddress(nt->hAdvapi32, "RegUnLoadKeyW");
+
 	if (info.dwMajorVersion >= 5)
 	{
 		nt->UpdateDriverForPlugAndPlayDevicesW =
@@ -12957,6 +12965,59 @@ DWORD MsRegAccessMaskFor64BitEx(bool force32bit, bool force64bit)
 	return 0;
 }
 
+// Load the hive
+bool MsRegLoadHive(UINT root, wchar_t *keyname, wchar_t *filename)
+{
+	LONG ret;
+	if (keyname == NULL || filename == NULL)
+	{
+		WHERE;
+		return false;
+	}
+
+	if (ms->nt == NULL || ms->nt->RegLoadKeyW == NULL || ms->nt->RegUnLoadKeyW == NULL)
+	{
+		WHERE;
+		return false;
+	}
+
+	ret = ms->nt->RegLoadKeyW(MsGetRootKeyFromInt(root), keyname, filename);
+
+	if (ret != ERROR_SUCCESS)
+	{
+		Debug("RegLoadKeyW: %S %S %u\n", keyname, filename, GetLastError());
+		return false;
+	}
+	WHERE;
+
+	return true;
+}
+
+// Unload the hive
+bool MsRegUnloadHive(UINT root, wchar_t *keyname)
+{
+	LONG ret;
+	if (keyname == NULL)
+	{
+		return false;
+	}
+
+	if (ms->nt == NULL || ms->nt->RegLoadKeyW == NULL || ms->nt->RegUnLoadKeyW == NULL)
+	{
+		return false;
+	}
+
+	ret = ms->nt->RegUnLoadKeyW(MsGetRootKeyFromInt(root), keyname);
+
+	if (ret != ERROR_SUCCESS)
+	{
+		Debug("RegUnLoadKeyW: %u\n", GetLastError());
+		return false;
+	}
+
+	return true;
+}
+
 // Delete the value
 bool MsRegDeleteValue(UINT root, char *keyname, char *valuename)
 {

src/Mayaqua/Microsoft.h

@@ -495,6 +495,8 @@ typedef struct NT_API
 	BOOL (WINAPI *AddAccessAllowedAceEx)(PACL, DWORD, DWORD, DWORD, PSID);
 	HRESULT (WINAPI *DwmIsCompositionEnabled)(BOOL *);
 	BOOL (WINAPI *GetComputerNameExW)(COMPUTER_NAME_FORMAT, LPWSTR, LPDWORD);
+	LONG (WINAPI *RegLoadKeyW)(HKEY, LPCWSTR, LPCWSTR);
+	LONG (WINAPI *RegUnLoadKeyW)(HKEY, LPCWSTR);
 } NT_API;
 
 typedef struct MS_EVENTLOG
@@ -725,6 +727,9 @@ bool MsRegDeleteValue(UINT root, char *keyname, char *valuename);
 bool MsRegDeleteValueEx(UINT root, char *keyname, char *valuename, bool force32bit);
 bool MsRegDeleteValueEx2(UINT root, char *keyname, char *valuename, bool force32bit, bool force64bit);
 
+bool MsRegLoadHive(UINT root, wchar_t *keyname, wchar_t *filename);
+bool MsRegUnloadHive(UINT root, wchar_t *keyname);
+
 bool MsIsNt();
 bool MsIsAdmin();
 bool MsEnablePrivilege(char *name, bool enable);

src/Neo/NDIS5.c

@@ -442,25 +442,36 @@ NTSTATUS NeoNdisDispatch(DEVICE_OBJECT *DeviceObject, IRP *Irp)
 				if (stack->Parameters.Read.Length == NEO_EXCHANGE_BUFFER_SIZE)
 				{
 					// Address check
-					MDL *mdl = IoAllocateMdl(buf, NEO_EXCHANGE_BUFFER_SIZE, false, false, NULL);
-
-					if (mdl != NULL)
+					bool check_ok = true;
+					__try
+					{
+						ProbeForWrite(buf, NEO_EXCHANGE_BUFFER_SIZE, 1);
+					}
+					__except (EXCEPTION_EXECUTE_HANDLER)
 					{
-						MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+						check_ok = false;
 					}
 
-					if (NeoIsKernelAddress(buf) == FALSE)
+					if (check_ok)
 					{
+						MDL *mdl = IoAllocateMdl(buf, NEO_EXCHANGE_BUFFER_SIZE, false, false, NULL);
+
+						if (mdl != NULL)
+						{
+							MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+						}
+
+
 						// Read
 						NeoRead(buf);
 						Irp->IoStatus.Information = NEO_EXCHANGE_BUFFER_SIZE;
 						ok = true;
-					}
 
-					if (mdl != NULL)
-					{
-						MmUnlockPages(mdl);
-						IoFreeMdl(mdl);
+						if (mdl != NULL)
+						{
+							MmUnlockPages(mdl);
+							IoFreeMdl(mdl);
+						}
 					}
 				}
 			}
@@ -485,25 +496,37 @@ NTSTATUS NeoNdisDispatch(DEVICE_OBJECT *DeviceObject, IRP *Irp)
 				if (stack->Parameters.Write.Length == NEO_EXCHANGE_BUFFER_SIZE)
 				{
 					// Address check
-					MDL *mdl = IoAllocateMdl(buf, NEO_EXCHANGE_BUFFER_SIZE, false, false, NULL);
-
-					if (mdl != NULL)
+					bool check_ok = true;
+					__try
+					{
+						ProbeForRead(buf, NEO_EXCHANGE_BUFFER_SIZE, 1);
+					}
+					__except (EXCEPTION_EXECUTE_HANDLER)
 					{
-						MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
+						check_ok = false;
 					}
 
-					if (NeoIsKernelAddress(buf) == FALSE)
+					if (check_ok)
 					{
+						MDL *mdl = IoAllocateMdl(buf, NEO_EXCHANGE_BUFFER_SIZE, false, false, NULL);
+
+						if (mdl != NULL)
+						{
+							MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
+						}
+
+						ProbeForRead(buf, NEO_EXCHANGE_BUFFER_SIZE, 1);
+
 						// Write
 						NeoWrite(buf);
 						Irp->IoStatus.Information = stack->Parameters.Write.Length;
 						ok = true;
-					}
 
-					if (mdl != NULL)
-					{
-						MmUnlockPages(mdl);
-						IoFreeMdl(mdl);
+						if (mdl != NULL)
+						{
+							MmUnlockPages(mdl);
+							IoFreeMdl(mdl);
+						}
 					}
 				}
 			}
@@ -1387,20 +1410,6 @@ PACKET_BUFFER *NeoNewPacketBuffer()
 	return p;
 }
 
-// Check whether the specified address is kernel memory
-BOOL NeoIsKernelAddress(void *addr)
-{
-#if	0
-	if ((ULONG)addr >= (ULONG)0x80000000)
-	{
-		// Kernel memory
-		return TRUE;
-	}
-#endif	// CPU_64
-	// User memory
-	return FALSE;
-}
-
 // Reset the event
 void NeoReset(NEO_EVENT *event)
 {

src/Neo/Neo.h

@@ -328,7 +328,6 @@ NEO_EVENT *NeoCreateWin9xEvent(DWORD h);
 void NeoFreeEvent(NEO_EVENT *event);
 void NeoSet(NEO_EVENT *event);
 void NeoReset(NEO_EVENT *event);
-BOOL NeoIsKernelAddress(void *addr);
 
 #endif	// NEO_DEVICE_DRIVER
 

src/Neo6/NDIS6.c

@@ -562,25 +562,36 @@ NTSTATUS NeoNdisDispatch(DEVICE_OBJECT *DeviceObject, IRP *Irp)
 				if (stack->Parameters.Read.Length == NEO_EXCHANGE_BUFFER_SIZE)
 				{
 					// Address check
-					MDL *mdl = IoAllocateMdl(buf, NEO_EXCHANGE_BUFFER_SIZE, false, false, NULL);
-
-					if (mdl != NULL)
+					bool check_ok = true;
+					__try
+					{
+						ProbeForWrite(buf, NEO_EXCHANGE_BUFFER_SIZE, 1);
+					}
+					__except (EXCEPTION_EXECUTE_HANDLER)
 					{
-						MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+						check_ok = false;
 					}
 
-					if (NeoIsKernelAddress(buf) == FALSE)
+					if (check_ok)
 					{
+						// Address check
+						MDL *mdl = IoAllocateMdl(buf, NEO_EXCHANGE_BUFFER_SIZE, false, false, NULL);
+
+						if (mdl != NULL)
+						{
+							MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+						}
+
 						// Read
 						NeoRead(buf);
 						Irp->IoStatus.Information = NEO_EXCHANGE_BUFFER_SIZE;
 						ok = true;
-					}
 
-					if (mdl != NULL)
-					{
-						MmUnlockPages(mdl);
-						IoFreeMdl(mdl);
+						if (mdl != NULL)
+						{
+							MmUnlockPages(mdl);
+							IoFreeMdl(mdl);
+						}
 					}
 				}
 			}
@@ -603,25 +614,38 @@ NTSTATUS NeoNdisDispatch(DEVICE_OBJECT *DeviceObject, IRP *Irp)
 				if (stack->Parameters.Write.Length == NEO_EXCHANGE_BUFFER_SIZE)
 				{
 					// Address check
-					MDL *mdl = IoAllocateMdl(buf, NEO_EXCHANGE_BUFFER_SIZE, false, false, NULL);
-
-					if (mdl != NULL)
+					bool check_ok = true;
+					__try
 					{
-						MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
+						ProbeForRead(buf, NEO_EXCHANGE_BUFFER_SIZE, 1);
+					}
+					__except (EXCEPTION_EXECUTE_HANDLER)
+					{
+						check_ok = false;
 					}
 
-					if (NeoIsKernelAddress(buf) == FALSE)
+					if (check_ok)
 					{
+						// Address check
+						MDL *mdl = IoAllocateMdl(buf, NEO_EXCHANGE_BUFFER_SIZE, false, false, NULL);
+
+						if (mdl != NULL)
+						{
+							MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
+						}
+
+						ProbeForRead(buf, NEO_EXCHANGE_BUFFER_SIZE, 1);
+
 						// Write
 						NeoWrite(buf);
 						Irp->IoStatus.Information = stack->Parameters.Write.Length;
 						ok = true;
-					}
 
-					if (mdl != NULL)
-					{
-						MmUnlockPages(mdl);
-						IoFreeMdl(mdl);
+						if (mdl != NULL)
+						{
+							MmUnlockPages(mdl);
+							IoFreeMdl(mdl);
+						}
 					}
 				}
 			}
@@ -1644,20 +1668,6 @@ PACKET_BUFFER *NeoNewPacketBuffer()
 	return p;
 }
 
-// Check whether the specified address is kernel memory
-BOOL NeoIsKernelAddress(void *addr)
-{
-#if	0
-	if ((ULONG)addr >= (ULONG)0x80000000)
-	{
-		// Kernel memory
-		return TRUE;
-	}
-#endif	// CPU_64
-	// User memory
-	return FALSE;
-}
-
 // Reset the event
 void NeoReset(NEO_EVENT *event)
 {

src/Neo6/Neo6.h

@@ -337,7 +337,6 @@ NEO_EVENT *NeoCreateWin9xEvent(DWORD h);
 void NeoFreeEvent(NEO_EVENT *event);
 void NeoSet(NEO_EVENT *event);
 void NeoReset(NEO_EVENT *event);
-BOOL NeoIsKernelAddress(void *addr);
 
 #endif	// NEO_DEVICE_DRIVER
 

src/Neo6/Neo6.vcproj

@@ -79,7 +79,7 @@
 				IgnoreImportLibrary="true"
 				LinkLibraryDependencies="false"
 				AdditionalOptions="/driver /subsystem:native,5.00 /FULLBUILD /align:0x80 /osversion:5.00 /STACK:0x40000,0x1000 /MERGE:_PAGE=PAGE /MERGE:_TEXT=.text /NODEFAULTLIB /stub:C:\WINDDK\7600.16385.0\lib\win7\stub512.com /ALIGN:4096"
-				AdditionalDependencies="wdm.lib ndis.lib ntoskrnl.lib fwpkclnt.lib "$(SolutionDir)tmp\VersionResources\$(ProjectName)_$(PlatformName).res""
+				AdditionalDependencies="bufferoverflowK.lib wdm.lib ndis.lib ntoskrnl.lib fwpkclnt.lib "$(SolutionDir)tmp\VersionResources\$(ProjectName)_$(PlatformName).res""
 				OutputFile="$(OutDir)\Neo6_x86_unsigned.sys"
 				LinkIncremental="1"
 				AdditionalLibraryDirectories="C:\WINDDK\7600.16385.0\lib\win7\i386"
@@ -121,7 +121,7 @@
 			/>
 			<Tool
 				Name="VCPostBuildEventTool"
-				CommandLine="$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)Neo6_x86.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:0&#x0D;&#x0A;$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)Neo6_x86_win10.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:2"
+				CommandLine="$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)Neo6_x86.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:0&#x0D;&#x0A;$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)Neo6_x86_win10.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:2&#x0D;&#x0A;"
 			/>
 		</Configuration>
 		<Configuration
@@ -227,7 +227,7 @@
 			/>
 			<Tool
 				Name="VCPostBuildEventTool"
-				CommandLine="$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)Neo6_x64.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:0&#x0D;&#x0A;$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)Neo6_x64_win10.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:2"
+				CommandLine="$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)Neo6_x64.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:0&#x0D;&#x0A;$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)Neo6_x64_win10.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:2&#x0D;&#x0A;"
 			/>
 		</Configuration>
 	</Configurations>

src/SeLow/SeLow.c

@@ -620,47 +620,61 @@ NTSTATUS SlDeviceReadProc(DEVICE_OBJECT *device_object, IRP *irp)
 
 			if (dst != NULL)
 			{
-				MDL *mdl;
-
-				mdl = IoAllocateMdl(dst, irp_stack->Parameters.Read.Length, false, false, NULL);
-				if (mdl != NULL)
+				// Address check
+				bool check_ok = true;
+				__try
+				{
+					ProbeForWrite(irp->UserBuffer, sizeof(SL_ADAPTER_INFO_LIST), 1);
+				}
+				__except (EXCEPTION_EXECUTE_HANDLER)
 				{
-					MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+					check_ok = false;
 				}
 
-				SlZero(dst, sizeof(SL_ADAPTER_INFO_LIST));
+				if (check_ok)
+				{
+					MDL *mdl;
 
-				dst->Signature = SL_SIGNATURE;
-				dst->SeLowVersion = SL_VER;
-				dst->EnumCompleted = sl->IsEnumCompleted ? 8 : 1;
+					mdl = IoAllocateMdl(dst, irp_stack->Parameters.Read.Length, false, false, NULL);
+					if (mdl != NULL)
+					{
+						MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+					}
 
-				SlLockList(sl->AdapterList);
-				{
-					UINT i;
+					SlZero(dst, sizeof(SL_ADAPTER_INFO_LIST));
 
-					dst->NumAdapters = MIN(SL_LIST_NUM(sl->AdapterList), SL_MAX_ADAPTER_INFO_LIST_ENTRY);
+					dst->Signature = SL_SIGNATURE;
+					dst->SeLowVersion = SL_VER;
+					dst->EnumCompleted = sl->IsEnumCompleted ? 8 : 1;
 
-					for (i = 0;i < dst->NumAdapters;i++)
+					SlLockList(sl->AdapterList);
 					{
-						SL_ADAPTER *a = SL_LIST_DATA(sl->AdapterList, i);
-						SL_ADAPTER_INFO *d = &dst->Adapters[i];
-
-						d->MtuSize = a->MtuSize;
-						SlCopy(d->MacAddress, a->MacAddress, 6);
-						SlCopy(d->AdapterId, a->AdapterId, sizeof(a->AdapterId));
-						strcpy(d->FriendlyName, a->FriendlyName);
-						d->SupportsVLanHw = a->SupportVLan;
+						UINT i;
+
+						dst->NumAdapters = MIN(SL_LIST_NUM(sl->AdapterList), SL_MAX_ADAPTER_INFO_LIST_ENTRY);
+
+						for (i = 0;i < dst->NumAdapters;i++)
+						{
+							SL_ADAPTER *a = SL_LIST_DATA(sl->AdapterList, i);
+							SL_ADAPTER_INFO *d = &dst->Adapters[i];
+
+							d->MtuSize = a->MtuSize;
+							SlCopy(d->MacAddress, a->MacAddress, 6);
+							SlCopy(d->AdapterId, a->AdapterId, sizeof(a->AdapterId));
+							strcpy(d->FriendlyName, a->FriendlyName);
+							d->SupportsVLanHw = a->SupportVLan;
+						}
 					}
-				}
-				SlUnlockList(sl->AdapterList);
+					SlUnlockList(sl->AdapterList);
 
-				ret_size = sizeof(SL_ADAPTER_INFO);
-				ret = STATUS_SUCCESS;
+					ret_size = sizeof(SL_ADAPTER_INFO);
+					ret = STATUS_SUCCESS;
 
-				if (mdl != NULL)
-				{
-					MmUnlockPages(mdl);
-					IoFreeMdl(mdl);
+					if (mdl != NULL)
+					{
+						MmUnlockPages(mdl);
+						IoFreeMdl(mdl);
+					}
 				}
 			}
 		}
@@ -680,75 +694,89 @@ NTSTATUS SlDeviceReadProc(DEVICE_OBJECT *device_object, IRP *irp)
 			}
 			else
 			{
-				UINT num = 0;
-				bool left = true;
-				MDL *mdl;
-				
-				mdl = IoAllocateMdl(buf, SL_EXCHANGE_BUFFER_SIZE, false, false, NULL);
-				if (mdl != NULL)
+				// Address check
+				bool check_ok = true;
+				__try
 				{
-					MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+					ProbeForWrite(irp->UserBuffer, SL_EXCHANGE_BUFFER_SIZE, 1);
+				}
+				__except (EXCEPTION_EXECUTE_HANDLER)
+				{
+					check_ok = false;
 				}
 
-				// Lock the receive queue
-				SlLock(f->RecvLock);
+				if (check_ok)
 				{
-					while (true)
+					UINT num = 0;
+					bool left = true;
+					MDL *mdl;
+
+					mdl = IoAllocateMdl(buf, SL_EXCHANGE_BUFFER_SIZE, false, false, NULL);
+					if (mdl != NULL)
 					{
-						SL_PACKET *q;
-						if (num >= SL_MAX_PACKET_EXCHANGE)
+						MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+					}
+
+					// Lock the receive queue
+					SlLock(f->RecvLock);
+					{
+						while (true)
 						{
-							if (f->RecvPacketHead == NULL)
+							SL_PACKET *q;
+							if (num >= SL_MAX_PACKET_EXCHANGE)
 							{
-								left = false;
+								if (f->RecvPacketHead == NULL)
+								{
+									left = false;
+								}
+								break;
 							}
-							break;
-						}
-						q = f->RecvPacketHead;
-						if (q != NULL)
-						{
-							f->RecvPacketHead = f->RecvPacketHead->Next;
-							q->Next = NULL;
-							f->NumRecvPackets--;
+							q = f->RecvPacketHead;
+							if (q != NULL)
+							{
+								f->RecvPacketHead = f->RecvPacketHead->Next;
+								q->Next = NULL;
+								f->NumRecvPackets--;
 
-							if (f->RecvPacketHead == NULL)
+								if (f->RecvPacketHead == NULL)
+								{
+									f->RecvPacketTail = NULL;
+								}
+							}
+							else
 							{
-								f->RecvPacketTail = NULL;
+								left = false;
+								break;
 							}
+							SL_SIZE_OF_PACKET(buf, num) = q->Size;
+							SlCopy(SL_ADDR_OF_PACKET(buf, num), q->Data, q->Size);
+							num++;
+							SlFree(q);
 						}
-						else
-						{
-							left = false;
-							break;
-						}
-						SL_SIZE_OF_PACKET(buf, num) = q->Size;
-						SlCopy(SL_ADDR_OF_PACKET(buf, num), q->Data, q->Size);
-						num++;
-						SlFree(q);
 					}
-				}
-				SlUnlock(f->RecvLock);
+					SlUnlock(f->RecvLock);
 
-				if (mdl != NULL)
-				{
-					MmUnlockPages(mdl);
-					IoFreeMdl(mdl);
-				}
+					if (mdl != NULL)
+					{
+						MmUnlockPages(mdl);
+						IoFreeMdl(mdl);
+					}
 
-				SL_NUM_PACKET(buf) = num;
-				SL_LEFT_FLAG(buf) = left;
+					SL_NUM_PACKET(buf) = num;
+					SL_LEFT_FLAG(buf) = left;
 
-				if (left == false)
-				{
-					SlReset(f->Event);
-				}
-				else
-				{
-					SlSet(f->Event);
-				}
+					if (left == false)
+					{
+						SlReset(f->Event);
+					}
+					else
+					{
+						SlSet(f->Event);
+					}
 
-				ret = STATUS_SUCCESS;
-				ret_size = SL_EXCHANGE_BUFFER_SIZE;
+					ret = STATUS_SUCCESS;
+					ret_size = SL_EXCHANGE_BUFFER_SIZE;
+				}
 			}
 		}
 	}
@@ -783,264 +811,279 @@ NTSTATUS SlDeviceWriteProc(DEVICE_OBJECT *device_object, IRP *irp)
 			}
 			else
 			{
-				// Write the packet
-				MDL *mdl;
-				UINT num = SL_NUM_PACKET(buf);
-
-				mdl = IoAllocateMdl(buf, SL_EXCHANGE_BUFFER_SIZE, false, false, NULL);
-				if (mdl != NULL)
+				// Address check
+				bool check_ok = true;
+				__try
 				{
-					MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
+					ProbeForRead(irp->UserBuffer, SL_EXCHANGE_BUFFER_SIZE, 1);
+				}
+				__except (EXCEPTION_EXECUTE_HANDLER)
+				{
+					check_ok = false;
 				}
 
-				ret = true;
-				ret_size = SL_EXCHANGE_BUFFER_SIZE;
-
-				if (num >= 1 && num <= SL_MAX_PACKET_EXCHANGE)
+				if (check_ok)
 				{
-					UINT i, j;
-					NET_BUFFER_LIST *nbl_head = NULL;
-					NET_BUFFER_LIST *nbl_tail = NULL;
-					UINT num_packets = 0;
-					NDIS_HANDLE adapter_handle = NULL;
+					// Write the packet
+					MDL *mdl;
+					UINT num = SL_NUM_PACKET(buf);
 
-					SlLock(f->Adapter->Lock);
 
-					if (f->Adapter->NumPendingSendPackets <= SL_MAX_PACKET_QUEUED)
+					mdl = IoAllocateMdl(buf, SL_EXCHANGE_BUFFER_SIZE, false, false, NULL);
+					if (mdl != NULL)
 					{
-						// Admit to send only if the number of packets being transmitted does not exceed the specified limit
-						adapter_handle = f->Adapter->AdapterHandle;
+						MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
 					}
 
-					if (adapter_handle != NULL)
+					ret = true;
+					ret_size = SL_EXCHANGE_BUFFER_SIZE;
+
+					if (num >= 1 && num <= SL_MAX_PACKET_EXCHANGE)
 					{
-						// Lock the file list which opens the same adapter
-						SlLockList(dev->FileList);
-						for (j = 0;j < SL_LIST_NUM(dev->FileList);j++)
-						{
-							SL_FILE *other = SL_LIST_DATA(dev->FileList, j);
+						UINT i, j;
+						NET_BUFFER_LIST *nbl_head = NULL;
+						NET_BUFFER_LIST *nbl_tail = NULL;
+						UINT num_packets = 0;
+						NDIS_HANDLE adapter_handle = NULL;
 
-							if (other != f)
-							{
-								// Lock the receive queue of other file lists
-								SlLock(other->RecvLock);
+						SlLock(f->Adapter->Lock);
 
-								other->SetEventFlag = false;
-							}
+						if (f->Adapter->NumPendingSendPackets <= SL_MAX_PACKET_QUEUED)
+						{
+							// Admit to send only if the number of packets being transmitted does not exceed the specified limit
+							adapter_handle = f->Adapter->AdapterHandle;
 						}
 
-						for (i = 0;i < num;i++)
+						if (adapter_handle != NULL)
 						{
-							UINT packet_size = SL_SIZE_OF_PACKET(buf, i);
-							UCHAR *packet_buf;
-							NET_BUFFER_LIST *nbl = NULL;
-							bool ok = false;
-							bool is_vlan = false;
-							UINT vlan_id = 0;
-							UINT vlan_user_priority = 0, vlan_can_format_id = 0;
-
-							if (packet_size > SL_MAX_PACKET_SIZE)
-							{
-								packet_size = SL_MAX_PACKET_SIZE;
-							}
-							else if (packet_size < SL_PACKET_HEADER_SIZE)
-							{
-								packet_size = SL_PACKET_HEADER_SIZE;
-							}
-
-							packet_buf = (UCHAR *)SL_ADDR_OF_PACKET(buf, i);
-
+							// Lock the file list which opens the same adapter
+							SlLockList(dev->FileList);
 							for (j = 0;j < SL_LIST_NUM(dev->FileList);j++)
 							{
 								SL_FILE *other = SL_LIST_DATA(dev->FileList, j);
 
 								if (other != f)
 								{
-									// Insert into the receive queue of the other file lists
-									if (other->NumRecvPackets < SL_MAX_PACKET_QUEUED)
-									{
-										SL_PACKET *q = SlMalloc(sizeof(SL_PACKET));
+									// Lock the receive queue of other file lists
+									SlLock(other->RecvLock);
 
-										SlCopy(q->Data, packet_buf, packet_size);
-										q->Size = packet_size;
-										q->Next = NULL;
-
-										if (other->RecvPacketHead == NULL)
-										{
-											other->RecvPacketHead = q;
-										}
-										else
-										{
-											other->RecvPacketTail->Next = q;
-										}
-
-										other->RecvPacketTail = q;
-
-										other->NumRecvPackets++;
-
-										other->SetEventFlag = true;
-									}
+									other->SetEventFlag = false;
 								}
 							}
 
-							// Allocate a new NET_BUFFER_LIST
-							if (f->NetBufferListPool != NULL)
+							for (i = 0;i < num;i++)
 							{
-								nbl = NdisAllocateNetBufferList(f->NetBufferListPool, 16, 0);
-
-								if (nbl != NULL)
+								UINT packet_size = SL_SIZE_OF_PACKET(buf, i);
+								UCHAR *packet_buf;
+								NET_BUFFER_LIST *nbl = NULL;
+								bool ok = false;
+								bool is_vlan = false;
+								UINT vlan_id = 0;
+								UINT vlan_user_priority = 0, vlan_can_format_id = 0;
+
+								if (packet_size > SL_MAX_PACKET_SIZE)
 								{
-									nbl->SourceHandle = adapter_handle;
+									packet_size = SL_MAX_PACKET_SIZE;
+								}
+								else if (packet_size < SL_PACKET_HEADER_SIZE)
+								{
+									packet_size = SL_PACKET_HEADER_SIZE;
 								}
-							}
-
-							if (nbl != NULL)
-							{
-								// Get the NET_BUFFER from the NET_BUFFER_LIST
-								NET_BUFFER *nb = NET_BUFFER_LIST_FIRST_NB(nbl);
 
-								NET_BUFFER_LIST_NEXT_NBL(nbl) = NULL;
+								packet_buf = (UCHAR *)SL_ADDR_OF_PACKET(buf, i);
 
-								// Determine if the packet is IEEE802.1Q tagged packet
-								if (dev->Adapter->SupportVLan && packet_size >= 18)
+								for (j = 0;j < SL_LIST_NUM(dev->FileList);j++)
 								{
-									if (packet_buf[12] == 0x81 && packet_buf[13] == 0x00)
+									SL_FILE *other = SL_LIST_DATA(dev->FileList, j);
+
+									if (other != f)
 									{
-										USHORT tag_us = 0;
+										// Insert into the receive queue of the other file lists
+										if (other->NumRecvPackets < SL_MAX_PACKET_QUEUED)
+										{
+											SL_PACKET *q = SlMalloc(sizeof(SL_PACKET));
 
-										((UCHAR *)(&tag_us))[0] = packet_buf[15];
-										((UCHAR *)(&tag_us))[1] = packet_buf[14];
+											SlCopy(q->Data, packet_buf, packet_size);
+											q->Size = packet_size;
+											q->Next = NULL;
 
-										vlan_id = tag_us & 0x0FFF;
-										vlan_user_priority = (tag_us >> 13) & 0x07;
-										vlan_can_format_id = (tag_us >> 12) & 0x01;
+											if (other->RecvPacketHead == NULL)
+											{
+												other->RecvPacketHead = q;
+											}
+											else
+											{
+												other->RecvPacketTail->Next = q;
+											}
 
-										if (vlan_id != 0)
-										{
-											is_vlan = true;
+											other->RecvPacketTail = q;
+
+											other->NumRecvPackets++;
+
+											other->SetEventFlag = true;
 										}
 									}
 								}
 
-								if (is_vlan)
+								// Allocate a new NET_BUFFER_LIST
+								if (f->NetBufferListPool != NULL)
 								{
-									packet_size -= 4;
+									nbl = NdisAllocateNetBufferList(f->NetBufferListPool, 16, 0);
+
+									if (nbl != NULL)
+									{
+										nbl->SourceHandle = adapter_handle;
+									}
 								}
 
-								if (nb != NULL && OK(NdisRetreatNetBufferDataStart(nb, packet_size, 0, NULL)))
+								if (nbl != NULL)
 								{
-									// Buffer copy
-									UCHAR *dst = NdisGetDataBuffer(nb, packet_size, NULL, 1, 0);
+									// Get the NET_BUFFER from the NET_BUFFER_LIST
+									NET_BUFFER *nb = NET_BUFFER_LIST_FIRST_NB(nbl);
 
-									if (dst != NULL)
+									NET_BUFFER_LIST_NEXT_NBL(nbl) = NULL;
+
+									// Determine if the packet is IEEE802.1Q tagged packet
+									if (dev->Adapter->SupportVLan && packet_size >= 18)
 									{
-										if (is_vlan == false)
-										{
-											SlCopy(dst, packet_buf, packet_size);
-										}
-										else
+										if (packet_buf[12] == 0x81 && packet_buf[13] == 0x00)
 										{
-											SlCopy(dst, packet_buf, 12);
-											SlCopy(dst + 12, packet_buf + 16, packet_size + 4 - 16);
+											USHORT tag_us = 0;
+
+											((UCHAR *)(&tag_us))[0] = packet_buf[15];
+											((UCHAR *)(&tag_us))[1] = packet_buf[14];
+
+											vlan_id = tag_us & 0x0FFF;
+											vlan_user_priority = (tag_us >> 13) & 0x07;
+											vlan_can_format_id = (tag_us >> 12) & 0x01;
+
+											if (vlan_id != 0)
+											{
+												is_vlan = true;
+											}
 										}
+									}
 
-										ok = true;
+									if (is_vlan)
+									{
+										packet_size -= 4;
 									}
-									else
+
+									if (nb != NULL && OK(NdisRetreatNetBufferDataStart(nb, packet_size, 0, NULL)))
 									{
-										NdisAdvanceNetBufferDataStart(nb, packet_size, false, NULL);
+										// Buffer copy
+										UCHAR *dst = NdisGetDataBuffer(nb, packet_size, NULL, 1, 0);
+
+										if (dst != NULL)
+										{
+											if (is_vlan == false)
+											{
+												SlCopy(dst, packet_buf, packet_size);
+											}
+											else
+											{
+												SlCopy(dst, packet_buf, 12);
+												SlCopy(dst + 12, packet_buf + 16, packet_size + 4 - 16);
+											}
+
+											ok = true;
+										}
+										else
+										{
+											NdisAdvanceNetBufferDataStart(nb, packet_size, false, NULL);
+										}
 									}
 								}
-							}
 
-							if (ok == false)
-							{
-								if (nbl != NULL)
+								if (ok == false)
 								{
-									NdisFreeNetBufferList(nbl);
+									if (nbl != NULL)
+									{
+										NdisFreeNetBufferList(nbl);
+									}
 								}
-							}
-							else
-							{
-								if (nbl_head == NULL)
+								else
 								{
-									nbl_head = nbl;
-								}
+									if (nbl_head == NULL)
+									{
+										nbl_head = nbl;
+									}
 
-								if (nbl_tail != NULL)
-								{
-									NET_BUFFER_LIST_NEXT_NBL(nbl_tail) = nbl;
-								}
+									if (nbl_tail != NULL)
+									{
+										NET_BUFFER_LIST_NEXT_NBL(nbl_tail) = nbl;
+									}
 
-								nbl_tail = nbl;
+									nbl_tail = nbl;
 
-								((void **)NET_BUFFER_LIST_CONTEXT_DATA_START(nbl))[0] = f;
+									((void **)NET_BUFFER_LIST_CONTEXT_DATA_START(nbl))[0] = f;
 
-								if (is_vlan == false)
-								{
-									NET_BUFFER_LIST_INFO(nbl, Ieee8021QNetBufferListInfo) = NULL;
-								}
-								else
-								{
-									NDIS_NET_BUFFER_LIST_8021Q_INFO qinfo;
+									if (is_vlan == false)
+									{
+										NET_BUFFER_LIST_INFO(nbl, Ieee8021QNetBufferListInfo) = NULL;
+									}
+									else
+									{
+										NDIS_NET_BUFFER_LIST_8021Q_INFO qinfo;
 
-									qinfo.Value = &(((void **)NET_BUFFER_LIST_CONTEXT_DATA_START(nbl))[1]);
-									SlZero(qinfo.Value, sizeof(UINT32) * 12);
+										qinfo.Value = &(((void **)NET_BUFFER_LIST_CONTEXT_DATA_START(nbl))[1]);
+										SlZero(qinfo.Value, sizeof(UINT32) * 12);
 
-									qinfo.TagHeader.VlanId = vlan_id;
-									qinfo.TagHeader.UserPriority = vlan_user_priority;
-									qinfo.TagHeader.CanonicalFormatId = vlan_can_format_id;
+										qinfo.TagHeader.VlanId = vlan_id;
+										qinfo.TagHeader.UserPriority = vlan_user_priority;
+										qinfo.TagHeader.CanonicalFormatId = vlan_can_format_id;
 
-									NET_BUFFER_LIST_INFO(nbl, Ieee8021QNetBufferListInfo) = qinfo.Value;
-								}
+										NET_BUFFER_LIST_INFO(nbl, Ieee8021QNetBufferListInfo) = qinfo.Value;
+									}
 
-								num_packets++;
+									num_packets++;
+								}
 							}
-						}
 
-						for (j = 0;j < SL_LIST_NUM(dev->FileList);j++)
-						{
-							SL_FILE *other = SL_LIST_DATA(dev->FileList, j);
-
-							if (other != f)
+							for (j = 0;j < SL_LIST_NUM(dev->FileList);j++)
 							{
-								// Release the receive queue of other file lists
-								SlUnlock(other->RecvLock);
+								SL_FILE *other = SL_LIST_DATA(dev->FileList, j);
 
-								// Set an event
-								if (other->SetEventFlag)
+								if (other != f)
 								{
-									SlSet(other->Event);
+									// Release the receive queue of other file lists
+									SlUnlock(other->RecvLock);
+
+									// Set an event
+									if (other->SetEventFlag)
+									{
+										SlSet(other->Event);
+									}
 								}
 							}
-						}
-						SlUnlockList(dev->FileList);
+							SlUnlockList(dev->FileList);
 
-						if (nbl_head != NULL)
-						{
-							InterlockedExchangeAdd(&f->NumSendingPacketets, num_packets);
-							InterlockedExchangeAdd(&f->Adapter->NumPendingSendPackets, num_packets);
+							if (nbl_head != NULL)
+							{
+								InterlockedExchangeAdd(&f->NumSendingPacketets, num_packets);
+								InterlockedExchangeAdd(&f->Adapter->NumPendingSendPackets, num_packets);
 
-							SlUnlock(f->Adapter->Lock);
+								SlUnlock(f->Adapter->Lock);
 
-							NdisSendNetBufferLists(adapter_handle, nbl_head, 0, 0);
+								NdisSendNetBufferLists(adapter_handle, nbl_head, 0, 0);
+							}
+							else
+							{
+								SlUnlock(f->Adapter->Lock);
+							}
 						}
 						else
 						{
 							SlUnlock(f->Adapter->Lock);
 						}
 					}
-					else
+
+					if (mdl != NULL)
 					{
-						SlUnlock(f->Adapter->Lock);
+						MmUnlockPages(mdl);
+						IoFreeMdl(mdl);
 					}
 				}
-
-				if (mdl != NULL)
-				{
-					MmUnlockPages(mdl);
-					IoFreeMdl(mdl);
-				}
 			}
 		}
 	}
@@ -1068,17 +1111,31 @@ NTSTATUS SlDeviceIoControlProc(DEVICE_OBJECT *device_object, IRP *irp)
 		switch (irp_stack->Parameters.DeviceIoControl.IoControlCode)
 		{
 		case SL_IOCTL_GET_EVENT_NAME:
-			if (irp_stack->Parameters.DeviceIoControl.InputBufferLength >= sizeof(SL_IOCTL_EVENT_NAME))
+			if (irp_stack->Parameters.DeviceIoControl.OutputBufferLength >= sizeof(SL_IOCTL_EVENT_NAME))
 			{
 				SL_IOCTL_EVENT_NAME *t = irp->UserBuffer;
 
 				if (t != NULL)
 				{
-					strcpy(t->EventNameWin32, f->EventNameWin32);
+					// Address check
+					bool check_ok = true;
+					__try
+					{
+						ProbeForWrite(t, sizeof(SL_IOCTL_EVENT_NAME), 1);
+					}
+					__except (EXCEPTION_EXECUTE_HANDLER)
+					{
+						check_ok = false;
+					}
 
-					ret_size = sizeof(SL_IOCTL_EVENT_NAME);
+					if (check_ok)
+					{
+						strcpy(t->EventNameWin32, f->EventNameWin32);
 
-					ret = STATUS_SUCCESS;
+						ret_size = sizeof(SL_IOCTL_EVENT_NAME);
+
+						ret = STATUS_SUCCESS;
+					}
 				}
 			}
 			break;

src/SeLow/SeLowCommon.h

@@ -115,7 +115,7 @@
 // Change this number every time functions are added or modified on the driver.
 // As long as this number does not change, installation of SeLow during the update
 // installation of the VPN Server / VPN Client / VPN Bridge is skipped.
-#define	SL_VER						46
+#define	SL_VER						48
 
 // Constants
 #define	SL_MAX_PACKET_SIZE			1600

src/Wfp/Wfp.c

@@ -172,22 +172,49 @@ NTSTATUS DriverDispatch(DEVICE_OBJECT *device_object, IRP *irp)
 	case IRP_MJ_WRITE:	// Write
 		if ((stack->Parameters.Write.Length % sizeof(WFP_LOCAL_IP)) == 0)
 		{
-			UINT size = MIN(WFP_MAX_LOCAL_IP_COUNT * sizeof(WFP_LOCAL_IP), stack->Parameters.Write.Length);
-			UCHAR *copied_buf = Malloc(size);
-			UCHAR *old_buf;
-			Copy(copied_buf, buf, size);
-
-			SpinLock(wfp->LocalIPListLock);
+			// Address check
+			bool check_ok = true;
+			__try
+			{
+				ProbeForRead(buf, stack->Parameters.Write.Length, 1);
+			}
+			__except (EXCEPTION_EXECUTE_HANDLER)
 			{
-				old_buf = wfp->LocalIPListData;
-				wfp->LocalIPListData = copied_buf;
-				wfp->LocalIPListSize = size;
+				check_ok = false;
 			}
-			SpinUnlock(wfp->LocalIPListLock);
 
-			if (old_buf != NULL)
+			if (check_ok)
 			{
-				Free(old_buf);
+				MDL *mdl = IoAllocateMdl(buf, stack->Parameters.Write.Length, false, false, NULL);
+				UINT size = MIN(WFP_MAX_LOCAL_IP_COUNT * sizeof(WFP_LOCAL_IP), stack->Parameters.Write.Length);
+				UCHAR *copied_buf = Malloc(size);
+				UCHAR *old_buf;
+
+				if (mdl != NULL)
+				{
+					MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
+				}
+
+				Copy(copied_buf, buf, size);
+
+				SpinLock(wfp->LocalIPListLock);
+				{
+					old_buf = wfp->LocalIPListData;
+					wfp->LocalIPListData = copied_buf;
+					wfp->LocalIPListSize = size;
+				}
+				SpinUnlock(wfp->LocalIPListLock);
+
+				if (old_buf != NULL)
+				{
+					Free(old_buf);
+				}
+
+				if (mdl != NULL)
+				{
+					MmUnlockPages(mdl);
+					IoFreeMdl(mdl);
+				}
 			}
 		}
 		irp->IoStatus.Information = stack->Parameters.Write.Length;

src/Wfp/Wfp.vcproj

@@ -79,7 +79,7 @@
 				Name="VCLinkerTool"
 				IgnoreImportLibrary="true"
 				AdditionalOptions="/driver /subsystem:native,6.00 /FULLBUILD /align:0x80 /osversion:6.00 /STACK:0x40000,0x1000 /MERGE:_PAGE=PAGE /MERGE:_TEXT=.text /NODEFAULTLIB /stub:C:\WINDDK\7600.16385.0\lib\wlh\stub512.com /ALIGN:4096"
-				AdditionalDependencies="wdm.lib ndis.lib ntoskrnl.lib fwpkclnt.lib "$(SolutionDir)tmp\VersionResources\$(ProjectName)_$(PlatformName).res""
+				AdditionalDependencies="bufferoverflowK.lib wdm.lib ndis.lib wdmsec.lib ntoskrnl.lib fwpkclnt.lib "$(SolutionDir)tmp\VersionResources\$(ProjectName)_$(PlatformName).res""
 				OutputFile="$(OutDir)\pxwfp_x86_unsigned.sys"
 				LinkIncremental="1"
 				AdditionalLibraryDirectories="C:\WINDDK\7600.16385.0\lib\wlh\i386"
@@ -121,7 +121,7 @@
 			/>
 			<Tool
 				Name="VCPostBuildEventTool"
-				CommandLine="$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)pxwfp_x86.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:0&#x0D;&#x0A;$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)pxwfp_x86_win10.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:2"
+				CommandLine="$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)pxwfp_x86.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:0&#x0D;&#x0A;$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)pxwfp_x86_win10.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:2&#x0D;&#x0A;"
 			/>
 		</Configuration>
 		<Configuration
@@ -183,7 +183,7 @@
 				Name="VCLinkerTool"
 				IgnoreImportLibrary="true"
 				AdditionalOptions="/driver /subsystem:native /FULLBUILD /align:0x80 /osversion:6.00 /STACK:0x40000,0x1000 /MERGE:_PAGE=PAGE /MERGE:_TEXT=.text /NODEFAULTLIB /stub:C:\WINDDK\7600.16385.0\lib\wlh\stub512.com /ALIGN:4096"
-				AdditionalDependencies="wdm.lib ndis.lib wdmsec.lib ntoskrnl.lib fwpkclnt.lib &quot;$(SolutionDir)tmp\VersionResources\$(ProjectName)_$(PlatformName).res&quot;"
+				AdditionalDependencies="bufferoverflowK.lib wdm.lib ndis.lib wdmsec.lib ntoskrnl.lib fwpkclnt.lib &quot;$(SolutionDir)tmp\VersionResources\$(ProjectName)_$(PlatformName).res&quot;"
 				OutputFile="$(OutDir)\pxwfp_x64_unsigned.sys"
 				LinkIncremental="1"
 				AdditionalLibraryDirectories="C:\WINDDK\7600.16385.0\lib\wlh\amd64"
@@ -225,7 +225,7 @@
 			/>
 			<Tool
 				Name="VCPostBuildEventTool"
-				CommandLine="$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)pxwfp_x64.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:0&#x0D;&#x0A;$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)pxwfp_x64_win10.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:2"
+				CommandLine="$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)pxwfp_x64.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:0&#x0D;&#x0A;$(SolutionDir)bin\BuildUtil.exe /CMD:SignCode &quot;$(TargetPath)&quot; /DEST:&quot;$(TargetDir)pxwfp_x64_win10.sys&quot; /COMMENT:&quot;VPN Software&quot; /KERNEL:yes /CERTID:0 /SHAMODE:2&#x0D;&#x0A;"
 			/>
 		</Configuration>
 	</Configurations>

src/bin/hamcore/DriverPackages/Neo/x64/Neo_x64.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ;
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 ;CatalogFile.NT				= $CATALOG_FILENAME$
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193640.387
+; Auto Generated 20151018_201626.032
 

src/bin/hamcore/DriverPackages/Neo/x86/Neo_x86.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 ;CatalogFile.NT				= $CATALOG_FILENAME$
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193640.383
+; Auto Generated 20151018_201626.029
 

src/bin/hamcore/DriverPackages/Neo6/x64/Neo6_x64.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 ;CatalogFile.NT				= $CATALOG_FILENAME$
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193640.393
+; Auto Generated 20151018_201626.038
 

src/bin/hamcore/DriverPackages/Neo6/x86/Neo6_x86.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 ;CatalogFile.NT				= $CATALOG_FILENAME$
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193640.390
+; Auto Generated 20151018_201626.035
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193658.928
+; Auto Generated 20151018_201643.395
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN10.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN10.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193659.933
+; Auto Generated 20151018_201644.250
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN100.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN100.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193709.982
+; Auto Generated 20151018_201652.798
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN101.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN101.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193710.086
+; Auto Generated 20151018_201652.893
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN102.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN102.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193710.189
+; Auto Generated 20151018_201652.987
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN103.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN103.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193710.292
+; Auto Generated 20151018_201653.082
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN104.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN104.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193710.395
+; Auto Generated 20151018_201653.176
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN105.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN105.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193710.534
+; Auto Generated 20151018_201653.270
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN106.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN106.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193710.656
+; Auto Generated 20151018_201653.364
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN107.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN107.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193710.977
+; Auto Generated 20151018_201653.458
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN108.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN108.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193711.080
+; Auto Generated 20151018_201653.553
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN109.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN109.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193711.184
+; Auto Generated 20151018_201653.657
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN11.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN11.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193700.037
+; Auto Generated 20151018_201644.345
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN110.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN110.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193711.290
+; Auto Generated 20151018_201653.752
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN111.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN111.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193711.394
+; Auto Generated 20151018_201653.846
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN112.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN112.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193711.497
+; Auto Generated 20151018_201653.940
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN113.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN113.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193711.620
+; Auto Generated 20151018_201654.035
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN114.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN114.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193711.742
+; Auto Generated 20151018_201654.131
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN115.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN115.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193711.900
+; Auto Generated 20151018_201654.225
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN116.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN116.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193712.004
+; Auto Generated 20151018_201654.319
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN117.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN117.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193712.107
+; Auto Generated 20151018_201654.414
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN118.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN118.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193712.209
+; Auto Generated 20151018_201654.509
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN119.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN119.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193712.314
+; Auto Generated 20151018_201654.603
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN12.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN12.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193700.140
+; Auto Generated 20151018_201644.439
 

src/bin/hamcore/DriverPackages/Neo6_Win10/x64/Neo6_x64_VPN120.inf

@@ -3,14 +3,14 @@
 ; Copyright (c) SoftEther Corporation. All Rights Reserved.
 ; http://www.softether.co.jp/
 ; 
-; BUILD 9575
+; BUILD 9594
 
 [Version]
 Signature					= "$Windows NT$"
 Class						= Net
 ClassGUID					= {4D36E972-E325-11CE-BFC1-08002BE10318}
 Provider					= %CompanyName%
-DriverVer					= 09/09/2015, 4.19.0.9575
+DriverVer					= 10/17/2015, 4.19.0.9594
 CatalogFile.NT				= Neo6_x64_VPN120.cat
 
 [Manufacturer]
@@ -110,5 +110,5 @@ On							= "On"
 Off							= "Off"
 
 
-; Auto Generated 20150910_193712.418
+; Auto Generated 20151018_201654.697