use utf8 instead of utf16le for locale

Italian language update

.github/workflows/scorecard.yml

@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '32 18 * * 3'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+          file_mode: git
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -37,3 +37,5 @@ desktop.ini
 *.obj
 *.res
 *.tlog
+
+*PVS-Studio*

CHANGELOG.md

@@ -1,3 +1,94 @@
+v3.9.1 Beta (22 July 2026)
+- added network statistics to watch info about speed (issue #2100) [thx @Tarkiin]
+- added option to exclude inbound blocked packets (#2111)
+- fixed repeatedly notifications (issue #2107)
+- updated igmp rule (issue #2111)
+
+v3.9 Beta (21 July 2026)
+- changed messages with displays unused apps and timers (it displays full paths)
+- now creating rules from network/log listviews do not use local IP addressess
+- mark toolbar log icons as disabled when log subsription failed
+- changed option resolve network address to enabled by default
+- now profile saved paths with environment variables
+- increased rules limit to 1024 symbols (issue #809)
+- improved loopback filters
+- improved memory usage
+- improved dark theme
+- improved security
+- fixed saving profile when it have read-only attribute (issue #2048) [thx @jekesx]
+- fixed log subscription sometimes returns access denied (issue #1710)
+- fixed crash when loading notification dialog (issue #2070)
+- fixed searchbox dissapear (issue #1790)
+- fixed possible memory leaks
+- updated port services lists
+
+v3.8.7 (8 August 2025)
+- fixed not logical crash (issue #2012)
+- fixed context menu performance
+- updated locale (issue #1984)
+- updated project sdk
+- cosmetic fixes
+
+v3.8.6.1 (21 May 2025)
+- fixed "open containing folder" error (issue #1977)
+- fixed crash at startup (issue #1979)
+- fixed crash dump (issue #1958)
+
+v3.8.6 (1 April 2025)
+- fixed check for update, does not bring up popup (issue #1923)
+- fixed memory heap error (issue #1945)
+- fixed possible crash
+- improved dark theme support
+
+v3.8.5 (27 November 2024)
+- fixed adding apps with drive letters instead of specific apps (issue #1887)
+- fixed creating rules for inaccessible paths (issue #1891)
+- fixed opening log with spaces path (issue #1912)
+- fixed windows 7 loopback rules
+- cosmetic fixes
+
+v3.8.4 (11 September 2024)
+- added listview empty markup
+- fixed tray icon middle click not worked when log ui is disabled
+- fixed notification displays invalid signature (issue #1871)
+- fixed does not show up tray icon (issue #1844)
+- fixed crash when cleanup timers (issue #1860)
+- fixed possible memory leak
+- updated project sdk
+- updated rule hint
+- cosmetic fixes
+
+v3.8.3 (8 August 2024)
+- added remember last position of notification window (issue #1659)
+- added watch services & uwp apps for install/uninstall
+- added displays long time for apps
+- improved windows 7 compatibility
+- improved arm64 compatibility
+- improved dark theme support
+- fixed show log button does not work as expected (issue #1757, again!)
+- fixed apps sometimes delete themselves (issue #1794, not fixed)
+- fixed duplicate process at startup (issue #1769)
+- fixed do not save hash when it is not enabled
+- fixed row colors for dark mode (issue #1767)
+- fixed log listview sorting by date
+- fixed displaying timer tooltip
+- updated project sdk
+
+v3.8.2 (9 May 2024)
+- revert back windows 7 & windows 8 support
+- improved dark theme support
+- improved log subscription
+- fixed show log button does not work as expected (issue #1757)
+- fixed search visibility
+
+v3.8.1 (27 April 2024)
+- fixed lacks search context (issue #1760)
+- fixed incorrect log ui listview item counting
+- updated confirm message for timers cleanup
+- updated confirm message for unused cleanup
+- updated cppwinrt package
+- updated project sdk
+
 v3.8 (1 April 2024)
 - added mitigations (win10+) (issue #611)
 - added dark theme support (issue #248)

README.md

@@ -1,345 +1,331 @@
-<h1 align="center">simplewall</h1>
-
-<p align="center">
-	<a href="https://github.com/henrypp/simplewall/releases"><img src="https://img.shields.io/github/v/release/henrypp/simplewall?style=flat-square&include_prereleases&label=version" /></a>
-	<a href="https://github.com/henrypp/simplewall/releases"><img src="https://img.shields.io/github/downloads/henrypp/simplewall/total.svg?style=flat-square" /></a>
-	<a href="https://github.com/henrypp/simplewall/issues"><img src="https://img.shields.io/github/issues-raw/henrypp/simplewall.svg?style=flat-square&label=issues" /></a>
-	<a href="https://github.com/henrypp/simplewall/graphs/contributors"><img src="https://img.shields.io/github/contributors/henrypp/simplewall?style=flat-square" /></a>
-	<a href="https://github.com/henrypp/simplewall/blob/master/LICENSE"><img src="https://img.shields.io/github/license/henrypp/simplewall?style=flat-square" /></a>
-</p>
-
-<p align="center">
-	<i>Definitely for advanced users.</i>
-</p>
-
--------
-
-<p align="center">
-	<img src="/images/simplewall.png?cache" />
-</p>
-
-### Description:
-Simple tool to configure [Windows Filtering Platform (WFP)](https://docs.microsoft.com/en-us/windows/win32/fwp/windows-filtering-platform-start-page) which can configure network activity on your computer.
-
-The lightweight application is less than a megabyte, and it is compatible with Windows 8.1 and higher operating systems.
-You can download either the installer or portable version. For correct working you are require administrator rights.
-
-### System requirements:
-- Windows 8.1 and above operating system.
-- [Visual C++ 2022 Redistributable package](https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170)
-
-### Donate:
-- [Bitcoin](https://www.blockchain.com/btc/address/1LrRTXPsvHcQWCNZotA9RcwjsGcRghG96c) (BTC)
-- [Ethereum](https://www.blockchain.com/explorer/addresses/eth/0xe2C84A62eb2a4EF154b19bec0c1c106734B95960) (ETC)
-- [Paypal](https://paypal.me/henrypp) (USD)
-- [Yandex Money](https://yoomoney.ru/to/4100115776040583) (RUB)
-
-### GPG Signature:
-Binaries have GPG signature `simplewall.exe.sig` in application folder.
-
-- Public key: [pubkey.asc](https://raw.githubusercontent.com/henrypp/builder/master/pubkey.asc) ([pgpkeys.eu](https://pgpkeys.eu/pks/lookup?op=index&fingerprint=on&search=0x5635B5FD))
-- Key ID: 0x5635B5FD
-- Fingerprint: D985 2361 1524 AB29 BE73 30AC 2881 20A7 5635 B5FD
-
-### Nota bene:
-Keep in mind, simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall. It works
-over Windows Filtering Platform (WFP) which is a set of internal API and system services that provide a platform for creating network filtering
-applications. Windows Filtering Platform is a development technology and not a firewall itself, but simplewall is the tool that uses this technology.
-
-### Features:
-- Simple interface without annoying pop ups
-- [Rules editor](https://github.com/henrypp/simplewall#rules-editor) (create your own rules)
-- [Internal blocklist](https://crazymax.dev/WindowsSpyBlocker/blocking-rules/simplewall/) (block Windows spy / telemetry)
-- Dropped packets information with notification and logging to a file feature (win7+)
-- Allowed packets information with logging to a file feature (win8+)
-- Windows Subsystem for Linux (WSL) support
-- Windows services support
-- Windows Store support
-- Free and open source
-- Localization support
-- IPv6 support
-
-```
-To activate portable mode, create "simplewall.ini" in application folder, or move it from "%APPDATA%\Henry++\simplewall".
-```
-
-### Reviews of idiots:
-[<img src="/images/idiot_n1.png" />](https://alternativeto.net/software/simplewall-firewall/about/)
-
-Look at them, he does not know about [.gitmodules](https://github.com/henrypp/simplewall/blob/master/.gitmodules) and how to use, lol.
-
-PS: Without idiots we are not to be fun, yeah!
-
-### Installation:
-When install rules, you can choose two modes:
-- Permanent rules - rules are working until you <a href="#uninstall">disable it manually</a>.
-- Temporary rules - rules are reset after the next reboot.
-
-### Uninstall:
-When you uninstall simplewall, all previously configured filters stay alive in system.
-To remove all filters created by simplewall, start simplewall and press "Disable filters" button.
-
-### Command line:
-
-~~~
--install - enable filtering.
--install -temp - enable filtering until next reboot.
--install -silent - enable filtering without prompt.
--uninstall - remove all installed filters.
-~~~
-
-### Rules editor:
-simplewall have two types of custom user rules rules:
-- **Global rules:** rule applied for all applications.
-- **Special rules:** rule applied only for specified applications.
-
-<img src="/images/simplewall_rules.png?cache" />
-
-_To set rule applications, open rule and then navigate to "Apps" tab._
-
-<details>
-<summary>Rule syntax format:</summary>
-
----
-- IP addresses `192.168.0.1; 192.168.0.1; [fc00::]`
-- IP addresses with port `192.168.0.1:80; 192.168.0.1:443; [fc00::]:443;`
-- IP ranges `192.168.0.1-192.168.0.255; 192.168.0.1-192.168.0.255;`
-- IP ranges (with port) `192.168.0.1-192.168.0.255:80; 192.168.0.1-192.168.0.255:443;` (v2.0.20+)
-- IP with prefix lengths (CIDR) `192.168.0.0/16; 192.168.0.0/24; fe80::/10`
-- Ports `21; 80; 443;`
-- Ports ranges `20-21; 49152-65534;`
-
-_To specify more than one ip, port and/or host, use semicolon._
----
-</details>
-
-<details>
-<summary>IPv4 CIDR blocks:</summary>
-
----
-|Address format|Mask|
-|---|---|
-|a.b.c.d/32|255.255.255.255|
-|a.b.c.d/31|255.255.255.254|
-|a.b.c.d/30|255.255.255.252|
-|a.b.c.d/29|255.255.255.248|
-|a.b.c.d/28|255.255.255.240|
-|a.b.c.d/27|255.255.255.224|
-|a.b.c.d/26|255.255.255.192|
-|a.b.c.d/25|255.255.255.128|
-|a.b.c.0/24|255.255.255.0|
-|a.b.c.0/23|255.255.254.0|
-|a.b.c.0/22|255.255.252.0|
-|a.b.c.0/21|255.255.248.0|
-|a.b.c.0/20|255.255.240.0|
-|a.b.c.0/19|255.255.224.0|
-|a.b.c.0/18|255.255.192.0|
-|a.b.c.0/17|255.255.128.0|
-|a.b.0.0/16|255.255.0.0|
-|a.b.0.0/15|255.254.0.0|
-|a.b.0.0/14|255.252.0.0|
-|a.b.0.0/13|255.248.0.0|
-|a.b.0.0/12|255.240.0.0|
-|a.b.0.0/11|255.224.0.0|
-|a.b.0.0/10|255.192.0.0|
-|a.b.0.0/9|255.128.0.0|
-|a.0.0.0/8|255.0.0.0|
-|a.0.0.0/7|254.0.0.0|
-|a.0.0.0/6|252.0.0.0|
-|a.0.0.0/5|248.0.0.0|
-|a.0.0.0/4|240.0.0.0|
-|a.0.0.0/3|224.0.0.0|
-|a.0.0.0/2|192.0.0.0|
-|a.0.0.0/1|128.0.0.0|
-|0.0.0.0/0|0.0.0.0|
----
-</details>
-
-<details>
-<summary>IPv6 CIDR blocks:</summary>
-
----
-`2001:0db8:0123:4567:89ab:cdef:1234:5678` <br>
-`|||| |||| |||| |||| |||| |||| |||| ||||` <br>
-`|||| |||| |||| |||| |||| |||| |||| |||128	Single end-points and loopback` <br>
-`|||| |||| |||| |||| |||| |||| |||| |||127	Point-to-point links (inter-router)` <br>
-`|||| |||| |||| |||| |||| |||| |||| ||124` <br>
-`|||| |||| |||| |||| |||| |||| |||| |120` <br>
-`|||| |||| |||| |||| |||| |||| |||| 116` <br>
-`|||| |||| |||| |||| |||| |||| |||112` <br>
-`|||| |||| |||| |||| |||| |||| ||108` <br>
-`|||| |||| |||| |||| |||| |||| |104` <br>
-`|||| |||| |||| |||| |||| |||| 100` <br>
-`|||| |||| |||| |||| |||| |||96` <br>
-`|||| |||| |||| |||| |||| ||92` <br>
-`|||| |||| |||| |||| |||| |88` <br>
-`|||| |||| |||| |||| |||| 84` <br>
-`|||| |||| |||| |||| |||80` <br>
-`|||| |||| |||| |||| ||76` <br>
-`|||| |||| |||| |||| |72` <br>
-`|||| |||| |||| |||| 68` <br>
-`|||| |||| |||| |||64	Single LAN (default prefix size for SLAAC)` <br>
-`|||| |||| |||| ||60	Some (very limited) 6rd deployments (/60 = 16 /64)` <br>
-`|||| |||| |||| |56	Minimal end sites assignment[12] (e.g. Home network) (/56 = 256 /64)` <br>
-`|||| |||| |||| 52	(/52 = 4096 /64)` <br>
-`|||| |||| |||48	Typical assignment for larger sites (/48 = 65536 /64) - Many ISP also do for residential` <br>
-`|||| |||| ||44` <br>
-`|||| |||| |40` <br>
-`|||| |||| 36	possible future Local Internet registry extra-small allocations` <br>
-`|||| |||32	Local Internet registry minimum allocations` <br>
-`|||| ||28	Local Internet registry medium allocations` <br>
-`|||| |24	Local Internet registry large allocations` <br>
-`|||| 20	Local Internet registry extra large allocations` <br>
-`|||16` <br>
-`||12	Regional Internet Registry allocations from IANA[15]` <br>
-`|8` <br>
-`4` <br>
----
-</details>
-
-### FAQ:
-#### Q: Are internet connections blocked when simplewall is not running?
-A: Yes. Installed filters are working even if simplewall is terminated.
-
-#### Q: What apps are blocked in default configuration?
-A: By default, simplewall blocks **all** applications. You do not need to create custom rules to block specific applications.
-
-#### Q: Is it safe to use simplewall with Windows Firewall?
-A:  Yes. You do not need to disable Windows Firewall. These two firewalls work independently.
-
-#### Q: How can i disable blocklist entirely?
-A:  Open `Settings` -> `Blocklist` and then click the radio buttons labeled `Disable`.
-
-#### Q: Where is blacklist mode?
-A: Blacklist was removed many days ago for uselessness. But if you need it, you can still configure it.
-
-<details>
-<summary>Solution: Configure blacklist mode in simplewall:</summary>
-
----
-1) Open `Settings` -> `Rules`
-2) Uncheck `Block outbound for all` and `Block inbound for all` options.
-3) Create user rule (green cross on toolbar) with block action, any direction, `Block connection` name and empty remote and local rule.
-4) You can assign this rule for apps whatever you want to block network access.
----
-</details>
-
-#### Q: Why does my network icon have an exclamation mark?
-A: When you are connected to a network, Windows checks for internet connectivity using Active Probing. This feature is named as NCSI (Network Connectivity Status Indicator). You can resolve this problem in one of the following ways:
-
-<details>
-<summary>Solution 1: Enable NCSI through internal system rule:</summary>
-
----
-1) Open `System rules` tab.
-2) Allow `NCSI` rule (enabled by default).
----
-</details>
-
-<details>
-<summary>Solution 2: Disable NCSI through system registry:</summary>
-
----
-Create `Disable NCSI.reg` and import it into registry.
-
-```reg
-Windows Registry Editor Version 5.00
-
-[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator]
-"NoActiveProbe"=dword:00000001
-"DisablePassivePolling"=dword:00000001
-```
----
-</details>
-
-<details>
-<summary>Solution 3: Disable NCSI through group policy:</summary>
-
----
-1) Launch the group policy editor (`gpedit.msc` ).
-2) Go to `Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings`.
-3) Double-click `Turn off Windows Network Connectivity Status Indicator active tests` and then select Enabled. Click Ok.
-4) Open the Command Prompt (Admin) and enter `gpupdate /force` to enforce the changes made to the Group Policies.
----
-</details>
-
-#### Q: How can I disable Windows Firewall?
-Start the command line _as an administrator_, and enter the commands below.
-
-<details>
-<summary>Disable Windows Firewall profiles:</summary>
-
----
-~~~bat
-netsh advfirewall set allprofiles state off
-~~~
----
-</details>
-
-<details>
-<summary>Enable Windows Firewall profiles:</summary>
-
----
-~~~bat
-netsh advfirewall set allprofiles state on
-~~~
----
-</details>
-
-#### Q: How can I view all filters information?
-Start the command line _as an administrator_, and enter the commands below.
-
-<details>
-<summary>Dump filters information saved into a `filters.xml` file:</summary>
-
----
-~~~bat
-cd /d %USERPROFILE%\Desktop
-
-netsh wfp show filters
-~~~
----
-</details>
-
-<details>
-<summary>Dump providers, callouts and layers information into a `wfpstate.xml` file:</summary>
-
----
-~~~bat
-cd /d %USERPROFILE%\Desktop
-
-netsh wfp show state
-~~~
----
-</details>
-
-Open it in any text editor and study.
-
-#### Q: How to fix Windows Update internet access?
-<details>
-<summary>Windows 10 and above:</summary>
-
----
-Open main window menu `Settings` -> `Rules` -> `Allow Windows Update`.
-<br />
-This is working by method described [here](https://github.com/henrypp/simplewall/issues/677).
-
----
-</details>
-
-<details>
-<summary>Windows 8.1:</summary>
-
----
-Open main window, Navigate into `System rules` tab and then enable `Windows Update service` rule.
-
----
-</details>
-
-#### Q: Other questions:
-- [Windows Security center integration (impossible)](https://stackoverflow.com/questions/3698285/how-can-i-tell-the-windows-security-center-that-im-an-antivirus/3698375#3698375)
----
-- Website: [github.com/henrypp](https://github.com/henrypp)
-- Support: sforce5@mail.ru
-
-(c) 2016-2024 Henry++
+<h1 align="center">simplewall</h1>
+
+<p align="center">
+	<a href="https://github.com/henrypp/simplewall/releases"><img src="https://img.shields.io/github/v/release/henrypp/simplewall?style=flat-square&include_prereleases&label=version" /></a>
+	<a href="https://github.com/henrypp/simplewall/releases"><img src="https://img.shields.io/github/downloads/henrypp/simplewall/total.svg?style=flat-square" /></a>
+	<a href="https://github.com/henrypp/simplewall/issues"><img src="https://img.shields.io/github/issues-raw/henrypp/simplewall.svg?style=flat-square&label=issues" /></a>
+	<a href="https://github.com/henrypp/simplewall/graphs/contributors"><img src="https://img.shields.io/github/contributors/henrypp/simplewall?style=flat-square" /></a>
+	<a href="https://github.com/henrypp/simplewall/blob/master/LICENSE"><img src="https://img.shields.io/github/license/henrypp/simplewall?style=flat-square" /></a>
+</p>
+
+<p align="center">
+	<i>Definitely for advanced users.</i>
+</p>
+
+-------
+
+<p align="center">
+	<img src="/images/simplewall.png?cache" />
+</p>
+
+### Description:
+Simple tool to configure [Windows Filtering Platform (WFP)](https://docs.microsoft.com/en-us/windows/win32/fwp/windows-filtering-platform-start-page) which can configure network activity on your computer.
+
+The lightweight application is less than a megabyte, and it is compatible with Windows 7 SP1 and higher operating systems.
+You can download either the installer or portable version. For correct working you are require administrator rights.
+
+### Nota bene:
+Keep in mind, simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall. It works
+over Windows Filtering Platform (WFP) which is a set of internal API and system services that provide a platform for creating network filtering
+applications. Windows Filtering Platform is a development technology and not a firewall itself, but simplewall is the tool that uses this technology.
+
+### Features:
+- Simple interface without annoying pop ups
+- [Rules editor](https://github.com/henrypp/simplewall#rules-editor) (create your own rules)
+- [Internal blocklist](https://crazymax.dev/WindowsSpyBlocker/blocking-rules/simplewall/) (block Windows spy / telemetry)
+- Dropped packets information with notification and logging to a file feature (win7+)
+- Allowed packets information with logging to a file feature (win8+)
+- Windows Subsystem for Linux (WSL) support
+- Windows Store support (win8+)
+- Windows services support
+- Free and open source
+- Localization support
+- IPv6 support
+
+```
+To activate portable mode, create "simplewall.ini" in application folder, or move it from "%APPDATA%\Henry++\simplewall".
+```
+
+### System requirements:
+- Windows 7, 8, 8.1, 10, 11 64-bit/ARM64
+- An SSE2-capable CPU
+- <s>KB2533623</s> [KB3063858](https://www.microsoft.com/en-us/download/details.aspx?id=47442) update for Windows 7 was required
+
+### Donate:
+- [Bitcoin](https://www.blockchain.com/btc/address/1LrRTXPsvHcQWCNZotA9RcwjsGcRghG96c) (BTC)
+- [Ethereum](https://www.blockchain.com/explorer/addresses/eth/0xe2C84A62eb2a4EF154b19bec0c1c106734B95960) (ETH)
+- [Yandex Money](https://yoomoney.ru/to/4100115776040583) (RUB)
+- [Paypal](https://paypal.me/henrypp) (USD)
+
+### GPG Signature:
+Binaries have GPG signature `simplewall.exe.sig` in application folder.
+
+- Public key: [pubkey.asc](https://raw.githubusercontent.com/henrypp/builder/master/pubkey.asc) ([pgpkeys.eu](https://pgpkeys.eu/pks/lookup?op=index&fingerprint=on&search=0x5635B5FD))
+- Key ID: 0x5635B5FD
+- Fingerprint: D985 2361 1524 AB29 BE73 30AC 2881 20A7 5635 B5FD
+
+### Reviews of idiots:
+[<img src="/images/idiot_n1.png" />](https://alternativeto.net/software/simplewall-firewall/about/)
+
+Look at them, he does not know about [.gitmodules](https://github.com/henrypp/simplewall/blob/master/.gitmodules) and how to use, lol.
+
+PS: Without idiots we are not to be fun, yeah!
+
+### Installation:
+When install rules, you can choose two modes:
+- Permanent rules - rules are working until you <a href="#uninstall">disable it manually</a>.
+- Temporary rules - rules are reset after the next reboot.
+
+### Uninstall:
+When you uninstall simplewall, all previously configured filters stay alive in system.
+To remove all filters created by simplewall, start simplewall and press "Disable filters" button.
+
+### Command line:
+
+~~~
+-install - enable filtering.
+-install -temp - enable filtering until next reboot.
+-install -silent - enable filtering without prompt.
+-uninstall - remove all installed filters.
+~~~
+
+### Rules editor:
+simplewall have two types of custom user rules rules:
+- **Global rules:** rule applied for all applications.
+- **Special rules:** rule applied only for specified applications.
+
+<img src="/images/simplewall_rules.png?cache2" />
+
+### Rule syntax format:
+
+To set rule applications, open rule and then navigate to "Apps" tab.
+
+<details>
+<summary>Rule syntax format:</summary>
+
+---
+- IP addresses `192.168.0.1; 192.168.0.1; [fc00::]`
+- IP addresses with port `192.168.0.1:80; 192.168.0.1:443; [fc00::]:443;`
+- IP ranges `192.168.0.1-192.168.0.255; 192.168.0.1-192.168.0.255;`
+- IP ranges (with port) `192.168.0.1-192.168.0.255:80; 192.168.0.1-192.168.0.255:443;` (v2.0.20+)
+- IP with prefix lengths (CIDR) `192.168.0.0/16; 192.168.0.0/24; fe80::/10`
+- Ports `21; 80; 443;`
+- Ports ranges `20-21; 49152-65534;`
+
+_To specify more than one ip, port and/or host, use semicolon._
+---
+</details>
+
+<details>
+<summary>IPv4 CIDR blocks:</summary>
+
+---
+| Address format | Mask |
+| -------- | ------- |
+| a.b.c.d/32 | 255.255.255.255 |
+| a.b.c.d/31 | 255.255.255.254 |
+| a.b.c.d/30 | 255.255.255.252 |
+| a.b.c.d/29 | 255.255.255.248 |
+| a.b.c.d/28 | 255.255.255.240 |
+| a.b.c.d/27 | 255.255.255.224 |
+| a.b.c.d/26 | 255.255.255.192 |
+| a.b.c.d/25 | 255.255.255.128 |
+| a.b.c.0/24 | 255.255.255.0|
+| a.b.c.0/23 | 255.255.254.0|
+| a.b.c.0/22 | 255.255.252.0|
+| a.b.c.0/21 | 255.255.248.0|
+| a.b.c.0/20 | 255.255.240.0|
+| a.b.c.0/19 | 255.255.224.0|
+| a.b.c.0/18 | 255.255.192.0|
+| a.b.c.0/17 | 255.255.128.0|
+| a.b.0.0/16 | 255.255.0.0|
+| a.b.0.0/15 | 255.254.0.0|
+| a.b.0.0/14 | 255.252.0.0|
+| a.b.0.0/13 | 255.248.0.0|
+| a.b.0.0/12 | 255.240.0.0|
+| a.b.0.0/11 | 255.224.0.0|
+| a.b.0.0/10 | 255.192.0.0|
+| a.b.0.0/9 | 255.128.0.0|
+| a.0.0.0/8 | 255.0.0.0|
+| a.0.0.0/7 | 254.0.0.0|
+| a.0.0.0/6 | 252.0.0.0|
+| a.0.0.0/5 | 248.0.0.0|
+| a.0.0.0/4 | 240.0.0.0|
+| a.0.0.0/3 | 224.0.0.0|
+| a.0.0.0/2 | 192.0.0.0|
+| a.0.0.0/1 | 128.0.0.0|
+| 0.0.0.0/0 | 0.0.0.0|
+---
+</details>
+
+<details>
+<summary>IPv6 CIDR blocks:</summary>
+
+---
+[IPv6 CIDR blocks](https://www.mediawiki.org/wiki/Help:Range_blocks/IPv6)
+---
+</details>
+
+### FAQ:
+#### Q: Are internet connections blocked when simplewall is not running?
+A: Yes. Installed filters are working even if simplewall is terminated.
+
+#### Q: What apps are blocked in default configuration?
+A: By default, simplewall blocks **all** applications. You do not need to create custom rules to block specific applications.
+
+#### Q: Is it safe to use simplewall with Windows Firewall?
+A: Yes. You do not need to disable Windows Firewall. These two firewalls work independently.
+
+#### Q: How can i disable blocklist entirely?
+A: Open `Settings` -> `Blocklist` and then click the radio buttons labeled `Disable`.
+
+#### Q: Where is blacklist mode?
+A: Blacklist was removed many days ago for uselessness. But if you need it, you can still configure it.
+
+<details>
+<summary>Solution: Configure blacklist mode in simplewall:</summary>
+
+---
+1) Open `Settings` -> `Rules`
+2) Uncheck `Block outbound for all` and `Block inbound for all` options.
+3) Create user rule (green cross on toolbar) with block action, any direction, `Block connection` name and empty remote and local rule.
+4) You can assign this rule for apps whatever you want to block network access.
+---
+</details>
+
+#### Q: Why does my network icon have an exclamation mark?
+A: When you are connected to a network, Windows checks for internet connectivity using Active Probing. This feature is named as NCSI (Network Connectivity Status Indicator). You can resolve this problem in one of the following ways:
+
+<details>
+<summary>Solution 1: Enable NCSI through internal system rule:</summary>
+
+---
+1) Open `System rules` tab.
+2) Allow `NCSI` rule (enabled by default).
+---
+</details>
+
+<details>
+<summary>Solution 2: Disable NCSI through system registry:</summary>
+
+---
+Create `Disable NCSI.reg` and import it into registry.
+
+```reg
+Windows Registry Editor Version 5.00
+
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator]
+"NoActiveProbe"=dword:00000001
+"DisablePassivePolling"=dword:00000001
+```
+---
+</details>
+
+<details>
+<summary>Solution 3: Disable NCSI through group policy:</summary>
+
+---
+1) Launch the group policy editor (`gpedit.msc` ).
+2) Go to `Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings`.
+3) Double-click `Turn off Windows Network Connectivity Status Indicator active tests` and then select Enabled. Click Ok.
+4) Open the Command Prompt (Admin) and enter `gpupdate /force` to enforce the changes made to the Group Policies.
+---
+</details>
+
+#### Q: How can I disable Windows Firewall?
+Start the command line _as an administrator_, and enter the commands below.
+
+<details>
+<summary>Disable Windows Firewall profiles:</summary>
+
+---
+~~~bat
+netsh advfirewall set allprofiles state off
+~~~
+---
+</details>
+
+<details>
+<summary>Enable Windows Firewall profiles:</summary>
+
+---
+~~~bat
+netsh advfirewall set allprofiles state on
+~~~
+---
+</details>
+
+#### Q: How can I view all filters information?
+Start the command line _as an administrator_, and enter the commands below.
+
+<details>
+<summary>Dump filters information saved into a `filters.xml` file:</summary>
+
+---
+~~~bat
+cd /d %USERPROFILE%\Desktop
+
+netsh wfp show filters
+~~~
+---
+</details>
+
+<details>
+<summary>Dump providers, callouts and layers information into a `wfpstate.xml` file:</summary>
+
+---
+~~~bat
+cd /d %USERPROFILE%\Desktop
+
+netsh wfp show state
+~~~
+---
+</details>
+
+Open it in any text editor and study.
+
+#### Q: How to fix Windows Update internet access?
+<details>
+<summary>Windows 10 and above:</summary>
+
+---
+Open main window menu `Settings` -> `Rules` -> `Allow Windows Update`.
+<br />
+This is working by method described [here](https://github.com/henrypp/simplewall/issues/677).
+
+---
+</details>
+
+<details>
+<summary>Windows 8.1:</summary>
+
+---
+Open main window, Navigate into `System rules` tab and then enable `Windows Update service` rule.
+
+---
+</details>
+
+#### Q: Other questions:
+- [Windows Security center integration (impossible)](https://stackoverflow.com/questions/3698285/how-can-i-tell-the-windows-security-center-that-im-an-antivirus/3698375#3698375)
+
+<details>
+<summary>Undocumented options:</summary>
+
+---
+~~~ini
+IsSaveAppsWithEnvironment=TRUE # 4.0+
+IsNetworkMonitorEnabled=TRUE
+IsInternalRulesDisabled=FALSE
+IsBackupProfile=TRUE
+BackupPeriod=BACKUP_HOURS_PERIOD
+BackupTimestamp=0
+IsOCSPEnabled=FALSE
+UseStealthMode=TRUE
+~~~
+</details>
+
+---
+- Website: [github.com/henrypp](https://github.com/henrypp)
+- Support: sforce5@mail.ru
+---
+(c) 2016-2026 Henry++

VERSION

@@ -1,3 +1,3 @@
-simplewall=3.8|https://github.com/henrypp/simplewall/releases/download/v.3.8/simplewall-3.8-setup.exe;
-language=1711810037|https://raw.githubusercontent.com/henrypp/simplewall/master/bin/simplewall.lng;
-rules_internal=1652781827|https://raw.githubusercontent.com/henrypp/simplewall/master/bin/profile_internal.xml;
+simplewall=3.9.1|https://github.com/henrypp/simplewall/releases/download/v.3.9.1/simplewall-3.9.1-setup.exe;
+language=1792312253|https://raw.githubusercontent.com/henrypp/simplewall/master/bin/simplewall.lng;
+rules_internal=1784741706|https://raw.githubusercontent.com/henrypp/simplewall/master/bin/profile_internal.sp;

bin/History.txt

@@ -1,3 +1,94 @@
+v3.9.1 Beta (22 July 2026)
+- added network statistics to watch info about speed (issue #2100) [thx @Tarkiin]
+- added option to exclude inbound blocked packets (#2111)
+- fixed repeatedly notifications (issue #2107)
+- updated igmp rule (issue #2111)
+
+v3.9 Beta (21 July 2026)
+- changed messages with displays unused apps and timers (it displays full paths)
+- now creating rules from network/log listviews do not use local IP addressess
+- mark toolbar log icons as disabled when log subsription failed
+- changed option resolve network address to enabled by default
+- now profile saved paths with environment variables
+- increased rules limit to 1024 symbols (issue #809)
+- improved loopback filters
+- improved memory usage
+- improved dark theme
+- improved security
+- fixed saving profile when it have read-only attribute (issue #2048) [thx @jekesx]
+- fixed log subscription sometimes returns access denied (issue #1710)
+- fixed crash when loading notification dialog (issue #2070)
+- fixed searchbox dissapear (issue #1790)
+- fixed possible memory leaks
+- updated port services lists
+
+v3.8.7 (8 August 2025)
+- fixed not logical crash (issue #2012)
+- fixed context menu performance
+- updated locale (issue #1984)
+- updated project sdk
+- cosmetic fixes
+
+v3.8.6.1 (21 May 2025)
+- fixed "open containing folder" error (issue #1977)
+- fixed crash at startup (issue #1979)
+- fixed crash dump (issue #1958)
+
+v3.8.6 (1 April 2025)
+- fixed check for update, does not bring up popup (issue #1923)
+- fixed memory heap error (issue #1945)
+- fixed possible crash
+- improved dark theme support
+
+v3.8.5 (27 November 2024)
+- fixed adding apps with drive letters instead of specific apps (issue #1887)
+- fixed creating rules for inaccessible paths (issue #1891)
+- fixed opening log with spaces path (issue #1912)
+- fixed windows 7 loopback rules
+- cosmetic fixes
+
+v3.8.4 (11 September 2024)
+- added listview empty markup
+- fixed tray icon middle click not worked when log ui is disabled
+- fixed notification displays invalid signature (issue #1871)
+- fixed does not show up tray icon (issue #1844)
+- fixed crash when cleanup timers (issue #1860)
+- fixed possible memory leak
+- updated project sdk
+- updated rule hint
+- cosmetic fixes
+
+v3.8.3 (8 August 2024)
+- added remember last position of notification window (issue #1659)
+- added watch services & uwp apps for install/uninstall
+- added displays long time for apps
+- improved windows 7 compatibility
+- improved arm64 compatibility
+- improved dark theme support
+- fixed show log button does not work as expected (issue #1757, again!)
+- fixed apps sometimes delete themselves (issue #1794, not fixed)
+- fixed duplicate process at startup (issue #1769)
+- fixed do not save hash when it is not enabled
+- fixed row colors for dark mode (issue #1767)
+- fixed log listview sorting by date
+- fixed displaying timer tooltip
+- updated project sdk
+
+v3.8.2 (9 May 2024)
+- revert back windows 7 & windows 8 support
+- improved dark theme support
+- improved log subscription
+- fixed show log button does not work as expected (issue #1757)
+- fixed search visibility
+
+v3.8.1 (27 April 2024)
+- fixed lacks search context (issue #1760)
+- fixed incorrect log ui listview item counting
+- updated confirm message for timers cleanup
+- updated confirm message for unused cleanup
+- updated cppwinrt package
+- updated project sdk
+
 v3.8 (1 April 2024)
 - added mitigations (win10+) (issue #611)
 - added dark theme support (issue #248)

bin/Readme.txt

@@ -3,12 +3,12 @@ simplewall
 Description:
 Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.
 
-The lightweight application is less than a megabyte, and it is compatible with Windows 8.1 and higher operating systems.
+The lightweight application is less than a megabyte, and it is compatible with Windows 7 SP1 and higher operating systems.
 You can download either the installer or portable version. For correct working you are require administrator rights.
 
 System requirements:
-- Windows 8.1 and above operating system.
-- Visual C++ 2022 Redistributable package (https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170)
+- Windows 7, 8, 8.1, 10, 11 64-bit/ARM64
+- An SSE2-capable CPU
 
 Nota bene:
 Keep in mind, simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall. It works
@@ -31,8 +31,8 @@ Features:
 - Dropped packets information with notification and logging to a file feature (win7+)
 - Allowed packets information with logging to a file feature (win8+)
 - Windows Subsystem for Linux (WSL) support
+- Windows Store support (win8+)
 - Windows services support
-- Windows Store support
 - Free and open source
 - Localization support
 - IPv6 support
@@ -57,4 +57,4 @@ Command line:
 Website: https://github.com/henrypp
 Support: sforce5@mail.ru
 
-(c) 2016-2024 Henry++
+(c) 2016-2026 Henry++

bin/i18n/Arabic.ini

@@ -0,0 +1,241 @@
+; Arabic
+; Bob (Oman)
+; Discord: 111a1
+
+[Arabic]
+IDS_TITLE_EXCLUDE=استبعاد
+IDS_FILE=ملف
+IDS_SETTINGS=الإعدادات
+IDS_EXIT=خروج
+IDS_EDIT=تحرير
+IDS_PURGE_UNUSED=تنظيف التطبيقات غير المستخدمة
+IDS_PURGE_TIMERS=تنظيف المؤقتات
+IDS_FIND=بحث
+IDS_REFRESH=تحديث
+IDS_VIEW=عرض
+IDS_ICONS=الرموز
+IDS_ICONSSMALL=صغيرة
+IDS_ICONSLARGE=كبيرة
+IDS_ICONSISHIDDEN=عدم عرض الرموز
+IDS_LANGUAGE=اللغة
+IDS_FONT=الخط
+IDS_HELP=مساعدة
+IDS_WEBSITE=الموقع الإلكتروني
+IDS_CHECKUPDATES=التحقق من التحديثات
+IDS_DONATE=قل شكراً!
+IDS_ABOUT=حول
+IDS_TRAY_SHOW=إظهار/إخفاء
+IDS_TRAY_START=تفعيل الفلاتر
+IDS_TRAY_STOP=إلغاء تفعيل الفلاتر
+IDS_TRAY_RULES=القواعد
+IDS_TRAY_BLOCKLIST_RULES=قائمة الحظر
+IDS_TRAY_SYSTEM_RULES=قواعد نظام التشغيل
+IDS_TRAY_USER_RULES=قواعد المستخدم
+IDS_TRAY_LOGERR=سجل الأخطاء
+IDS_ADD_FILE=إضافة تطبيق
+IDS_ANY=أي
+IDS_DISABLENOTIFICATIONS=إلغاء تنشيط الإشعارات
+IDS_OPENRULESEDITOR=إنشاء قاعدة
+IDS_TIMER=مؤقت
+IDS_DISABLETIMER=إلغاء تنشيط المؤقت
+IDS_EXPLORE=فتح موقع الملف
+IDS_COPY=نسخ
+IDS_SELECT_ALL=تحديد الكل
+IDS_CHECK=السماح بالتحديد
+IDS_UNCHECK=حظر التحديد
+IDS_ADD=إضافة
+IDS_EDIT2=تعديل
+IDS_DELETE=حذف
+IDS_EXPORT=تصدير
+IDS_IMPORT=استيراد
+IDS_RULE_ALLOWLOOPBACK=السماح بكل حركة المرور الخاصة بالتكرار (loopback)
+IDS_HIGHLIGHT_INVALID=غير صالح (الملف مفقود أو مشكلة في الفلتر)
+IDS_HIGHLIGHT_NETWORK=تطبيق الشبكة المشتركة
+IDS_HIGHLIGHT_PICO=تطبيق بيكو
+IDS_HIGHLIGHT_SIGNED=تطبيق موقّع
+IDS_HIGHLIGHT_SILENT=الإشعارات معطلة
+IDS_HIGHLIGHT_SPECIAL=قواعد المستخدم
+IDS_HIGHLIGHT_SYSTEM=تطبيق نظام التشغيل
+IDS_GROUP_TIMER=تطبيقات تحتوي على مؤقت
+IDS_EDITOR=محرر القواعد
+IDS_NAME=الاسم
+IDS_RULE=القاعدة
+IDS_PORTVERSION=العائلة (المنافذ فقط)
+IDS_PROTOCOL=البروتوكول
+IDS_DIRECTION=Direction
+IDS_ACTION=Action
+IDS_DATE=Date
+IDS_FILEPATH=المسار
+IDS_SIGNATURE=Signature
+IDS_ADDRESS=العنوان
+IDS_FILTER=الفلتر
+IDS_NOTES=Notes
+IDS_ADDED=تمت الإضافة
+IDS_TIMELEFT=الوقت المتبقي
+IDS_SIGN_SIGNED=موقع
+IDS_SIGN_UNSIGNED=غير موقّع
+IDS_GROUP_ALLOWED=تطبيقات ذات وصول إلى الشبكة
+IDS_GROUP_BLOCKED=تطبيقات بدون وصول إلى الشبكة
+IDS_GROUP_ENABLED=القواعد مفعلة
+IDS_GROUP_DISABLED=القواعد غير مفعلة
+IDS_DIRECTION_1=صادر
+IDS_DIRECTION_2=وارد
+IDS_DIRECTION_3=كلاهما
+IDS_ACTION_ALLOW=السماح
+IDS_ACTION_BLOCK=حظر
+IDS_ENABLE_CHK=تفعيل القاعدة
+IDS_WIKI=مساعدة
+IDS_SAVE=حفظ
+IDS_CLOSE=إغلاق
+IDS_SETTINGS_GENERAL=عام
+IDS_TITLE_GENERAL=الإعدادات العامة
+IDS_TITLE_LANGUAGE=اللغة
+IDS_TITLE_CONFIRMATIONS=Confirmations
+IDS_TITLE_INTERFACE=Interface
+IDS_TITLE_HIGHLIGHTING=التظليل
+IDS_TITLE_LOGGING=سجل الحزم
+IDS_TITLE_NOTIFICATIONS=Notifications
+IDS_TITLE_ADVANCED=متقدم
+IDS_ALWAYSONTOP_CHK=دائمًا مرئي
+IDS_LOADONSTARTUP_CHK=التحميل عند بدء تشغيل النظام
+IDS_STARTMINIMIZED_CHK=تشغيل في الوضع المصغر
+IDS_SHOWFILENAMESONLY_CHK=عرض أسماء الملفات فقط
+IDS_AUTOSIZECOLUMNS_CHK=الحجم التلقائي للأعمدة
+IDS_SKIPUACWARNING_CHK=تجاهل تحذير "التحقق من حساب المستخدم"
+IDS_CHECKUPDATES_CHK=التحقق التلقائي من التحديثات (موصى به)
+IDS_LANGUAGE_HINT=اختيار اللغة:
+IDS_USESTEALTHMODE_CHK=منع فحص المنافذ
+IDS_USESTEALTHMODE_HINT=منع فحص المنافذ TCP عن طريق إسقاط فحص المنافذ TCP و RST و UDP الواردة، والرد على ICMP الصادرة مع "الوجهة غير قابلة للوصول".
+IDS_INSTALLBOOTTIMEFILTERS_CHK=تفعيل الفلاتر عند بدء التشغيل
+IDS_INSTALLBOOTTIMEFILTERS_HINT=منع تسرب البيانات عند بدء تشغيل النظام، حتى قبل بدء خدمة "محرك الفلترة الأساسي" (BFE).
+IDS_USECERTIFICATES_CHK=التحقق من التوقيعات الرقمية للتطبيقات
+IDS_USENETWORKRESOLUTION_CHK=حل العناوين الشبكية
+IDS_DISABLEWINDOWSFIREWALL_CHK=إلغاء تفعيل جدار الحماية لويندوز
+IDS_ENABLEWINDOWSFIREWALL_CHK=تفعيل جدار الحماية لويندوز
+IDS_CONFIRMEXIT_CHK=التأكيد عند الإغلاق
+IDS_CONFIRMEXITTIMER_CHK=التأكيد عند الإغلاق إذا كانت المؤقتات نشطة
+IDS_CONFIRMLOGCLEAR_CHK=التأكيد عند مسح سجل الملفات
+IDS_COLORS_HINT=انقر مرتين على عنصر لتعديله.
+IDS_ENABLELOG_CHK=تفعيل تسجيل الحزم في ملف
+IDS_LOGSHOW=عرض السجل
+IDS_LOGCLEAR=مسح السجل
+IDS_LOGSIZELIMIT_HINT=الحجم الأقصى للسجل: (ك.ب)
+IDS_ENABLENOTIFICATIONS_CHK=تفعيل إشعارات الحزم
+IDS_NOTIFICATIONSOUND_CHK=تفعيل الإشعارات الصوتية
+IDS_NOTIFICATIONTIMEOUT_HINT=مدة العرض بين الإشعارات المتشابهة (ثواني):
+IDS_NOTIFY_TOOLTIP=تحديد قاعدة للمستخدم للسماح لتطبيق بالوصول إلى عنوان أو منفذ
+IDS_QUESTION=هل أنت متأكد؟
+IDS_QUESTION_DELETE=حذف العنصر/العناصر المحددة؟
+IDS_QUESTION_START=حظر الوصول إلى الشبكة للتطبيقات بناءً على الإعدادات الحالية. الاستمرار؟
+IDS_QUESTION_STOP=استعادة الوصول إلى الشبكة لجميع التطبيقات المحجوبة حاليًا. الاستمرار؟
+IDS_QUESTION_EXIT=الفلاتر المثبتة ستظل مفعلة حتى إذا غادرت. الاستمرار؟
+IDS_QUESTION_TIMER=المؤقت/المؤقتات نشطة. المؤقتات تكون نشطة فقط عندما يتم تشغيل التطبيق. هل تريد الخروج؟
+IDS_QUESTION_TIMERS=حذف جميع المؤقتات؟
+IDS_QUESTION_FLAG_CHK=عدم السؤال مرة أخرى
+IDS_STATUS_EMPTY=فارغ.
+IDS_STATUS_SYNTAX_ERROR=خطأ في الصيغة في القاعدة!
+IDS_ADDRESS_LOCAL=Source
+IDS_ADDRESS_REMOTE=Destination
+IDS_UPDATE_ERROR=خطأ في الاتصال بخادم التحديثات.
+IDS_UPDATE_DOWNLOAD=تحميل التحديث...
+IDS_UPDATE_DONE=تم تحميل التحديث.
+IDS_GROUP_SPECIAL_APPS=تطبيقات تحتوي على قواعد المستخدم
+IDS_RULE_ALLOWLOOPBACK_HINT=السماح بكل حركة المرور الخاصة بالتكرار (loopback).
+IDS_RESET=إعادة تعيين
+IDS_EXCLUDESTEALTH_CHK=فحص المنافذ
+IDS_EXCLUDEBLOCKLIST_CHK=قائمة الحظر
+IDS_UPDATE_INIT=التحقق من وجود نسخة جديدة...
+IDS_UPDATE_INSTALL=تحديث متاح. هل ترغب في تثبيته الآن؟
+IDS_EXCLUDECUSTOM_CHK=قواعد المستخدم
+IDS_EXCLUDECLASSIFYALLOW_CHK=الاتصالات المسموح بها
+IDS_STATUS_TIMER_DONE=انتهت مدة المؤقت لهذا التطبيق
+IDS_ICONSEXTRALARGE=كبير جدًا
+IDS_STATUS_UNUSED_APPS=تطبيقات غير مستخدمة
+IDS_STATUS_TIMER_APPS=تطبيقات تحتوي على مؤقت
+IDS_SECUREFILTERS_CHK=تفعيل حماية الفلاتر المثبتة
+IDS_SECUREFILTERS_HINT=منع التطبيقات غير المصرح لها من الوصول إلى الفلاتر المثبتة.
+IDS_USEREFRESHDEVICES_CHK=تحديث الفلاتر عند توصيل الأجهزة (التخزين)
+IDS_RULE_ALLOW6TO4=السماح بكل إعادة توجيه IPv6 (6to4)
+IDS_RECOMMENDED=موصى به
+IDS_ICONSISTABLEVIEW=عرض كجدول
+IDS_ACTION_ALLOW_HINT=السماح بالوصول إلى الشبكة إلى الأبد
+IDS_ACTION_BLOCK_HINT=حظر الوصول إلى الشبكة إلى الأبد (إلى الأبد)
+IDS_ACTION_LATER_HINT=تجاهل واطلب مني لاحقًا
+IDS_RULE_APPLY_2=تطبيق القاعدة "%s" على هذا التطبيق
+IDS_EDITRULES=تعديل القواعد
+IDS_TAB_APPS=تطبيقات
+IDS_TAB_SERVICES=Services
+IDS_TAB_PACKAGES=تطبيقات UWP
+IDS_TAB_NETWORK=الاتصالات
+IDS_STATE=الحالة
+IDS_STATUS_FILTERS_ACTIVE=الفلاتر مفعلة.
+IDS_STATUS_FILTERS_INACTIVE=الفلاتر معطلة!
+IDS_STATUS_FILTERS_PROCESSING=تطبيق الفلاتر
+IDS_HIGHLIGHT_CONNECTION=متصل بالشبكة
+IDS_SHOWINLIST=عرض في القائمة
+IDS_BLOCKLIST_SPY=التجسس والقياسات من مايكروسوفت
+IDS_BLOCKLIST_UPDATE=تحديثات مايكروسوفت
+IDS_BLOCKLIST_EXTRA=تطبيقات مايكروسوفت
+IDS_PORT=Port
+IDS_NOTIFY_TITLE=تنبيه الشبكة
+IDS_NOTIFY_HEADER=تم حظر الاتصال بالشبكة
+IDS_DISABLE=إلغاء التفعيل
+IDS_TITLE_SECURITY=الأمان
+IDS_LOGVIEWER_HINT=تطبيق مشاهدة السجلات
+IDS_NOTIFICATIONONTRAY_CHK=عرض الإشعارات في أسفل يمين الشاشة
+IDS_NETWORK_CLOSE=إنهاء الاتصال
+IDS_RULE_BLOCKOUTBOUND=حظر كل الحركة الصادرة
+IDS_RULE_BLOCKINBOUND=حظر كل الحركة الواردة
+IDS_VIEW_ICON=الرموز
+IDS_VIEW_DETAILS=التفاصيل
+IDS_VIEW_TILE=البلاطات
+IDS_RULE_HINT=إذا تركت الحقول فارغة، فسيتم تطبيق القاعدة على جميع العناوين والمنافذ.
+IDS_RULE_APPS_HINT=إذا لم يتم تحديد أي تطبيق، فسيتم تطبيق القاعدة على جميع التطبيقات.
+IDS_STATUS_FILTERS_ACTIVE_TEMP=الفلاتر مفعلة حتى إعادة التشغيل التالي.
+IDS_INSTALL_PERMANENT=القواعد الدائمة. هذه القواعد مفعلة حتى يتم تعطيلها يدويًا.
+IDS_INSTALL_TEMPORARY=القواعد المؤقتة. سيتم تعطيل هذه القواعد بعد إعادة التشغيل التالي.
+IDS_ENABLEUILOG_CHK=تفعيل واجهة تسجيل الحزم
+IDS_NOTIFICATIONFULLSCREENSILENTMODE_CHK=تفعيل الوضع الصامت عندما يكون التطبيق في وضع ملء الشاشة
+IDS_TITLE_TRAY=رمز في منطقة الإشعارات
+IDS_TRAYICONSINGLECLICK_CHK=فتح بنقرة واحدة على الرمز في منطقة الإشعارات
+IDS_ENABLE_APP_CHK=السماح بالوصول إلى الشبكة
+IDS_APP_HINT=لا يوجد سبب لتحديد قاعدة تيسيرية لتطبيق لديه وصول كامل إلى الشبكة بالفعل.
+IDS_HOST=المضيف
+IDS_CONFIRMALLOW_CHK=التأكيد عند السماح لتطبيق
+IDS_QUESTION_ALLOW=هل أنت متأكد أنك تريد منح هذا التطبيق وصولاً كاملاً إلى الشبكة؟
+IDS_SHOWSEARCHBAR_CHK=عرض شريط البحث
+IDS_LAYER=الطبقة
+IDS_RULE_ALLOWWINDOWSUPDATE=السماح بتحديثات ويندوز
+IDS_ACTION_TERMINATE_HINT=إيقاف العملية
+IDS_PROFILE_TYPE=نوع الملف
+IDS_USEAPPMONITOR_CHK=مراقبة تغييرات التطبيقات
+IDS_DISABLEREMOVAL=منع الحذف
+IDS_USEHASHES_CHK=التحقق من قيم التحقق من التطبيقات SHA-256
+IDS_COMMENT=التعليقات
+IDS_USEDARKTHEME=تفعيل الوضع الداكن
+IDS_KEEPUNUSED_CHK=احتفظ بالتطبيقات غير المستخدمة
+IDS_UPDATE_NO=لا يوجد تحديث متاح.
+IDS_UPDATE_YES=تحديث متاح. هل ترغب في تنزيله وتثبيته الآن؟
+IDS_UPDATE_SPEED=Speed
+IDS_RULE_FOR_ALL=for all
+IDS_RULE_FOR_APPS=for apps
+IDS_PROFILE_TYPE_PLAIN=Plain
+IDS_PROFILE_TYPE_COMPRESSED=Compressed
+IDS_PROFILE_TYPE_ENCRYPTED=Encrypted
+IDS_SESSION_ONLY=session only
+IDS_LIMIT_REACHED=Limit reached.
+IDS_INTERNAL_RULE=Internal rule
+IDS_LOADING=Loading...
+IDS_DIRECTION_REMOTE=Remote
+IDS_DIRECTION_LOCAL=Local
+IDS_WARNING_UNEXPECTED=Be careful, through service/driver host (svchost.exe/System) internet traffic can let out through unexpected ways. Continue?
+IDS_WARNING_ME=If you disallow main process, you cannot use resolve network addresses option. Continue?
+IDS_TOTAL=Total
+IDS_ALLOWIPFORWARDING_CHK=Allow IP forwarding
+IDS_EXCLUDEINBOUND_CHK=inbound multicast/broadcast
+IDS_CONNECTIONS_ENABLE=Enable connections monitoring
+IDS_CONNECTIONS_SHOWAITCONNECTIONS=Show waiting connections
+IDS_CONNECTIONS_MEASUREUDPTRAFFIC=Measure UDP/QUIC traffic (experimental, restart required)
+IDS_UDP_ACCOUNTING=UDP (including QUIC): ETW bytes since this socket was first monitored.
+IDS_UDP_UNAVAILABLE=UDP measurement unavailable or incomplete. Restart simplewall to retry. Error
+IDS_UDP_PENDING=UDP: no verified measurement yet. Sockets opened before monitoring must be reopened.

bin/i18n/Armenian.ini

@@ -0,0 +1,240 @@
+; Armenian
+; Armenian localization from hrach mk
+
+[Armenian]
+IDS_TITLE_EXCLUDE=Բացառել
+IDS_FILE=Թարմացումներ չկան:
+IDS_SETTINGS=Թարմացումը հասանելի է, ներբեռնե՞լ և տեղադրել:
+IDS_EXIT=Ֆայլ
+IDS_EDIT=Դրույթներ
+IDS_PURGE_UNUSED=Խմբագրել
+IDS_PURGE_TIMERS=Purge timers
+IDS_FIND=Ջնջել չօգտագործված հավելվածները
+IDS_REFRESH=Որոնել
+IDS_VIEW=Որոնել․․․
+IDS_ICONS=Թարմացնել
+IDS_ICONSSMALL=Տեսք
+IDS_ICONSLARGE=Պատկերակներ
+IDS_ICONSISHIDDEN=Փոքր
+IDS_LANGUAGE=Միջին
+IDS_FONT=Չբեռնել պատկերակները
+IDS_HELP=Լեզու
+IDS_WEBSITE=Տառասեսակ
+IDS_CHECKUPDATES=Օգնություն
+IDS_DONATE=Ծրագրի կայք
+IDS_ABOUT=Ստուգել թարմացումները
+IDS_TRAY_SHOW=Շնորհակալություն հայտնել!
+IDS_TRAY_START=Ծրագրի մասին
+IDS_TRAY_STOP=Ցույց տալ/թաքցնել
+IDS_TRAY_RULES=Անջատել զտումը
+IDS_TRAY_BLOCKLIST_RULES=Blocklist
+IDS_TRAY_SYSTEM_RULES=Կանոններ
+IDS_TRAY_USER_RULES=Սև ցուցակ
+IDS_TRAY_LOGERR=Իմ կանոններ
+IDS_ADD_FILE=Add app
+IDS_ANY=Any
+IDS_DISABLENOTIFICATIONS=Disable notifications
+IDS_OPENRULESEDITOR=Ցանկացած
+IDS_TIMER=Անջատել ծանուցումները
+IDS_DISABLETIMER=Ժամաչափ
+IDS_EXPLORE=Open containing folder
+IDS_COPY=Անջատել ժամանակաչափը
+IDS_SELECT_ALL=Բացել թղթապանակը
+IDS_CHECK=Պատճենել
+IDS_UNCHECK=Ընտրել բոլորը
+IDS_ADD=Միացնել ընտրվածը
+IDS_EDIT2=Անջատել ընտրվածը
+IDS_DELETE=Ավելացնել
+IDS_EXPORT=Փոփոխել
+IDS_IMPORT=Ջնջնել
+IDS_RULE_ALLOWLOOPBACK=Allow loopback connections for all
+IDS_HIGHLIGHT_INVALID=Invalid (file not found or filter problem)
+IDS_HIGHLIGHT_NETWORK=Թույլատրել շրջադարձ կապերը բոլորի համար
+IDS_HIGHLIGHT_PICO=Ֆայլ համօգտագործումից
+IDS_HIGHLIGHT_SIGNED=Pico հավելված
+IDS_HIGHLIGHT_SILENT=Disabled notifications
+IDS_HIGHLIGHT_SPECIAL=Ստորագրված հավելված
+IDS_HIGHLIGHT_SYSTEM=Ծանուցումներն անջատված են
+IDS_GROUP_TIMER=Օգտագործողի կանոններ
+IDS_EDITOR=Համակարգային հավելված
+IDS_NAME=ժամաչափով հավելված
+IDS_RULE=Կանոնների խմբագիր
+IDS_PORTVERSION=Անվանումը
+IDS_PROTOCOL=Կանոնը
+IDS_DIRECTION=Family (միայն պորտերի համար)
+IDS_ACTION=հաղորդակարգը
+IDS_DATE=Ուղղությունը
+IDS_FILEPATH=Գործողությունը
+IDS_SIGNATURE=Ամսաթիվը
+IDS_ADDRESS=Ուղին
+IDS_FILTER=Ստորագրությունը
+IDS_NOTES=Հասցեն
+IDS_ADDED=Զտիչ
+IDS_TIMELEFT=Ավելացված է
+IDS_SIGN_SIGNED=Signed
+IDS_SIGN_UNSIGNED=Մնացած ժամանակ
+IDS_GROUP_ALLOWED=Ստորագրվել է
+IDS_GROUP_BLOCKED=Ստորագրված չէ
+IDS_GROUP_ENABLED=Հավելվածներ ցանցի մուտքով
+IDS_GROUP_DISABLED=Ներառված կանոններ
+IDS_DIRECTION_1=Outbound
+IDS_DIRECTION_2=Անջատված կանոններ
+IDS_DIRECTION_3=Ելքային
+IDS_ACTION_ALLOW=Մուտքային
+IDS_ACTION_BLOCK=Եկուսն էլ
+IDS_ENABLE_CHK=Enable rule
+IDS_WIKI=Միացնել կանոնը
+IDS_SAVE=Save
+IDS_CLOSE=Հղում
+IDS_SETTINGS_GENERAL=Պահել
+IDS_TITLE_GENERAL=Փակել
+IDS_TITLE_LANGUAGE=Հիմնական
+IDS_TITLE_CONFIRMATIONS=Հիմնական պարամետրեր
+IDS_TITLE_INTERFACE=Միջերեսի լեզուն
+IDS_TITLE_HIGHLIGHTING=Հաստատումներ
+IDS_TITLE_LOGGING=Հետին լույս
+IDS_TITLE_NOTIFICATIONS=Notifications
+IDS_TITLE_ADVANCED=Փաթեթների մատյան
+IDS_ALWAYSONTOP_CHK=Ծանուցումներ
+IDS_LOADONSTARTUP_CHK=Լրացուցիչ
+IDS_STARTMINIMIZED_CHK=Մյուս պատուհաններից առաջ
+IDS_SHOWFILENAMESONLY_CHK=Գործարկել համակարգի բեռնման ժամանակ
+IDS_AUTOSIZECOLUMNS_CHK=Մեկնարկել թաքցված
+IDS_SKIPUACWARNING_CHK=Ցույց տալ միայն ֆայլերի անունները
+IDS_CHECKUPDATES_CHK=Տեղավորել սյունակները
+IDS_LANGUAGE_HINT=Անտեսեք «Օգտագործողի հաշվի վերահսկում» նախազգուշացումը
+IDS_USESTEALTHMODE_CHK=Prevent port scanning
+IDS_USESTEALTHMODE_HINT=Prevent TCP port scanning by silently dropping inbound TCP RST and UDP port scanning by responding to outbound ICMP with "Destination Unreachable".
+IDS_INSTALLBOOTTIMEFILTERS_CHK=Կանխել նավահանգիստների ստուգումը
+IDS_INSTALLBOOTTIMEFILTERS_HINT=Կանխեք պորտերի ստուգումը՝ թույլ չտալով մուտքային TCP RST և ելքային ICMP «Անհասանելի նպատակակետ» հարցումները:
+IDS_USECERTIFICATES_CHK=Check apps for digital signatures
+IDS_USENETWORKRESOLUTION_CHK=Resolve network addresses
+IDS_DISABLEWINDOWSFIREWALL_CHK=Ստուգել հավելվածի թվային ստորագրությունները
+IDS_ENABLEWINDOWSFIREWALL_CHK=Թույլատրել ցանցային հասցեները
+IDS_CONFIRMEXIT_CHK=Անջատել Windows firewall-ը
+IDS_CONFIRMEXITTIMER_CHK=Միացնել Windows firewall-ը
+IDS_CONFIRMLOGCLEAR_CHK=Դուրս գալու հաստատում սահմանված ժամաչափով
+IDS_COLORS_HINT=Հաստատեք հավելվածների հեռացումը ցուցակից
+IDS_ENABLELOG_CHK=Մատյանի մաքրման հաստատում
+IDS_LOGSHOW=Կրկնակի սեղմեք տարրի վրա՝ խմբագրելու համար:
+IDS_LOGCLEAR=Միացնել գրելու փաթեթները ֆայլի համար
+IDS_LOGSIZELIMIT_HINT=Ցույց տալ գրանցամատյանը
+IDS_ENABLENOTIFICATIONS_CHK=Մաքրել գրանցամատյանը
+IDS_NOTIFICATIONSOUND_CHK=Մատյանների առավելագույն չափը. (ԿԲ)
+IDS_NOTIFICATIONTIMEOUT_HINT=Timeout between similar notifications (sec.):
+IDS_NOTIFY_TOOLTIP=Set user rule to allow access to an address and/or port for this application.
+IDS_QUESTION=Are you sure?
+IDS_QUESTION_DELETE=Կիրառեք հատուկ կանոն՝ այս հավելվածի համար հասցե կամ նավահանգիստ մուտք գործելու համար:
+IDS_QUESTION_START=Վստա՞հ եք
+IDS_QUESTION_STOP=Ջնջել %d տարր(եր)ը
+IDS_QUESTION_EXIT=Սա կվերականգնի ցանցի հասանելիությունը բոլոր հավելվածներին, շարունակե՞լ:
+IDS_QUESTION_TIMER=Timer(s) activated. Timers will only work when the application is running. Exit?
+IDS_QUESTION_TIMERS=Delete all timers?
+IDS_QUESTION_FLAG_CHK=Ժամաչափը միացված է: Ժամաչափն աշխատում է միայն այն ժամանակ, երբ հավելվածն աշխատում է, դուրս գա՞լ:
+IDS_STATUS_EMPTY=Բոլոր հավելվածները. %d
+IDS_STATUS_SYNTAX_ERROR=<դատարկ>
+IDS_ADDRESS_LOCAL=Source
+IDS_ADDRESS_REMOTE=Կանոնը պարունակում է շարահյուսական սխալ:
+IDS_UPDATE_ERROR=Աղբյուրը
+IDS_UPDATE_DOWNLOAD=Downloading update...
+IDS_UPDATE_DONE=Downloading update finished.
+IDS_GROUP_SPECIAL_APPS=Թարմացումը ներբեռնվում է...
+IDS_RULE_ALLOWLOOPBACK_HINT=This allows all loopback traffic.
+IDS_RESET=Թույլ է տալիս ամբողջ շրջադարձային տրաֆիկը:
+IDS_EXCLUDESTEALTH_CHK=Վստա՞հ եք, որ ցանկանում եք վերակայել ծրագրի բոլոր կարգավորումները:
+IDS_EXCLUDEBLOCKLIST_CHK=blocklist
+IDS_UPDATE_INIT=պորտերի ստուգիչի միացումները
+IDS_UPDATE_INSTALL=սև ցուցակի միացումներ
+IDS_EXCLUDECUSTOM_CHK=Ստուգել թարմացումները...
+IDS_EXCLUDECLASSIFYALLOW_CHK=օգտագործողի կանոնները
+IDS_STATUS_TIMER_DONE=Timer for application has been expired
+IDS_ICONSEXTRALARGE=թույլատրված կապեր
+IDS_STATUS_UNUSED_APPS=«%s»-ի ժամաչափն ավարտվել է:
+IDS_STATUS_TIMER_APPS=Չօգտագործվածները
+IDS_SECUREFILTERS_CHK=Enable protection of installed filters
+IDS_SECUREFILTERS_HINT=Ժամաչափեր
+IDS_USEREFRESHDEVICES_CHK=Միացնել տեղադրված զտիչների պաշտպանությունը
+IDS_RULE_ALLOW6TO4=Կանխել երրորդ կողմի հավելվածների մուտքը տեղադրված զտիչներ:
+IDS_RECOMMENDED=Թարմացրեք կանոնները, երբ սարքերը միացված են
+IDS_ICONSISTABLEVIEW=Թույլատրել IPv6 (6to4) վերահասցեավորումը բոլորի համար
+IDS_ACTION_ALLOW_HINT=Ցույց տալ որպես աղյուսակ
+IDS_ACTION_BLOCK_HINT=Block network access forever ('til kingdom come)
+IDS_ACTION_LATER_HINT=Թույլ տվեք ընդմիշտ
+IDS_RULE_APPLY_2=Ընդմիշտ արգելել
+IDS_EDITRULES=Edit rules
+IDS_TAB_APPS=Կիրառեք «%s»-ը հավելվածին
+IDS_TAB_SERVICES=Խմբագրել կանոնները
+IDS_TAB_PACKAGES=Հավելվածներ
+IDS_TAB_NETWORK=Ծառայություններ
+IDS_STATE=UWP հավելվածներ
+IDS_STATUS_FILTERS_ACTIVE=Միացումներ
+IDS_STATUS_FILTERS_INACTIVE=Իրավիճակ
+IDS_STATUS_FILTERS_PROCESSING=Զտումն ակտիվ է:
+IDS_HIGHLIGHT_CONNECTION=Զտումն ակտիվ չէ:
+IDS_SHOWINLIST=Զտիչների կիրառում
+IDS_BLOCKLIST_SPY=Ունի ցանցային կապեր
+IDS_BLOCKLIST_UPDATE=Ցույց տալ ցանկում
+IDS_BLOCKLIST_EXTRA=Microsoft-ի հետևումների սերվերները
+IDS_PORT=Microsoft-ի թարմացումների սերվերները
+IDS_NOTIFY_TITLE=Microsoft-ի հավելվածների սերվերները
+IDS_NOTIFY_HEADER=Պորտ
+IDS_DISABLE=Ցանցի ծանուցումները
+IDS_TITLE_SECURITY=%s-ն արգելափակել է հավելվածի կապը
+IDS_LOGVIEWER_HINT=Անջատել
+IDS_NOTIFICATIONONTRAY_CHK=Անվտանգություն
+IDS_NETWORK_CLOSE=Մատյանի դիտման հավելված
+IDS_RULE_BLOCKOUTBOUND=Ցույց տալ ծանուցման պատուհանը համակարգային խնդրագոտում
+IDS_RULE_BLOCKINBOUND=Փակել կապակցումը
+IDS_VIEW_ICON=Արգելափակել ելքային կապերը բոլորի համար
+IDS_VIEW_DETAILS=Արգելափակել մուտքային կապերը բոլորի համար
+IDS_VIEW_TILE=Պատկերակներ
+IDS_RULE_HINT=Մանրամասներ
+IDS_RULE_APPS_HINT=Սալիկներ
+IDS_STATUS_FILTERS_ACTIVE_TEMP=Եթե ​​դաշտերը դատարկ եք թողնում, ապա կանոնը վերաբերում է բոլոր հասցեներին և պորտերին:
+IDS_INSTALL_PERMANENT=Եթե ​​ոչ մի ծրագիր ընտրված չէ, ապա կանոնը վերաբերում է բոլոր հավելվածներին:
+IDS_INSTALL_TEMPORARY=Զտումն ակտիվացված է մինչև վերաբեռնումը:
+IDS_ENABLEUILOG_CHK=Մշտական ​​կանոններ. Կանոնները կգործեն այնքան ժամանակ, քանի դեռ դրանք ձեռքով չանջատեք:
+IDS_NOTIFICATIONFULLSCREENSILENTMODE_CHK=Ժամանակավոր կանոններ. Կանոնները կգործեն մինչև համակարգը վերագործարկվի:
+IDS_TITLE_TRAY=Միացնել մատյանի վարումը միջերեսում
+IDS_TRAYICONSINGLECLICK_CHK=Միացնել հանգիստ ռեժիմը, երբ ամբողջ էկրանով հավելվածն ակտիվ է
+IDS_ENABLE_APP_CHK=Խնդրագոտի
+IDS_APP_HINT=Մեկ սեղմում պատկերակը բացելու համար
+IDS_HOST=Միացնել ցանցի մուտքը
+IDS_CONFIRMALLOW_CHK=Կարիք չկա սահմանել թույլատրելի կանոններից որևէ մեկը այն հավելվածի համար, որն արդեն թույլատրված է մուտք գործել ցանց:
+IDS_QUESTION_ALLOW=Հոսթը
+IDS_SHOWSEARCHBAR_CHK=Հաստատեք հավելվածի թույլտվությունը
+IDS_LAYER=Իսկապե՞ս ուզում եք միացնել այս հավելվածի ամբողջական ինտերնետ հասանելիությունը:
+IDS_RULE_ALLOWWINDOWSUPDATE=Ցույց տալ որոնման տողը
+IDS_ACTION_TERMINATE_HINT=Terminate process
+IDS_PROFILE_TYPE=Թույլատրել Windows Update-ը
+IDS_USEAPPMONITOR_CHK=Monitor apps changing
+IDS_DISABLEREMOVAL=Disable removal
+IDS_USEHASHES_CHK=Check apps for sha-256 hash
+IDS_COMMENT=Comments
+IDS_USEDARKTHEME=Use dark theme
+IDS_KEEPUNUSED_CHK=Keep unused apps
+IDS_UPDATE_NO=No updates available.
+IDS_UPDATE_YES=Update available. Download and install now?
+IDS_UPDATE_SPEED=Speed
+IDS_RULE_FOR_ALL=for all
+IDS_RULE_FOR_APPS=for apps
+IDS_PROFILE_TYPE_PLAIN=Plain
+IDS_PROFILE_TYPE_COMPRESSED=Compressed
+IDS_PROFILE_TYPE_ENCRYPTED=Encrypted
+IDS_SESSION_ONLY=session only
+IDS_LIMIT_REACHED=Limit reached.
+IDS_INTERNAL_RULE=Internal rule
+IDS_LOADING=Loading...
+IDS_DIRECTION_REMOTE=Remote
+IDS_DIRECTION_LOCAL=Local
+IDS_WARNING_UNEXPECTED=Be careful, through service/driver host (svchost.exe/System) internet traffic can let out through unexpected ways. Continue?
+IDS_WARNING_ME=If you disallow main process, you cannot use resolve network addresses option. Continue?
+IDS_TOTAL=Total
+IDS_ALLOWIPFORWARDING_CHK=Allow IP forwarding
+IDS_EXCLUDEINBOUND_CHK=inbound multicast/broadcast
+IDS_CONNECTIONS_ENABLE=Enable connections monitoring
+IDS_CONNECTIONS_SHOWAITCONNECTIONS=Show waiting connections
+IDS_CONNECTIONS_MEASUREUDPTRAFFIC=Measure UDP/QUIC traffic (experimental, restart required)
+IDS_UDP_ACCOUNTING=UDP (including QUIC): ETW bytes since this socket was first monitored.
+IDS_UDP_UNAVAILABLE=UDP measurement unavailable or incomplete. Restart simplewall to retry. Error
+IDS_UDP_PENDING=UDP: no verified measurement yet. Sockets opened before monitoring must be reopened.

bin/i18n/Serbian (Cyrillic).ini

@@ -0,0 +1,240 @@
+; Serbian Cyrillic
+; Prevod: Adeii Schkartowsky (https://github.com/adeii), Radoš Milićev (https://github.com/rammba)
+
+[Serbian (Cyrillic)]
+IDS_TITLE_EXCLUDE=Искључи
+IDS_FILE=Фајл
+IDS_SETTINGS=Подешавања
+IDS_EXIT=Излаз
+IDS_EDIT=Уреди
+IDS_PURGE_UNUSED=Уклони неупотребљене апликације
+IDS_PURGE_TIMERS=Уклони све тајмере
+IDS_FIND=Претражи
+IDS_REFRESH=Освежи
+IDS_VIEW=Приказ
+IDS_ICONS=Иконице
+IDS_ICONSSMALL=Мало
+IDS_ICONSLARGE=Велико
+IDS_ICONSISHIDDEN=Не приказуј иконице
+IDS_LANGUAGE=Језик
+IDS_FONT=Фонт
+IDS_HELP=Помоћ
+IDS_WEBSITE=Веб-сајт
+IDS_CHECKUPDATES=Провери ажурирања
+IDS_DONATE=Захвали се!
+IDS_ABOUT=О ...
+IDS_TRAY_SHOW=Прикажи / Сакриј
+IDS_TRAY_START=Омогући филтере
+IDS_TRAY_STOP=Онемогући филтере
+IDS_TRAY_RULES=Правила
+IDS_TRAY_BLOCKLIST_RULES=Блок листа
+IDS_TRAY_SYSTEM_RULES=Системска правила
+IDS_TRAY_USER_RULES=Корисничка правила
+IDS_TRAY_LOGERR=Логови грешака
+IDS_ADD_FILE=Додај фајл
+IDS_ANY=Било шта
+IDS_DISABLENOTIFICATIONS=Онемогући нотификације
+IDS_OPENRULESEDITOR=Креирај правило
+IDS_TIMER=Тајмер
+IDS_DISABLETIMER=Онемогући тајмер
+IDS_EXPLORE=Отвори фолдер
+IDS_COPY=Копирај
+IDS_SELECT_ALL=Изабери све
+IDS_CHECK=Омогући изабрано
+IDS_UNCHECK=Онемогући изабрано
+IDS_ADD=Додај
+IDS_EDIT2=Уреди
+IDS_DELETE=Обриши
+IDS_EXPORT=Извези
+IDS_IMPORT=Увези
+IDS_RULE_ALLOWLOOPBACK=Дозволи повратне конекције за све
+IDS_HIGHLIGHT_INVALID=Невалидно (фајл не постоји / проблем са филтером)
+IDS_HIGHLIGHT_NETWORK=Апликација из дељене мреже
+IDS_HIGHLIGHT_PICO=Pico апликација
+IDS_HIGHLIGHT_SIGNED=Потписана апликација
+IDS_HIGHLIGHT_SILENT=Нотификације су онемогућене
+IDS_HIGHLIGHT_SPECIAL=Корисничка правила
+IDS_HIGHLIGHT_SYSTEM=Системска апликација
+IDS_GROUP_TIMER=Апликације за тајмер
+IDS_EDITOR=Уредник правила
+IDS_NAME=Назив
+IDS_RULE=Правило
+IDS_PORTVERSION=Породица (само за портове)
+IDS_PROTOCOL=Протокол
+IDS_DIRECTION=Смер
+IDS_ACTION=Акција
+IDS_DATE=Датум
+IDS_FILEPATH=Путања
+IDS_SIGNATURE=Потпис
+IDS_ADDRESS=Адреса
+IDS_FILTER=Филтер
+IDS_NOTES=Напомене
+IDS_ADDED=Додато
+IDS_TIMELEFT=Преостало време
+IDS_SIGN_SIGNED=Потписано
+IDS_SIGN_UNSIGNED=Није потписано
+IDS_GROUP_ALLOWED=Апликације са приступом интернету
+IDS_GROUP_BLOCKED=Апликације без приступа интернету
+IDS_GROUP_ENABLED=Омогућена правила
+IDS_GROUP_DISABLED=Онемогућена правила
+IDS_DIRECTION_1=Одлазно
+IDS_DIRECTION_2=Долазно
+IDS_DIRECTION_3=Оба
+IDS_ACTION_ALLOW=Дозволи
+IDS_ACTION_BLOCK=Блокирај
+IDS_ENABLE_CHK=Омогући правило
+IDS_WIKI=Помоћ
+IDS_SAVE=Сачувај
+IDS_CLOSE=Затвори
+IDS_SETTINGS_GENERAL=Опште
+IDS_TITLE_GENERAL=Општа конфигурација
+IDS_TITLE_LANGUAGE=Језик
+IDS_TITLE_CONFIRMATIONS=Потврде
+IDS_TITLE_INTERFACE=Интерфејс
+IDS_TITLE_HIGHLIGHTING=Истицање
+IDS_TITLE_LOGGING=Логови пакета
+IDS_TITLE_NOTIFICATIONS=Нотификације
+IDS_TITLE_ADVANCED=Напредно
+IDS_ALWAYSONTOP_CHK=Увек на врху
+IDS_LOADONSTARTUP_CHK=Учитавање приликом покретања система
+IDS_STARTMINIMIZED_CHK=Покрени смањено
+IDS_SHOWFILENAMESONLY_CHK=Прикажи само имена фајлова
+IDS_AUTOSIZECOLUMNS_CHK=Прилагоди величину колона
+IDS_SKIPUACWARNING_CHK=Прескочи "Контролу корисничког налога"
+IDS_CHECKUPDATES_CHK=Повремено проверавајте ажурирања (препорука)
+IDS_LANGUAGE_HINT=Изаберите језик:
+IDS_USESTEALTHMODE_CHK=Спречи скенирање портова
+IDS_USESTEALTHMODE_HINT=Спречавање скенирања TCP порта тихим пуштањем долазног TCP RST-а и UDP скенирања одговором на одлазни ICMP са "Destination Unreachable".
+IDS_INSTALLBOOTTIMEFILTERS_CHK=Омогући филтере за покретање система
+IDS_INSTALLBOOTTIMEFILTERS_HINT=Спречавање цурења података пре покретања система, чак и пре покретања "Base Filtering Engine" (BFE).
+IDS_USECERTIFICATES_CHK=Провера дигиталних потписа апликације
+IDS_USENETWORKRESOLUTION_CHK=Реши мрежне адресе
+IDS_DISABLEWINDOWSFIREWALL_CHK=Онемогући Windows Firewall
+IDS_ENABLEWINDOWSFIREWALL_CHK=Омогући Windows Firewall
+IDS_CONFIRMEXIT_CHK=Потврда затварања апликације
+IDS_CONFIRMEXITTIMER_CHK=Потврда затварања апликације док су тајмери активни
+IDS_CONFIRMLOGCLEAR_CHK=Потврда брисања фајла са логовима
+IDS_COLORS_HINT=Кликните двапут да бисте уредили.
+IDS_ENABLELOG_CHK=Омогући логовање пакета у фајл
+IDS_LOGSHOW=Прикажи логове
+IDS_LOGCLEAR=Обриши логове
+IDS_LOGSIZELIMIT_HINT=Максимална величина: (kB)
+IDS_ENABLENOTIFICATIONS_CHK=Омогући информације о пакетима
+IDS_NOTIFICATIONSOUND_CHK=Омогући звук нотификација
+IDS_NOTIFICATIONTIMEOUT_HINT=Временски размак између сличних нотификација (сек.):
+IDS_NOTIFY_TOOLTIP=Поставите корисничко правило за дозволу приступа адреси и/или порту за ову апликацију.
+IDS_QUESTION=Да ли сте сигурни?
+IDS_QUESTION_DELETE=Уклони елемемент(е)?
+IDS_QUESTION_START=Ово ће апликацијама забранити приступ мрежи у складу са тренутном конфигурацијом. Настави?
+IDS_QUESTION_STOP=Ово ће свим блокираним апликацијама вратити приступ мрежи. Настави?
+IDS_QUESTION_EXIT=Инсталирани филтери ће наставити са радом и кад затворите програм. Настави?
+IDS_QUESTION_TIMER=Активирани тајмер(и). Тајмери раде само док ради апликација. Изађи?
+IDS_QUESTION_TIMERS=Обриши све тајмере?
+IDS_QUESTION_FLAG_CHK=Не питај поново
+IDS_STATUS_EMPTY=Празно.
+IDS_STATUS_SYNTAX_ERROR=Правило садржи синтаксну грешку!
+IDS_ADDRESS_LOCAL=Извор
+IDS_ADDRESS_REMOTE=Дестинација
+IDS_UPDATE_ERROR=Грешка при повезивању сервера за ажурирање.
+IDS_UPDATE_DOWNLOAD=Преузимање ажурирања...
+IDS_UPDATE_DONE=Преузимање ажурирања је завршено.
+IDS_GROUP_SPECIAL_APPS=Апликације са корисничким правилима
+IDS_RULE_ALLOWLOOPBACK_HINT=Дозвољава сав повратни саобраћај.
+IDS_RESET=Ресетуј
+IDS_EXCLUDESTEALTH_CHK=конекције скенера портова
+IDS_EXCLUDEBLOCKLIST_CHK=блок листа
+IDS_UPDATE_INIT=Провера нових издања...
+IDS_UPDATE_INSTALL=Доступно ажурирање, желите ли да га инсталирате?
+IDS_EXCLUDECUSTOM_CHK=корисничка правила
+IDS_EXCLUDECLASSIFYALLOW_CHK=дозвољене конекције
+IDS_STATUS_TIMER_DONE=Тајмер за апликацију је истекао
+IDS_ICONSEXTRALARGE=Огромно
+IDS_STATUS_UNUSED_APPS=Неупотребљене апликације
+IDS_STATUS_TIMER_APPS=Апликације са тајмером
+IDS_SECUREFILTERS_CHK=Омогући заштиту инсталираних филтера
+IDS_SECUREFILTERS_HINT=Спречи приступ инсталираним филтерима за неауторизоване апликације
+IDS_USEREFRESHDEVICES_CHK=Ажурирај филтере када су уређаји за чување повезани
+IDS_RULE_ALLOW6TO4=Дозволи IPv6 преусмеравање (6to4) за све
+IDS_RECOMMENDED=препоручено
+IDS_ICONSISTABLEVIEW=Прикажи као табелу
+IDS_ACTION_ALLOW_HINT=Заувек дозволи приступ мрежи
+IDS_ACTION_BLOCK_HINT=Заувек забрани приступ мрежи (док је Сунца)
+IDS_ACTION_LATER_HINT=Игнориши и питај ме поново
+IDS_RULE_APPLY_2=Примени "%s" за ову апликацију
+IDS_EDITRULES=Уреди правила
+IDS_TAB_APPS=Апликације
+IDS_TAB_SERVICES=Услуге
+IDS_TAB_PACKAGES=UWP апликације
+IDS_TAB_NETWORK=Конекције
+IDS_STATE=Статус
+IDS_STATUS_FILTERS_ACTIVE=Филтери су омогућени.
+IDS_STATUS_FILTERS_INACTIVE=Филтери су онемогућени!
+IDS_STATUS_FILTERS_PROCESSING=Примењивање филтера
+IDS_HIGHLIGHT_CONNECTION=Поседује мрежне конекције
+IDS_SHOWINLIST=Прикажи у листи
+IDS_BLOCKLIST_SPY=Microsoft шпијунирање и телеметрија
+IDS_BLOCKLIST_UPDATE=Microsoft ажурирање
+IDS_BLOCKLIST_EXTRA=Microsoft апликације
+IDS_PORT=Порт
+IDS_NOTIFY_TITLE=Хитно обавештење о мрежи
+IDS_NOTIFY_HEADER=Мрежна конекција је била блокирана
+IDS_DISABLE=Онемогући
+IDS_TITLE_SECURITY=Безбедност
+IDS_LOGVIEWER_HINT=Апликација за преглед логова
+IDS_NOTIFICATIONONTRAY_CHK=Прикажи прозор са нотификацијама на траци
+IDS_NETWORK_CLOSE=Затвори конекцију
+IDS_RULE_BLOCKOUTBOUND=Блокирај одлазне конекције за све
+IDS_RULE_BLOCKINBOUND=Блокирај долазне конекције за све
+IDS_VIEW_ICON=Иконице
+IDS_VIEW_DETAILS=Детаљи
+IDS_VIEW_TILE=Поља
+IDS_RULE_HINT=Ако оставите празна поља, правило ће бити примењено на све адресе и портове.
+IDS_RULE_APPS_HINT=Ако нема одабраних апликација, правило ће бити примењено на све апликације.
+IDS_STATUS_FILTERS_ACTIVE_TEMP=Филтери су омогућени до поновног покретања.
+IDS_INSTALL_PERMANENT=Стална правила. Правила функционишу док их не искључите.
+IDS_INSTALL_TEMPORARY=Привремена правила. Правила су ресетована након поновног покретања.
+IDS_ENABLEUILOG_CHK=Омогући интерфејс за логовање пакета
+IDS_NOTIFICATIONFULLSCREENSILENTMODE_CHK=Омогући тихи мод док је апликација отворена на целом екрану
+IDS_TITLE_TRAY=Иконица обавештења
+IDS_TRAYICONSINGLECLICK_CHK=Један клик на иконицу обавештења за отварање
+IDS_ENABLE_APP_CHK=Омогући приступ мрежи
+IDS_APP_HINT=Нема разлога за постављање правила за апликацију са већ дозвољеним приступом интернету.
+IDS_HOST=Хост
+IDS_CONFIRMALLOW_CHK=Потврди кад дозвољаваш апликацију
+IDS_QUESTION_ALLOW=Да ли сте сигурни да желите дозволити потпуни приступ интернету за ову апликацију?
+IDS_SHOWSEARCHBAR_CHK=Прикажи траку за претрагу
+IDS_LAYER=Слој
+IDS_RULE_ALLOWWINDOWSUPDATE=Дозволи ажурирање Windows-а
+IDS_ACTION_TERMINATE_HINT=Прекини процес
+IDS_PROFILE_TYPE=Тип профила
+IDS_USEAPPMONITOR_CHK=Прати промене апликација
+IDS_DISABLEREMOVAL=Онемогући уклањање
+IDS_USEHASHES_CHK=Провери апликације за sha-256 хеш
+IDS_COMMENT=Коментари
+IDS_USEDARKTHEME=Користи тамну тему
+IDS_KEEPUNUSED_CHK=Задржи неупотребљене апликације
+IDS_UPDATE_NO=Нема доступних ажурирања.
+IDS_UPDATE_YES=Ажурирање је доступно, преузмите и инсталирајте?
+IDS_UPDATE_SPEED=Брзина
+IDS_RULE_FOR_ALL=за све
+IDS_RULE_FOR_APPS=за апликације
+IDS_PROFILE_TYPE_PLAIN=Обично
+IDS_PROFILE_TYPE_COMPRESSED=Компресовано
+IDS_PROFILE_TYPE_ENCRYPTED=Енкриптовано
+IDS_SESSION_ONLY=само сесија
+IDS_LIMIT_REACHED=Достигнут је лимит.
+IDS_INTERNAL_RULE=Интерно правило
+IDS_LOADING=Учитавање...
+IDS_DIRECTION_REMOTE=Удаљено
+IDS_DIRECTION_LOCAL=Локално
+IDS_WARNING_UNEXPECTED=Буди опрезан, интернет саобраћај се може неочекивано одвијати путем хоста за услуге/драјвере (svchost.exe/System). Настави?
+IDS_WARNING_ME=Ако онемогућиш главни процес, нећеш моћи да користиш опцију за разрешавање мрежних адреса. Настави?
+IDS_TOTAL=Укупно
+IDS_ALLOWIPFORWARDING_CHK=Allow IP forwarding
+IDS_EXCLUDEINBOUND_CHK=долазни multicast/broadcast
+IDS_CONNECTIONS_ENABLE=Enable connections monitoring
+IDS_CONNECTIONS_SHOWAITCONNECTIONS=Show waiting connections
+IDS_CONNECTIONS_MEASUREUDPTRAFFIC=Measure UDP/QUIC traffic (experimental, restart required)
+IDS_UDP_ACCOUNTING=UDP (including QUIC): ETW bytes since this socket was first monitored.
+IDS_UDP_UNAVAILABLE=UDP measurement unavailable or incomplete. Restart simplewall to retry. Error
+IDS_UDP_PENDING=UDP: no verified measurement yet. Sockets opened before monitoring must be reopened.

bin/i18n/Serbian (Latin).ini

@@ -0,0 +1,240 @@
+; Serbian Latin
+; Prevod: Adeii Schkartowsky (https://github.com/adeii), Radoš Milićev (https://github.com/rammba)
+
+[Serbian (Latin)]
+IDS_TITLE_EXCLUDE=Isključi
+IDS_FILE=Fajl
+IDS_SETTINGS=Podešavanja
+IDS_EXIT=Izlaz
+IDS_EDIT=Uredi
+IDS_PURGE_UNUSED=Ukloni neupotrebljene aplikacije
+IDS_PURGE_TIMERS=Ukloni sve tajmere
+IDS_FIND=Pretraži
+IDS_REFRESH=Osveži
+IDS_VIEW=Prikaz
+IDS_ICONS=Ikonice
+IDS_ICONSSMALL=Malo
+IDS_ICONSLARGE=Veliko
+IDS_ICONSISHIDDEN=Ne prikazuj ikonice
+IDS_LANGUAGE=Jezik
+IDS_FONT=Font
+IDS_HELP=Pomoć
+IDS_WEBSITE=Veb-sajt
+IDS_CHECKUPDATES=Proveri ažuriranja
+IDS_DONATE=Zahvali se!
+IDS_ABOUT=O ...
+IDS_TRAY_SHOW=Prikaži / Sakrij
+IDS_TRAY_START=Omogući filtere
+IDS_TRAY_STOP=Onemogući filtere
+IDS_TRAY_RULES=Pravila
+IDS_TRAY_BLOCKLIST_RULES=Blok lista
+IDS_TRAY_SYSTEM_RULES=Sistemska pravila
+IDS_TRAY_USER_RULES=Korisnička pravila
+IDS_TRAY_LOGERR=Logovi grešaka
+IDS_ADD_FILE=Dodaj fajl
+IDS_ANY=Bilo šta
+IDS_DISABLENOTIFICATIONS=Onemogući notifikacije
+IDS_OPENRULESEDITOR=Kreiraj pravilo
+IDS_TIMER=Tajmer
+IDS_DISABLETIMER=Onemogući tajmer
+IDS_EXPLORE=Otvori folder
+IDS_COPY=Kopiraj
+IDS_SELECT_ALL=Izaberi sve
+IDS_CHECK=Omogući izabrano
+IDS_UNCHECK=Onemogući izabrano
+IDS_ADD=Dodaj
+IDS_EDIT2=Uredi
+IDS_DELETE=Obriši
+IDS_EXPORT=Izvezi
+IDS_IMPORT=Uvezi
+IDS_RULE_ALLOWLOOPBACK=Dozvoli povratne konekcije za sve
+IDS_HIGHLIGHT_INVALID=Nevalidno (fajl ne postoji / problem sa filterom)
+IDS_HIGHLIGHT_NETWORK=Aplikacija iz deljene mreže
+IDS_HIGHLIGHT_PICO=Pico aplikacija
+IDS_HIGHLIGHT_SIGNED=Potpisana aplikacija
+IDS_HIGHLIGHT_SILENT=Notifikacije su onemogućene
+IDS_HIGHLIGHT_SPECIAL=Korisnička pravila
+IDS_HIGHLIGHT_SYSTEM=Sistemska aplikacija
+IDS_GROUP_TIMER=Aplikacije za tajmer
+IDS_EDITOR=Urednik pravila
+IDS_NAME=Naziv
+IDS_RULE=Pravilo
+IDS_PORTVERSION=Porodica (samo za portove)
+IDS_PROTOCOL=Protokol
+IDS_DIRECTION=Smer
+IDS_ACTION=Akcija
+IDS_DATE=Datum
+IDS_FILEPATH=Putanja
+IDS_SIGNATURE=Potpis
+IDS_ADDRESS=Adresa
+IDS_FILTER=Filter
+IDS_NOTES=Napomene
+IDS_ADDED=Dodato
+IDS_TIMELEFT=Preostalo vreme
+IDS_SIGN_SIGNED=Potpisano
+IDS_SIGN_UNSIGNED=Nije potpisano
+IDS_GROUP_ALLOWED=Aplikacije sa pristupom internetu
+IDS_GROUP_BLOCKED=Aplikacije bez pristupa internetu
+IDS_GROUP_ENABLED=Omogućena pravila
+IDS_GROUP_DISABLED=Onemogućena pravila
+IDS_DIRECTION_1=Odlazno
+IDS_DIRECTION_2=Dolazno
+IDS_DIRECTION_3=Oba
+IDS_ACTION_ALLOW=Dozvoli
+IDS_ACTION_BLOCK=Blokiraj
+IDS_ENABLE_CHK=Omogući pravilo
+IDS_WIKI=Pomoć
+IDS_SAVE=Sačuvaj
+IDS_CLOSE=Zatvori
+IDS_SETTINGS_GENERAL=Opšte
+IDS_TITLE_GENERAL=Opšta konfiguracija
+IDS_TITLE_LANGUAGE=Jezik
+IDS_TITLE_CONFIRMATIONS=Potvrde
+IDS_TITLE_INTERFACE=Interfejs
+IDS_TITLE_HIGHLIGHTING=Isticanje
+IDS_TITLE_LOGGING=Logovi paketa
+IDS_TITLE_NOTIFICATIONS=Notifikacije
+IDS_TITLE_ADVANCED=Napredno
+IDS_ALWAYSONTOP_CHK=Uvek na vrhu
+IDS_LOADONSTARTUP_CHK=Učitavanje prilikom pokretanja sistema
+IDS_STARTMINIMIZED_CHK=Pokreni smanjeno
+IDS_SHOWFILENAMESONLY_CHK=Prikaži samo imena fajlova
+IDS_AUTOSIZECOLUMNS_CHK=Prilagodi veličinu kolona
+IDS_SKIPUACWARNING_CHK=Preskoči "Kontrolu korisničkog naloga"
+IDS_CHECKUPDATES_CHK=Povremeno proveravajte ažuriranja (preporuka)
+IDS_LANGUAGE_HINT=Izaberite jezik:
+IDS_USESTEALTHMODE_CHK=Spreči skeniranje portova
+IDS_USESTEALTHMODE_HINT=Sprečavanje skeniranja TCP porta tihim puštanjem dolaznog TCP RST-a i UDP skeniranja odgovorom na odlazni ICMP sa "Destination Unreachable".
+IDS_INSTALLBOOTTIMEFILTERS_CHK=Omogući filtere za pokretanje sistema
+IDS_INSTALLBOOTTIMEFILTERS_HINT=Sprečavanje curenja podataka pre pokretanja sistema, čak i pre pokretanja "Base Filtering Engine" (BFE).
+IDS_USECERTIFICATES_CHK=Provera digitalnih potpisa aplikacije
+IDS_USENETWORKRESOLUTION_CHK=Reši mrežne adrese
+IDS_DISABLEWINDOWSFIREWALL_CHK=Onemogući Windows Firewall
+IDS_ENABLEWINDOWSFIREWALL_CHK=Omogući Windows Firewall
+IDS_CONFIRMEXIT_CHK=Potvrda zatvaranja aplikacije
+IDS_CONFIRMEXITTIMER_CHK=Potvrda zatvaranja aplikacije dok su tajmeri aktivni
+IDS_CONFIRMLOGCLEAR_CHK=Potvrda brisanja fajla sa logovima
+IDS_COLORS_HINT=Kliknite dvaput da biste uredili.
+IDS_ENABLELOG_CHK=Omogući logovanje paketa u fajl
+IDS_LOGSHOW=Prikaži logove
+IDS_LOGCLEAR=Obriši logove
+IDS_LOGSIZELIMIT_HINT=Maksimalna veličina: (kB)
+IDS_ENABLENOTIFICATIONS_CHK=Omogući informacije o paketima
+IDS_NOTIFICATIONSOUND_CHK=Omogući zvuk notifikacija
+IDS_NOTIFICATIONTIMEOUT_HINT=Vremenski razmak između sličnih notifikacija (sek.):
+IDS_NOTIFY_TOOLTIP=Postavite korisničko pravilo za dozvolu pristupa adresi i/ili portu za ovu aplikaciju.
+IDS_QUESTION=Da li ste sigurni?
+IDS_QUESTION_DELETE=Ukloni elemement(e)?
+IDS_QUESTION_START=Ovo će aplikacijama zabraniti pristup mreži u skladu sa trenutnom konfiguracijom. Nastavi?
+IDS_QUESTION_STOP=Ovo će svim blokiranim aplikacijama vratiti pristup mreži. Nastavi?
+IDS_QUESTION_EXIT=Instalirani filteri će nastaviti sa radom i kad zatvorite program. Nastavi?
+IDS_QUESTION_TIMER=Aktivirani tajmer(i). Tajmeri rade samo dok radi aplikacija. Izađi?
+IDS_QUESTION_TIMERS=Obriši sve tajmere?
+IDS_QUESTION_FLAG_CHK=Ne pitaj ponovo
+IDS_STATUS_EMPTY=Prazno.
+IDS_STATUS_SYNTAX_ERROR=Pravilo sadrži sintaksnu grešku!
+IDS_ADDRESS_LOCAL=Izvor
+IDS_ADDRESS_REMOTE=Destinacija
+IDS_UPDATE_ERROR=Greška pri povezivanju servera za ažuriranje.
+IDS_UPDATE_DOWNLOAD=Preuzimanje ažuriranja...
+IDS_UPDATE_DONE=Preuzimanje ažuriranja je završeno.
+IDS_GROUP_SPECIAL_APPS=Aplikacije sa korisničkim pravilima
+IDS_RULE_ALLOWLOOPBACK_HINT=Dozvoljava sav povratni saobraćaj.
+IDS_RESET=Resetuj
+IDS_EXCLUDESTEALTH_CHK=konekcije skenera portova
+IDS_EXCLUDEBLOCKLIST_CHK=blok lista
+IDS_UPDATE_INIT=Provera novih izdanja...
+IDS_UPDATE_INSTALL=Dostupno ažuriranje, želite li da ga instalirate?
+IDS_EXCLUDECUSTOM_CHK=korisnička pravila
+IDS_EXCLUDECLASSIFYALLOW_CHK=dozvoljene konekcije
+IDS_STATUS_TIMER_DONE=Tajmer za aplikaciju je istekao
+IDS_ICONSEXTRALARGE=Ogromno
+IDS_STATUS_UNUSED_APPS=Neupotrebljene aplikacije
+IDS_STATUS_TIMER_APPS=Aplikacije sa tajmerom
+IDS_SECUREFILTERS_CHK=Omogući zaštitu instaliranih filtera
+IDS_SECUREFILTERS_HINT=Spreči pristup instaliranim filterima za neautorizovane aplikacije
+IDS_USEREFRESHDEVICES_CHK=Ažuriraj filtere kada su uređaji za čuvanje povezani
+IDS_RULE_ALLOW6TO4=Dozvoli IPv6 preusmeravanje (6to4) za sve
+IDS_RECOMMENDED=preporučeno
+IDS_ICONSISTABLEVIEW=Prikaži kao tabelu
+IDS_ACTION_ALLOW_HINT=Zauvek dozvoli pristup mreži
+IDS_ACTION_BLOCK_HINT=Zauvek zabrani pristup mreži (dok je Sunca)
+IDS_ACTION_LATER_HINT=Ignoriši i pitaj me ponovo
+IDS_RULE_APPLY_2=Primeni "%s" za ovu aplikaciju
+IDS_EDITRULES=Uredi pravila
+IDS_TAB_APPS=Aplikacije
+IDS_TAB_SERVICES=Usluge
+IDS_TAB_PACKAGES=UWP aplikacije
+IDS_TAB_NETWORK=Konekcije
+IDS_STATE=Status
+IDS_STATUS_FILTERS_ACTIVE=Filteri su omogućeni.
+IDS_STATUS_FILTERS_INACTIVE=Filteri su onemogućeni!
+IDS_STATUS_FILTERS_PROCESSING=Primenjivanje filtera
+IDS_HIGHLIGHT_CONNECTION=Poseduje mrežne konekcije
+IDS_SHOWINLIST=Prikaži u listi
+IDS_BLOCKLIST_SPY=Microsoft špijuniranje i telemetrija
+IDS_BLOCKLIST_UPDATE=Microsoft ažuriranje
+IDS_BLOCKLIST_EXTRA=Microsoft aplikacije
+IDS_PORT=Port
+IDS_NOTIFY_TITLE=Hitno obaveštenje o mreži
+IDS_NOTIFY_HEADER=Mrežna konekcija je bila blokirana
+IDS_DISABLE=Onemogući
+IDS_TITLE_SECURITY=Bezbednost
+IDS_LOGVIEWER_HINT=Aplikacija za pregled logova
+IDS_NOTIFICATIONONTRAY_CHK=Prikaži prozor sa notifikacijama na traci
+IDS_NETWORK_CLOSE=Zatvori konekciju
+IDS_RULE_BLOCKOUTBOUND=Blokiraj odlazne konekcije za sve
+IDS_RULE_BLOCKINBOUND=Blokiraj dolazne konekcije za sve
+IDS_VIEW_ICON=Ikonice
+IDS_VIEW_DETAILS=Detalji
+IDS_VIEW_TILE=Polja
+IDS_RULE_HINT=Ako ostavite prazna polja, pravilo će biti primenjeno na sve adrese i portove.
+IDS_RULE_APPS_HINT=Ako nema odabranih aplikacija, pravilo će biti primenjeno na sve aplikacije.
+IDS_STATUS_FILTERS_ACTIVE_TEMP=Filteri su omogućeni do ponovnog pokretanja.
+IDS_INSTALL_PERMANENT=Stalna pravila. Pravila funkcionišu dok ih ne isključite.
+IDS_INSTALL_TEMPORARY=Privremena pravila. Pravila su resetovana nakon ponovnog pokretanja.
+IDS_ENABLEUILOG_CHK=Omogući interfejs za logovanje paketa
+IDS_NOTIFICATIONFULLSCREENSILENTMODE_CHK=Omogući tihi mod dok je aplikacija otvorena na celom ekranu
+IDS_TITLE_TRAY=Ikonica obaveštenja
+IDS_TRAYICONSINGLECLICK_CHK=Jedan klik na ikonicu obaveštenja za otvaranje
+IDS_ENABLE_APP_CHK=Omogući pristup mreži
+IDS_APP_HINT=Nema razloga za postavljanje pravila za aplikaciju sa već dozvoljenim pristupom internetu.
+IDS_HOST=Host
+IDS_CONFIRMALLOW_CHK=Potvrdi kad dozvoljavaš aplikaciju
+IDS_QUESTION_ALLOW=Da li ste sigurni da želite dozvoliti potpuni pristup internetu za ovu aplikaciju?
+IDS_SHOWSEARCHBAR_CHK=Prikaži traku za pretragu
+IDS_LAYER=Sloj
+IDS_RULE_ALLOWWINDOWSUPDATE=Dozvoli ažuriranje Windows-a
+IDS_ACTION_TERMINATE_HINT=Prekini proces
+IDS_PROFILE_TYPE=Tip profila
+IDS_USEAPPMONITOR_CHK=Prati promene aplikacija
+IDS_DISABLEREMOVAL=Onemogući uklanjanje
+IDS_USEHASHES_CHK=Proveri aplikacije za sha-256 heš
+IDS_COMMENT=Komentari
+IDS_USEDARKTHEME=Koristi tamnu temu
+IDS_KEEPUNUSED_CHK=Zadrži neupotrebljene aplikacije
+IDS_UPDATE_NO=Nema dostupnih ažuriranja.
+IDS_UPDATE_YES=Ažuriranje je dostupno, preuzmite i instalirajte?
+IDS_UPDATE_SPEED=Brzina
+IDS_RULE_FOR_ALL=za sve
+IDS_RULE_FOR_APPS=za aplikacije
+IDS_PROFILE_TYPE_PLAIN=Obično
+IDS_PROFILE_TYPE_COMPRESSED=Kompresovano
+IDS_PROFILE_TYPE_ENCRYPTED=Enkriptovano
+IDS_SESSION_ONLY=samo sesija
+IDS_LIMIT_REACHED=Dostignut je limit.
+IDS_INTERNAL_RULE=Interno pravilo
+IDS_LOADING=Učitavanje...
+IDS_DIRECTION_REMOTE=Udaljeno
+IDS_DIRECTION_LOCAL=Lokalno
+IDS_WARNING_UNEXPECTED=Budi oprezan, internet saobraćaj se može neočekivano odvijati putem hosta za usluge/drajvere (svchost.exe/System). Nastavi?
+IDS_WARNING_ME=Ako onemogućiš glavni proces, nećeš moći da koristiš opciju za razrešavanje mrežnih adresa. Nastavi?
+IDS_TOTAL=Ukupno
+IDS_ALLOWIPFORWARDING_CHK=Allow IP forwarding
+IDS_EXCLUDEINBOUND_CHK=dolazni multicast/broadcast
+IDS_CONNECTIONS_ENABLE=Enable connections monitoring
+IDS_CONNECTIONS_SHOWAITCONNECTIONS=Show waiting connections
+IDS_CONNECTIONS_MEASUREUDPTRAFFIC=Measure UDP/QUIC traffic (experimental, restart required)
+IDS_UDP_ACCOUNTING=UDP (including QUIC): ETW bytes since this socket was first monitored.
+IDS_UDP_UNAVAILABLE=UDP measurement unavailable or incomplete. Restart simplewall to retry. Error
+IDS_UDP_PENDING=UDP: no verified measurement yet. Sockets opened before monitoring must be reopened.

bin/i18n/Slovenian.ini

@@ -0,0 +1,240 @@
+; <Slovenian>
+; Andrew Poženel (https://github.com/anderlli0053)
+
+[Slovenian]
+IDS_TITLE_EXCLUDE=Izpusti
+IDS_FILE=Datoteka
+IDS_SETTINGS=Nastavitve
+IDS_EXIT=Izhod
+IDS_EDIT=Uredi
+IDS_PURGE_UNUSED=Počisti neuporabljene aplikacije
+IDS_PURGE_TIMERS=Počisti časovnike
+IDS_FIND=Išči
+IDS_REFRESH=Osveži
+IDS_VIEW=Pogled
+IDS_ICONS=Ikone
+IDS_ICONSSMALL=Majhne
+IDS_ICONSLARGE=Velike
+IDS_ICONSISHIDDEN=Ne nalagaj ikon
+IDS_LANGUAGE=Jezik
+IDS_FONT=Pisava
+IDS_HELP=Pomoč
+IDS_WEBSITE=Spletna stran
+IDS_CHECKUPDATES=Preglej posodobitve
+IDS_DONATE=Podpri!
+IDS_ABOUT=O programu
+IDS_TRAY_SHOW=Pokaži/Skrij
+IDS_TRAY_START=Omogoči filtre
+IDS_TRAY_STOP=Onemogoči filtre
+IDS_TRAY_RULES=Pravila
+IDS_TRAY_BLOCKLIST_RULES=Seznam blokiranih
+IDS_TRAY_SYSTEM_RULES=Sistemska pravila
+IDS_TRAY_USER_RULES=Uporabniška pravila
+IDS_TRAY_LOGERR=Dnevnik napak
+IDS_ADD_FILE=Dodaj aplikacijo
+IDS_ANY=Katerikoli
+IDS_DISABLENOTIFICATIONS=Onemogoči obvestila
+IDS_OPENRULESEDITOR=Ustvari pravilo
+IDS_TIMER=Časovnik
+IDS_DISABLETIMER=Onemogoči časovnik
+IDS_EXPLORE=Odpri mapo
+IDS_COPY=Kopiraj
+IDS_SELECT_ALL=Izberi vse
+IDS_CHECK=Omogoči izbrano
+IDS_UNCHECK=Onemogoči izbrano
+IDS_ADD=Dodaj
+IDS_EDIT2=Uredi
+IDS_DELETE=Izbriši
+IDS_EXPORT=Izvoz
+IDS_IMPORT=Uvoz
+IDS_RULE_ALLOWLOOPBACK=Dovoli povratne povezave za vse
+IDS_HIGHLIGHT_INVALID=Neveljavno (datoteka ni najdena ali težava s filtrom)
+IDS_HIGHLIGHT_NETWORK=Aplikacija v omrežju
+IDS_HIGHLIGHT_PICO=Pico aplikacija
+IDS_HIGHLIGHT_SIGNED=Podpisana aplikacija
+IDS_HIGHLIGHT_SILENT=Onemogočena obvestila
+IDS_HIGHLIGHT_SPECIAL=Uporabniška pravila
+IDS_HIGHLIGHT_SYSTEM=Sistemska aplikacija
+IDS_GROUP_TIMER=Aplikacije s časovnikom
+IDS_EDITOR=Urejevalnik pravil
+IDS_NAME=Ime
+IDS_RULE=Pravilo
+IDS_PORTVERSION=Družina (samo vrata)
+IDS_PROTOCOL=Protokol
+IDS_DIRECTION=Smer
+IDS_ACTION=Dejanje
+IDS_DATE=Datum
+IDS_FILEPATH=Pot
+IDS_SIGNATURE=Podpis
+IDS_ADDRESS=Naslov
+IDS_FILTER=Filter
+IDS_NOTES=Opombe
+IDS_ADDED=Dodano
+IDS_TIMELEFT=Preostali čas
+IDS_SIGN_SIGNED=Podpisano
+IDS_SIGN_UNSIGNED=Nepodpisano
+IDS_GROUP_ALLOWED=Aplikacije z internetnim dostopom
+IDS_GROUP_BLOCKED=Aplikacije brez internetnega dostopa
+IDS_GROUP_ENABLED=Omogočena pravila
+IDS_GROUP_DISABLED=Onemogočena pravila
+IDS_DIRECTION_1=Odhodno
+IDS_DIRECTION_2=Vhodno
+IDS_DIRECTION_3=Obojestransko
+IDS_ACTION_ALLOW=Dovoli
+IDS_ACTION_BLOCK=Blokiraj
+IDS_ENABLE_CHK=Omogoči pravilo
+IDS_WIKI=Pomoč
+IDS_SAVE=Shrani
+IDS_CLOSE=Zapri
+IDS_SETTINGS_GENERAL=Splošno
+IDS_TITLE_GENERAL=Splošna konfiguracija
+IDS_TITLE_LANGUAGE=Jezik
+IDS_TITLE_CONFIRMATIONS=Potrditve
+IDS_TITLE_INTERFACE=Vmesnik
+IDS_TITLE_HIGHLIGHTING=Označevanje
+IDS_TITLE_LOGGING=Dnevnik paketov
+IDS_TITLE_NOTIFICATIONS=Obvestila
+IDS_TITLE_ADVANCED=Napredno
+IDS_ALWAYSONTOP_CHK=Vedno na vrhu
+IDS_LOADONSTARTUP_CHK=Naloži ob zagonu sistema
+IDS_STARTMINIMIZED_CHK=Zaženi pomanjšano
+IDS_SHOWFILENAMESONLY_CHK=Prikaži samo imena datotek
+IDS_AUTOSIZECOLUMNS_CHK=Samodejno prilagodi stolpce
+IDS_SKIPUACWARNING_CHK=Preskoči opozorilo "Nadzor uporabniških računov"
+IDS_CHECKUPDATES_CHK=Periodično preverjaj posodobitve (priporočeno)
+IDS_LANGUAGE_HINT=Izberi jezik:
+IDS_USESTEALTHMODE_CHK=Prepreči skeniranje vrat
+IDS_USESTEALTHMODE_HINT=Prepreči skeniranje TCP vrat s tihim zavračanjem vhodnih TCP RST paketov in skeniranje UDP vrat z odgovorom "Cilj ni dosegljiv" na odhodne ICMP pakete.
+IDS_INSTALLBOOTTIMEFILTERS_CHK=Omogoči filtre ob zagonu
+IDS_INSTALLBOOTTIMEFILTERS_HINT=Prepreči uhajanje podatkov med zagonom sistema, še preden se začne servis "Base Filtering Engine" (BFE).
+IDS_USECERTIFICATES_CHK=Preveri aplikacije za digitalne podpise
+IDS_USENETWORKRESOLUTION_CHK=Razreši omrežne naslove
+IDS_DISABLEWINDOWSFIREWALL_CHK=Onemogoči požarni zid Windows
+IDS_ENABLEWINDOWSFIREWALL_CHK=Omogoči požarni zid Windows
+IDS_CONFIRMEXIT_CHK=Prikaži potrditveno okno ob izhodu
+IDS_CONFIRMEXITTIMER_CHK=Prikaži potrditveno okno ob izhodu, ko so časovniki aktivni
+IDS_CONFIRMLOGCLEAR_CHK=Potrdi pri brisanju dnevnika
+IDS_COLORS_HINT=Dvokliknite na element za spremembo.
+IDS_ENABLELOG_CHK=Omogoči beleženje paketov v datoteko
+IDS_LOGSHOW=Prikaži dnevnik
+IDS_LOGCLEAR=Izbriši dnevnik
+IDS_LOGSIZELIMIT_HINT=Največja velikost dnevnika: (kB)
+IDS_ENABLENOTIFICATIONS_CHK=Omogoči obvestila o paketih
+IDS_NOTIFICATIONSOUND_CHK=Omogoči zvok obvestil
+IDS_NOTIFICATIONTIMEOUT_HINT=Zakasnitev med podobnimi obvestili (sek.):
+IDS_NOTIFY_TOOLTIP=Nastavi uporabniško pravilo za dovoljenje dostopa do naslova in/ali vrat za to aplikacijo.
+IDS_QUESTION=Ste prepričani?
+IDS_QUESTION_DELETE=Izbrišem izbrane elemente?
+IDS_QUESTION_START=S tem boste onemogočili omrežni dostop aplikacijam glede na trenutno konfiguracijo. Nadaljujem?
+IDS_QUESTION_STOP=S tem boste povrnili omrežni dostop vsem trenutno blokiranim aplikacijam. Nadaljujem?
+IDS_QUESTION_EXIT=Nameščeni filtri bodo še naprej delovali tudi po izhodu iz programa. Nadaljujem?
+IDS_QUESTION_TIMER=Časovnik(i) aktivni. Časovniki bodo delovali le, ko teče aplikacija. Izhod?
+IDS_QUESTION_TIMERS=Izbrišem vse časovnike?
+IDS_QUESTION_FLAG_CHK=Ne vprašaj več
+IDS_STATUS_EMPTY=Prazno.
+IDS_STATUS_SYNTAX_ERROR=Sintaktična napaka v pravilu!
+IDS_ADDRESS_LOCAL=Vir
+IDS_ADDRESS_REMOTE=Cilj
+IDS_UPDATE_ERROR=Napaka pri povezavi s strežnikom za posodobitve.
+IDS_UPDATE_DOWNLOAD=Prenašam posodobitev...
+IDS_UPDATE_DONE=Prenos posodobitve končan.
+IDS_GROUP_SPECIAL_APPS=Aplikacije z uporabniškimi pravili
+IDS_RULE_ALLOWLOOPBACK_HINT=To dovoli ves povratni promet.
+IDS_RESET=Ponastavi
+IDS_EXCLUDESTEALTH_CHK=povezave s skenirnikom vrat
+IDS_EXCLUDEBLOCKLIST_CHK=seznam blokiranih
+IDS_UPDATE_INIT=Preverjam za nove izdaje...
+IDS_UPDATE_INSTALL=Razpoložljiva posodobitev. Želite jo namestiti zdaj?
+IDS_EXCLUDECUSTOM_CHK=uporabniška pravila
+IDS_EXCLUDECLASSIFYALLOW_CHK=dovoljene povezave
+IDS_STATUS_TIMER_DONE=Časovnik za aplikacijo je potekel
+IDS_ICONSEXTRALARGE=Zelo velike
+IDS_STATUS_UNUSED_APPS=Neuporabljene aplikacije
+IDS_STATUS_TIMER_APPS=Aplikacije s časovnikom
+IDS_SECUREFILTERS_CHK=Omogoči zaščito nameščenih filtrov
+IDS_SECUREFILTERS_HINT=Prepreči nepooblaščenim aplikacijam dostop do nameščenih filtrov.
+IDS_USEREFRESHDEVICES_CHK=Osveži filtre ob priklopu (pomnilniških) naprav
+IDS_RULE_ALLOW6TO4=Dovoli IPv6 preusmeritve (6to4) za vse
+IDS_RECOMMENDED=priporočeno
+IDS_ICONSISTABLEVIEW=Prikaži kot tabelo
+IDS_ACTION_ALLOW_HINT=Dovoli omrežni dostop za vedno
+IDS_ACTION_BLOCK_HINT=Blokiraj omrežni dostop za vedno
+IDS_ACTION_LATER_HINT=Prezri in vprašaj me pozneje
+IDS_RULE_APPLY_2=Uveljavi "%s" za to aplikacijo
+IDS_EDITRULES=Uredi pravila
+IDS_TAB_APPS=Aplikacije
+IDS_TAB_SERVICES=Storitve
+IDS_TAB_PACKAGES=UWP aplikacije
+IDS_TAB_NETWORK=Povezave
+IDS_STATE=Stanje
+IDS_STATUS_FILTERS_ACTIVE=Filtri so omogočeni.
+IDS_STATUS_FILTERS_INACTIVE=Filtri so onemogočeni!
+IDS_STATUS_FILTERS_PROCESSING=Uveljavljam filtre
+IDS_HIGHLIGHT_CONNECTION=Imajo omrežne povezave
+IDS_SHOWINLIST=Prikaži na seznamu
+IDS_BLOCKLIST_SPY=Microsoftovo vohunjenje in telemetrija
+IDS_BLOCKLIST_UPDATE=Microsoftove posodobitve
+IDS_BLOCKLIST_EXTRA=Microsoftove aplikacije
+IDS_PORT=Vrata
+IDS_NOTIFY_TITLE=Omrežno opozorilo
+IDS_NOTIFY_HEADER=Omrežna povezava je bila blokirana
+IDS_DISABLE=Onemogoči
+IDS_TITLE_SECURITY=Varnost
+IDS_LOGVIEWER_HINT=Aplikacija za pregled dnevnika
+IDS_NOTIFICATIONONTRAY_CHK=Prikaži obvestilno okno v sistemski vrstici
+IDS_NETWORK_CLOSE=Zapri povezavo
+IDS_RULE_BLOCKOUTBOUND=Blokiraj odhodne povezave za vse
+IDS_RULE_BLOCKINBOUND=Blokiraj vhodne povezave za vse
+IDS_VIEW_ICON=Ikone
+IDS_VIEW_DETAILS=Podrobnosti
+IDS_VIEW_TILE=Ploščice
+IDS_RULE_HINT=Če pustite polja prazna, se bo pravilo uporabilo za katerikoli naslov in vrata.
+IDS_RULE_APPS_HINT=Če ni izbrane aplikacije, se bo pravilo uporabilo za vse aplikacije.
+IDS_STATUS_FILTERS_ACTIVE_TEMP=Filtri so omogočeni do ponovnega zagona.
+IDS_INSTALL_PERMANENT=Trajna pravila. Pravila delujejo, dokler jih ročno ne onemogočite.
+IDS_INSTALL_TEMPORARY=Začasna pravila. Pravila se ponastavijo po naslednjem ponovnem zagonu.
+IDS_ENABLEUILOG_CHK=Omogoči vmesnik za beleženje paketov
+IDS_NOTIFICATIONFULLSCREENSILENTMODE_CHK=Omogoči tihi način, ko je celozaslonska aplikacija v ospredju
+IDS_TITLE_TRAY=Ikona v sistemski vrstici
+IDS_TRAYICONSINGLECLICK_CHK=Enojni klik na ikono v sistemski vrstici za odpiranje
+IDS_ENABLE_APP_CHK=Omogoči omrežni dostop
+IDS_APP_HINT=Ni razloga za nastavitev dovolilnega pravila za aplikacijo, ki že ima omrežni dostop.
+IDS_HOST=Gostitelj
+IDS_CONFIRMALLOW_CHK=Potrdi ob dovoljenju aplikacije
+IDS_QUESTION_ALLOW=Ste prepričani, da želite omogočiti poln internetni dostop za to aplikacijo?
+IDS_SHOWSEARCHBAR_CHK=Prikaži iskalno vrstico
+IDS_LAYER=Plast
+IDS_RULE_ALLOWWINDOWSUPDATE=Dovoli Windows Update
+IDS_ACTION_TERMINATE_HINT=Končaj proces
+IDS_PROFILE_TYPE=Vrsta profila
+IDS_USEAPPMONITOR_CHK=Spremljaj spremembe aplikacij
+IDS_DISABLEREMOVAL=Onemogoči odstranjevanje
+IDS_USEHASHES_CHK=Preveri aplikacije za SHA-256 hash
+IDS_COMMENT=Komentarji
+IDS_USEDARKTHEME=Uporabi temno temo
+IDS_KEEPUNUSED_CHK=Obdrži neuporabljene aplikacije
+IDS_UPDATE_NO=Ni razpoložljivih posodobitev.
+IDS_UPDATE_YES=Razpoložljiva posodobitev. Prenesem in namestim zdaj?
+IDS_UPDATE_SPEED=Hitrost
+IDS_RULE_FOR_ALL=za vse
+IDS_RULE_FOR_APPS=za aplikacije
+IDS_PROFILE_TYPE_PLAIN=Navaden
+IDS_PROFILE_TYPE_COMPRESSED=Stisnjen
+IDS_PROFILE_TYPE_ENCRYPTED=Šifriran
+IDS_SESSION_ONLY=samo za to sejo
+IDS_LIMIT_REACHED=Meja dosežena.
+IDS_INTERNAL_RULE=Notranje pravilo
+IDS_LOADING=Nalaganje...
+IDS_DIRECTION_REMOTE=Oddaljen
+IDS_DIRECTION_LOCAL=Lokalen
+IDS_WARNING_UNEXPECTED=Be careful, through service/driver host (svchost.exe/System) internet traffic can let out through unexpected ways. Continue?
+IDS_WARNING_ME=If you disallow main process, you cannot use resolve network addresses option. Continue?
+IDS_TOTAL=Total
+IDS_ALLOWIPFORWARDING_CHK=Allow IP forwarding
+IDS_EXCLUDEINBOUND_CHK=inbound multicast/broadcast
+IDS_CONNECTIONS_ENABLE=Enable connections monitoring
+IDS_CONNECTIONS_SHOWAITCONNECTIONS=Show waiting connections
+IDS_CONNECTIONS_MEASUREUDPTRAFFIC=Measure UDP/QUIC traffic (experimental, restart required)
+IDS_UDP_ACCOUNTING=UDP (including QUIC): ETW bytes since this socket was first monitored.
+IDS_UDP_UNAVAILABLE=UDP measurement unavailable or incomplete. Restart simplewall to retry. Error
+IDS_UDP_PENDING=UDP: no verified measurement yet. Sockets opened before monitoring must be reopened.

build.bat

@@ -1,6 +1,6 @@
 @echo off
 
 cd ..\builder
-call build simplewall 3.8 simplewall
+call build simplewall 3.9.2 simplewall
 
 pause

build_vc.bat

@@ -2,25 +2,23 @@
 @setlocal enableextensions
 rem @cd /d "%~dp0\..\"
 
-if exist "%ProgramFiles%\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsall.bat" (
-	call "%ProgramFiles%\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsall.bat" amd64_arm64
+rem VS 2026
+
+if exist "%ProgramFiles%\Microsoft Visual Studio\18\Community\VC\Auxiliary\Build\vcvarsall.bat" (
+	call "%ProgramFiles%\Microsoft Visual Studio\18\Community\VC\Auxiliary\Build\vcvarsall.bat" amd64_arm64
 	goto start
 )
 
-if exist "%ProgramFiles%\Microsoft Visual Studio\2022\Professional\VC\Auxiliary\Build\vcvarsall.bat" (
-	call "%ProgramFiles%\Microsoft Visual Studio\2022\Professional\VC\Auxiliary\Build\vcvarsall.bat" amd64_arm64
+if exist "%ProgramFiles%\Microsoft Visual Studio\18\Professional\VC\Auxiliary\Build\vcvarsall.bat" (
+	call "%ProgramFiles%\Microsoft Visual Studio\18\Professional\VC\Auxiliary\Build\vcvarsall.bat" amd64_arm64
 	goto start
 )
 
-echo VS 2022 not found...
+echo VS 2026 was not found...
 
 goto end
 
 :start
-
-msbuild simplewall.sln -property:Configuration=Release -property:Platform=x86 -verbosity:normal
-if %ERRORLEVEL% neq 0 goto end
-
 msbuild simplewall.sln -property:Configuration=Release -property:Platform=x64 -verbosity:normal
 if %ERRORLEVEL% neq 0 goto end
 

simplewall.sln

@@ -1,7 +1,7 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 17
-VisualStudioVersion = 17.6.33712.159
+# Visual Studio Version 18
+VisualStudioVersion = 18.1.11312.151 d18.0
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "simplewall", "simplewall.vcxproj", "{7FB76828-A353-4113-82D7-CD728EED81DF}"
 EndProject
@@ -9,24 +9,18 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|ARM64 = Debug|ARM64
 		Debug|x64 = Debug|x64
-		Debug|x86 = Debug|x86
 		Release|ARM64 = Release|ARM64
 		Release|x64 = Release|x64
-		Release|x86 = Release|x86
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
 		{7FB76828-A353-4113-82D7-CD728EED81DF}.Debug|ARM64.ActiveCfg = Debug|ARM64
 		{7FB76828-A353-4113-82D7-CD728EED81DF}.Debug|ARM64.Build.0 = Debug|ARM64
 		{7FB76828-A353-4113-82D7-CD728EED81DF}.Debug|x64.ActiveCfg = Debug|x64
 		{7FB76828-A353-4113-82D7-CD728EED81DF}.Debug|x64.Build.0 = Debug|x64
-		{7FB76828-A353-4113-82D7-CD728EED81DF}.Debug|x86.ActiveCfg = Debug|Win32
-		{7FB76828-A353-4113-82D7-CD728EED81DF}.Debug|x86.Build.0 = Debug|Win32
 		{7FB76828-A353-4113-82D7-CD728EED81DF}.Release|ARM64.ActiveCfg = Release|ARM64
 		{7FB76828-A353-4113-82D7-CD728EED81DF}.Release|ARM64.Build.0 = Release|ARM64
 		{7FB76828-A353-4113-82D7-CD728EED81DF}.Release|x64.ActiveCfg = Release|x64
 		{7FB76828-A353-4113-82D7-CD728EED81DF}.Release|x64.Build.0 = Release|x64
-		{7FB76828-A353-4113-82D7-CD728EED81DF}.Release|x86.ActiveCfg = Release|Win32
-		{7FB76828-A353-4113-82D7-CD728EED81DF}.Release|x86.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

simplewall.vcxproj

@@ -28,51 +28,50 @@
     </ProjectConfiguration>
   </ItemGroup>
   <PropertyGroup Label="Globals">
-    <VCProjectVersion>16.0</VCProjectVersion>
     <ProjectGuid>{7FB76828-A353-4113-82D7-CD728EED81DF}</ProjectGuid>
     <RootNamespace>simplewall</RootNamespace>
-    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
     <ProjectName>simplewall</ProjectName>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v143</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v145</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v143</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v145</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v143</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v145</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v143</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v145</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
-    <PlatformToolset>v143</PlatformToolset>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v145</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <PlatformToolset>v143</PlatformToolset>
     <WholeProgramOptimization>true</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v145</PlatformToolset>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -154,14 +153,18 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <ControlFlowGuard>Guard</ControlFlowGuard>
       <FunctionLevelLinking>true</FunctionLevelLinking>
-      <PreprocessorDefinitions>_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;APP_UPDATE_PERIOD=2;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>SECURITY_WIN32;MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS;_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <TreatWarningAsError>true</TreatWarningAsError>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <MultiProcessorCompilation>true</MultiProcessorCompilation>
       <LanguageStandard>stdcpplatest</LanguageStandard>
-      <LanguageStandard_C>stdc17</LanguageStandard_C>
+      <LanguageStandard_C>stdclatest</LanguageStandard_C>
       <SDLCheck>true</SDLCheck>
       <GuardEHContMetadata>true</GuardEHContMetadata>
+      <UseStandardPreprocessor>true</UseStandardPreprocessor>
+      <ConformanceMode>true</ConformanceMode>
+      <OmitFramePointers>true</OmitFramePointers>
+      <InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
     </ClCompile>
     <Link>
       <GenerateDebugInformation>true</GenerateDebugInformation>
@@ -170,7 +173,6 @@
       <SubSystem>Windows</SubSystem>
       <AdditionalOptions>/DEPENDENTLOADFLAG:0x800 /BREPRO %(AdditionalOptions)</AdditionalOptions>
       <DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
-      <MinimumRequiredVersion>6.3</MinimumRequiredVersion>
       <LargeAddressAware>true</LargeAddressAware>
     </Link>
     <ResourceCompile>
@@ -185,23 +187,26 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <ControlFlowGuard>Guard</ControlFlowGuard>
       <FunctionLevelLinking>true</FunctionLevelLinking>
-      <PreprocessorDefinitions>_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;APP_UPDATE_PERIOD=2;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>SECURITY_WIN32;MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS;;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <TreatWarningAsError>true</TreatWarningAsError>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <MultiProcessorCompilation>true</MultiProcessorCompilation>
       <LanguageStandard>stdcpplatest</LanguageStandard>
-      <LanguageStandard_C>stdc17</LanguageStandard_C>
+      <LanguageStandard_C>stdclatest</LanguageStandard_C>
       <CallingConvention>StdCall</CallingConvention>
-      <IntelJCCErratum>true</IntelJCCErratum>
       <SDLCheck>true</SDLCheck>
-      <EnableEnhancedInstructionSet>StreamingSIMDExtensions</EnableEnhancedInstructionSet>
+      <EnableEnhancedInstructionSet>StreamingSIMDExtensions2</EnableEnhancedInstructionSet>
+      <UseStandardPreprocessor>true</UseStandardPreprocessor>
+      <ConformanceMode>true</ConformanceMode>
+      <OmitFramePointers>true</OmitFramePointers>
+      <InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
     </ClCompile>
     <Link>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OptimizeReferences>true</OptimizeReferences>
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <SubSystem>Windows</SubSystem>
-      <MinimumRequiredVersion>6.3</MinimumRequiredVersion>
+      <MinimumRequiredVersion>6.1</MinimumRequiredVersion>
       <AdditionalOptions>/DEPENDENTLOADFLAG:0x800 /BREPRO %(AdditionalOptions)</AdditionalOptions>
       <CETCompat>true</CETCompat>
       <DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
@@ -219,16 +224,20 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <ControlFlowGuard>Guard</ControlFlowGuard>
       <FunctionLevelLinking>true</FunctionLevelLinking>
-      <PreprocessorDefinitions>_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;APP_UPDATE_PERIOD=2;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>SECURITY_WIN32;MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS;_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <TreatWarningAsError>true</TreatWarningAsError>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <MultiProcessorCompilation>true</MultiProcessorCompilation>
       <LanguageStandard>stdcpplatest</LanguageStandard>
-      <LanguageStandard_C>stdc17</LanguageStandard_C>
+      <LanguageStandard_C>stdclatest</LanguageStandard_C>
       <CallingConvention>StdCall</CallingConvention>
-      <IntelJCCErratum>true</IntelJCCErratum>
       <SDLCheck>true</SDLCheck>
       <GuardEHContMetadata>true</GuardEHContMetadata>
+      <EnableEnhancedInstructionSet>StreamingSIMDExtensions2</EnableEnhancedInstructionSet>
+      <UseStandardPreprocessor>true</UseStandardPreprocessor>
+      <ConformanceMode>true</ConformanceMode>
+      <OmitFramePointers>true</OmitFramePointers>
+      <InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
     </ClCompile>
     <Link>
       <GenerateDebugInformation>true</GenerateDebugInformation>
@@ -236,7 +245,7 @@
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <SubSystem>Windows</SubSystem>
       <AdditionalOptions>/DEPENDENTLOADFLAG:0x800 /BREPRO %(AdditionalOptions)</AdditionalOptions>
-      <MinimumRequiredVersion>6.3</MinimumRequiredVersion>
+      <MinimumRequiredVersion>6.1</MinimumRequiredVersion>
       <CETCompat>true</CETCompat>
       <DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
       <LargeAddressAware>true</LargeAddressAware>
@@ -255,15 +264,18 @@
       <StringPooling>true</StringPooling>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <PreprocessorDefinitions>_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;APP_UPDATE_PERIOD=2;NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <EnableParallelCodeGeneration>
-      </EnableParallelCodeGeneration>
+      <PreprocessorDefinitions>SECURITY_WIN32;MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS;_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <TreatWarningAsError>true</TreatWarningAsError>
       <MultiProcessorCompilation>true</MultiProcessorCompilation>
       <LanguageStandard>stdcpplatest</LanguageStandard>
-      <LanguageStandard_C>stdc17</LanguageStandard_C>
+      <LanguageStandard_C>stdclatest</LanguageStandard_C>
       <SDLCheck>true</SDLCheck>
       <GuardEHContMetadata>true</GuardEHContMetadata>
+      <UseStandardPreprocessor>true</UseStandardPreprocessor>
+      <ConformanceMode>true</ConformanceMode>
+      <OmitFramePointers>true</OmitFramePointers>
+      <InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
+      <FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <GenerateDebugInformation>true</GenerateDebugInformation>
@@ -274,7 +286,6 @@
       <AdditionalOptions>/DEPENDENTLOADFLAG:0x800 /BREPRO %(AdditionalOptions)</AdditionalOptions>
       <LinkTimeCodeGeneration>UseLinkTimeCodeGeneration</LinkTimeCodeGeneration>
       <DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
-      <MinimumRequiredVersion>6.3</MinimumRequiredVersion>
       <LargeAddressAware>true</LargeAddressAware>
     </Link>
     <ResourceCompile>
@@ -291,17 +302,19 @@
       <StringPooling>true</StringPooling>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <PreprocessorDefinitions>_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;APP_UPDATE_PERIOD=2;NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <EnableParallelCodeGeneration>
-      </EnableParallelCodeGeneration>
+      <PreprocessorDefinitions>SECURITY_WIN32;MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS;_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <TreatWarningAsError>true</TreatWarningAsError>
       <MultiProcessorCompilation>true</MultiProcessorCompilation>
       <LanguageStandard>stdcpplatest</LanguageStandard>
-      <LanguageStandard_C>stdc17</LanguageStandard_C>
+      <LanguageStandard_C>stdclatest</LanguageStandard_C>
       <CallingConvention>StdCall</CallingConvention>
-      <IntelJCCErratum>true</IntelJCCErratum>
       <SDLCheck>true</SDLCheck>
-      <EnableEnhancedInstructionSet>StreamingSIMDExtensions</EnableEnhancedInstructionSet>
+      <EnableEnhancedInstructionSet>StreamingSIMDExtensions2</EnableEnhancedInstructionSet>
+      <UseStandardPreprocessor>true</UseStandardPreprocessor>
+      <ConformanceMode>true</ConformanceMode>
+      <OmitFramePointers>true</OmitFramePointers>
+      <InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
+      <FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <GenerateDebugInformation>true</GenerateDebugInformation>
@@ -309,7 +322,7 @@
       <OptimizeReferences>true</OptimizeReferences>
       <SetChecksum>true</SetChecksum>
       <SubSystem>Windows</SubSystem>
-      <MinimumRequiredVersion>6.3</MinimumRequiredVersion>
+      <MinimumRequiredVersion>6.1</MinimumRequiredVersion>
       <AdditionalOptions>/DEPENDENTLOADFLAG:0x800 /BREPRO %(AdditionalOptions)</AdditionalOptions>
       <CETCompat>true</CETCompat>
       <LinkTimeCodeGeneration>UseLinkTimeCodeGeneration</LinkTimeCodeGeneration>
@@ -330,17 +343,20 @@
       <StringPooling>true</StringPooling>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
-      <PreprocessorDefinitions>_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;APP_UPDATE_PERIOD=2;NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
-      <EnableParallelCodeGeneration>
-      </EnableParallelCodeGeneration>
+      <PreprocessorDefinitions>SECURITY_WIN32;MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS;_UNICODE;UNICODE;WIN32_LEAN_AND_MEAN;APP_NO_GUEST;APP_HAVE_AUTORUN;APP_HAVE_SKIPUAC;APP_HAVE_TRAY;APP_HAVE_SETTINGS;APP_HAVE_UPDATES;NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <TreatWarningAsError>true</TreatWarningAsError>
       <MultiProcessorCompilation>true</MultiProcessorCompilation>
       <LanguageStandard>stdcpplatest</LanguageStandard>
-      <LanguageStandard_C>stdc17</LanguageStandard_C>
+      <LanguageStandard_C>stdclatest</LanguageStandard_C>
       <CallingConvention>StdCall</CallingConvention>
-      <IntelJCCErratum>true</IntelJCCErratum>
       <SDLCheck>true</SDLCheck>
       <GuardEHContMetadata>true</GuardEHContMetadata>
+      <EnableEnhancedInstructionSet>StreamingSIMDExtensions2</EnableEnhancedInstructionSet>
+      <UseStandardPreprocessor>true</UseStandardPreprocessor>
+      <ConformanceMode>true</ConformanceMode>
+      <OmitFramePointers>true</OmitFramePointers>
+      <InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
+      <FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <GenerateDebugInformation>true</GenerateDebugInformation>
@@ -349,7 +365,7 @@
       <SetChecksum>true</SetChecksum>
       <SubSystem>Windows</SubSystem>
       <AdditionalOptions>/DEPENDENTLOADFLAG:0x800 /BREPRO %(AdditionalOptions)</AdditionalOptions>
-      <MinimumRequiredVersion>6.3</MinimumRequiredVersion>
+      <MinimumRequiredVersion>6.1</MinimumRequiredVersion>
       <CETCompat>true</CETCompat>
       <LinkTimeCodeGeneration>UseLinkTimeCodeGeneration</LinkTimeCodeGeneration>
       <DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
@@ -377,6 +393,7 @@
     <ClCompile Include="src\search.c" />
     <ClCompile Include="src\security.c" />
     <ClCompile Include="src\timer.c" />
+    <ClCompile Include="src\udpstats.c" />
     <ClCompile Include="src\uwp.cpp" />
     <ClCompile Include="src\wfp.c" />
     <ClCompile Include="src\messages.c" />
@@ -406,6 +423,7 @@
     <ClInclude Include="src\search.h" />
     <ClInclude Include="src\security.h" />
     <ClInclude Include="src\timer.h" />
+    <ClInclude Include="src\udpstats.h" />
     <ClInclude Include="src\uwp.h" />
     <ClInclude Include="src\wfp.h" />
     <ClInclude Include="src\messages.h" />

simplewall.vcxproj.filters

@@ -75,6 +75,9 @@
     <ClCompile Include="src\uwp.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="src\udpstats.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="src\main.h">
@@ -158,6 +161,9 @@
     <ClInclude Include="src\uwp.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="src\udpstats.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
   </ItemGroup>
   <ItemGroup>
     <ResourceCompile Include="src\resource.rc">

src/app.h

@@ -1,11 +1,13 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
 #define APP_NAME L"simplewall"
 #define APP_NAME_SHORT L"simplewall"
-#define APP_VERSION L"3.8"
-#define APP_VERSION_RES 3,8,0,0
+#define APP_VERSION L"3.9.2"
+#define APP_VERSION_RES 3,9,2,0
 #define APP_AUTHOR L"Henry++"
-#define APP_COPYRIGHT L"(c) 2016-2024 " APP_AUTHOR L". All Rights Reversed."
+#define APP_COPYRIGHT L"(c) 2016-2026 " APP_AUTHOR L". All Rights Reversed."
+
+#define APP_BETA

src/controls.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -9,15 +9,15 @@ _Ret_maybenull_
 PR_STRING _app_gettooltipbylparam (
 	_In_ HWND hwnd,
 	_In_ INT listview_id,
-	_In_ ULONG_PTR lparam
+	_In_ LONG_PTR lparam
 );
 
-VOID _app_settab_id (
+BOOLEAN _app_settab_id (
 	_In_ HWND hwnd,
 	_In_ INT page_id
 );
 
-LPWSTR _app_getstateaction (
+LPCWSTR _app_getstateaction (
 	_In_ ENUM_INSTALL_TYPE install_type
 );
 
@@ -25,7 +25,7 @@ HBITMAP _app_getstatebitmap (
 	_In_ ENUM_INSTALL_TYPE install_type
 );
 
-INT _app_getstateicon (
+LONG _app_getstateicon (
 	_In_ ENUM_INSTALL_TYPE install_type
 );
 
@@ -34,12 +34,12 @@ LPCWSTR _app_getstatelocale (
 );
 
 BOOLEAN _app_initinterfacestate (
-	_In_ HWND hwnd,
+	_In_opt_ HWND hwnd,
 	_In_ BOOLEAN is_forced
 );
 
 VOID _app_restoreinterfacestate (
-	_In_ HWND hwnd,
+	_In_opt_ HWND hwnd,
 	_In_ BOOLEAN is_enabled
 );
 
@@ -60,7 +60,7 @@ VOID _app_imagelist_init (
 
 HFONT _app_createfont (
 	_Inout_ PLOGFONT logfont,
-	_In_ LONG size,
+	_In_opt_ LONG size,
 	_In_ BOOLEAN is_underline,
 	_In_ LONG dpi_value
 );

src/db.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2019-2024 Henry++
+// Copyright (c) 2019-2026 Henry++
 
 #pragma once
 
@@ -21,14 +21,17 @@ typedef enum _ENUM_VERSION_XML
 
 	// v3.7: added hashes support, use encrypted file format and added comments for apps/rules
 	XML_VERSION_5 = 5,
+
+	// v4.0: added file rules support, added correct encryption with password, store path with environment variables, now rules for services and drivers are separated
+	XML_VERSION_6 = 6,
 } ENUM_VERSION_XML;
 
 typedef struct _DB_INFORMATION
 {
 	R_XML_LIBRARY xml_library;
 
-	PR_BYTE hash;
 	PR_BYTE bytes;
+	PR_BYTE hash;
 
 	LONG64 timestamp;
 
@@ -38,18 +41,17 @@ typedef struct _DB_INFORMATION
 
 // Offset	Length	Description
 // ------------------------------------------
-// 0		3		FOURCC string 'swc'
-// 4		1		Body information flag
+// 0		3		FOURCC string 'SWC'
+// 4		1		Body information flag (PROFILE2_ID_PLAIN, PROFILE2_ID_COMPRESSED or PROFILE2_ID_ENCRYPTED)
 // 36		32		SHA256 checksum of the decrypted bytes
-// 68		whole	Body contained specified data
-
+// 68		<body>	Body contained specified data
 static const BYTE profile2_fourcc[] = {
-	0x73, 0x77, 0x63, // 's', 'w', 'c'
+	0x53, 0x57, 0x43, // 'S', 'W', 'C'
 };
 
 #define XML_VERSION_MINIMAL XML_VERSION_3
-#define XML_VERSION_CURRENT XML_VERSION_4
-#define XML_VERSION_MAXIMUM XML_VERSION_5
+#define XML_VERSION_CURRENT XML_VERSION_5
+#define XML_VERSION_MAXIMUM XML_VERSION_6
 
 #define XML_PROFILE_FILE L"profile.xml"
 #define XML_PROFILE_INTERNAL L"profile_internal.xml"
@@ -58,14 +60,15 @@ static const BYTE profile2_fourcc[] = {
 #define PROFILE2_ID_COMPRESSED ((BYTE)(0x31))
 #define PROFILE2_ID_ENCRYPTED ((BYTE)(0x32))
 
-#define PROFILE2_KEY "Gc(j1EptodnKP?{ZT!SlMVip[fJIs&Ci3fOqjATfp@h,q0(]QVaGs5Iht3)/b:Ll"
+#define PROFILE2_KEY_DEPRECATED "Gc(j1EptodnKP?{ZT!SlMVip[fJIs&Ci3fOqjATfp@h,q0(]QVaGs5Iht3)/b:Ll"
 
-#define PROFILE2_FOURCC_LENGTH sizeof (profile2_fourcc) + sizeof (BYTE)
+#define PROFILE2_FOURCC sizeof (profile2_fourcc)
+#define PROFILE2_FOURCC_LENGTH PROFILE2_FOURCC + sizeof (BYTE)
 #define PROFILE2_SHA256_LENGTH 32UL
 #define PROFILE2_HEADER_LENGTH (PROFILE2_FOURCC_LENGTH + PROFILE2_SHA256_LENGTH)
 
-_Success_ (NT_SUCCESS (return))
-NTSTATUS _app_db_initialize (
+_Success_ (SUCCEEDED (return))
+HRESULT _app_db_initialize (
 	_Out_ PDB_INFORMATION db_info,
 	_In_ BOOLEAN is_reader
 );
@@ -82,7 +85,7 @@ NTSTATUS _app_db_encrypt (
 
 _Success_ (NT_SUCCESS (return))
 NTSTATUS _app_db_decrypt (
-	_In_ PR_BYTEREF buffer,
+	_In_ PR_BYTEREF bytes,
 	_Out_ PR_BYTE_PTR out_buffer
 );
 
@@ -103,8 +106,7 @@ NTSTATUS _app_db_ishashvalid (
 _Success_ (NT_SUCCESS (return))
 NTSTATUS _app_db_openfrombuffer (
 	_Inout_ PDB_INFORMATION db_info,
-	_In_ PR_STORAGE buffer,
-	_In_ ENUM_VERSION_XML min_version,
+	_In_ PR_STORAGE storage,
 	_In_ ENUM_TYPE_XML type
 );
 
@@ -112,7 +114,6 @@ _Success_ (NT_SUCCESS (return))
 NTSTATUS _app_db_openfromfile (
 	_Inout_ PDB_INFORMATION db_info,
 	_In_ PR_STRING path,
-	_In_ ENUM_VERSION_XML min_version,
 	_In_ ENUM_TYPE_XML type
 );
 
@@ -133,14 +134,13 @@ NTSTATUS _app_db_generatebody (
 	_In_ BYTE profile_type,
 	_In_ PR_BYTE hash_value,
 	_In_ PR_BYTE buffer,
-	_Outptr_ PR_BYTE_PTR out_buffer
+	_Out_ PR_BYTE_PTR out_buffer
 );
 
 _Success_ (NT_SUCCESS (return))
 NTSTATUS _app_db_decodebuffer (
 	_Inout_ PDB_INFORMATION db_info,
-	_In_ ENUM_TYPE_XML type,
-	_In_ ENUM_VERSION_XML min_version
+	_In_ ENUM_TYPE_XML type
 );
 
 BOOLEAN _app_db_parse (
@@ -199,12 +199,10 @@ PR_STRING _app_db_getdirectionname (
 	_In_ BOOLEAN is_loopback,
 	_In_ BOOLEAN is_localized
 );
-
-_Ret_maybenull_
-PR_STRING _app_db_getprotoname (
+LPCWSTR _app_db_getprotoname (
 	_In_ ULONG proto,
 	_In_ ADDRESS_FAMILY af,
-	_In_ BOOLEAN is_notnull
+	_In_opt_ LPCWSTR default_value
 );
 
 _Ret_maybenull_

src/editor.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -12,8 +12,8 @@ typedef struct _EDITOR_CONTEXT
 
 	union
 	{
-		PITEM_APP ptr_app;
 		PITEM_RULE ptr_rule;
+		PITEM_APP ptr_app;
 	};
 
 	struct
@@ -28,18 +28,21 @@ typedef struct _EDITOR_CONTEXT
 	BOOLEAN is_settorules;
 } EDITOR_CONTEXT, *PEDITOR_CONTEXT;
 
+FORCEINLINE VOID _app_editor_deletewindow (
+	_In_ _Frees_ptr_ _Post_invalid_ PEDITOR_CONTEXT context
+)
+{
+	_r_mem_free (context);
+}
+
 _Ret_maybenull_
 PEDITOR_CONTEXT _app_editor_createwindow (
-	_In_ HWND hwnd,
+	_In_opt_ HWND hwnd,
 	_In_ PVOID lparam,
 	_In_ INT page_id,
 	_In_ BOOLEAN is_settorules
 );
 
-VOID _app_editor_deletewindow (
-	_In_ PEDITOR_CONTEXT context
-);
-
 _Ret_maybenull_
 PEDITOR_CONTEXT _app_editor_getcontext (
 	_In_ HWND hwnd
@@ -54,8 +57,7 @@ VOID _app_editor_addtabitem (
 	_In_ HWND hwnd,
 	_In_ UINT locale_id,
 	_In_ INT dlg_id,
-	_In_ PEDITOR_CONTEXT context,
-	_Inout_ PINT tabs_count
+	_In_ PEDITOR_CONTEXT context
 );
 
 VOID _app_editor_settabtitle (
@@ -73,7 +75,7 @@ PR_STRING _app_editor_getrulesfromlistview (
 VOID _app_editor_setrulestolistview (
 	_In_ HWND hwnd,
 	_In_ INT ctrl_id,
-	_In_ PR_STRING rule
+	_In_opt_ PR_STRING rule
 );
 
 INT_PTR CALLBACK EditorRuleProc (

src/global.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -11,6 +11,7 @@
 #include <windns.h>
 #include <mstcpip.h>
 #include <iphlpapi.h>
+#include <tcpestats.h>
 #include <aclapi.h>
 #include <dbt.h>
 #include <fwpmu.h>
@@ -21,6 +22,8 @@
 #include <softpub.h>
 #include <subauth.h>
 #include <mscat.h>
+#include <evntrace.h>
+#include <evntcons.h>
 
 #include "app.h"
 #include "rapp.h"
@@ -67,34 +70,34 @@ DECLSPEC_SELECTANY R_FREE_LIST listview_free_list = {0};
 // timers array
 DECLSPEC_SELECTANY const LONG64 timer_array[] =
 {
-	2 * 60,
-	5 * 60,
-	10 * 60,
-	30 * 60,
-	1 * 3600,
-	2 * 3600,
-	4 * 3600,
-	6 * 3600,
-	12 * 3600,
-	24 * 3600
+	2LL * 60LL, // 2 min
+	5LL * 60LL, // 5 min
+	10LL * 60LL, // 10 min
+	30LL * 60LL, // 30 min
+	1LL * 3600LL, // 1 hour
+	2LL * 3600LL, // 2 hour
+	4LL * 3600LL, // 4 hour
+	6LL * 3600LL, // 6 hour
+	12LL * 3600LL, // 12 hour
+	24LL * 3600LL // 24 hour
 };
 
 // dropped events callback subscription (win7+)
-#ifndef FWP_DIRECTION_IN
+#if !defined(FWP_DIRECTION_IN)
 #define FWP_DIRECTION_IN 0x00003900L
-#endif
+#endif // !FWP_DIRECTION_IN
 
-#ifndef FWP_DIRECTION_OUT
+#if !defined(FWP_DIRECTION_OUT)
 #define FWP_DIRECTION_OUT 0x00003901L
-#endif
+#endif // !FWP_DIRECTION_OUT
 
-#ifndef FWP_DIRECTION_FORWARD
+#if !defined(FWP_DIRECTION_FORWARD)
 #define FWP_DIRECTION_FORWARD 0x00003902L
-#endif
+#endif // !FWP_DIRECTION_FORWARD
 
-#ifndef FWP_DIRECTION_FORWARD2
+#if !defined(FWP_DIRECTION_FORWARD2)
 #define FWP_DIRECTION_FORWARD2 0x00003903L
-#endif
+#endif // !FWP_DIRECTION_FORWARD2
 
 #define WM_NOTIFICATION (WM_APP + 21)
 
@@ -113,5 +116,6 @@ DECLSPEC_SELECTANY const LONG64 timer_array[] =
 #include "search.h"
 #include "security.h"
 #include "timer.h"
+#include "udpstats.h"
 #include "uwp.h"
 #include "wfp.h"

src/helper.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -36,20 +36,26 @@ VOID NTAPI _app_dereferencenetwork (
 VOID NTAPI _app_dereferencelog (
 	_In_ PVOID entry
 );
+
 VOID NTAPI _app_dereferencerule (
 	_In_ PVOID entry
 );
 
 VOID _app_addcachetable (
 	_Inout_ PR_HASHTABLE hashtable,
-	_In_ ULONG_PTR hash_code,
+	_In_ ULONG hash_code,
 	_In_ PR_QUEUED_LOCK spin_lock,
-	_In_opt_ PR_STRING string
+	_In_opt_ PVOID string
+);
+
+BOOLEAN _app_checkipisnotlocal (
+	_In_ ADDRESS_FAMILY af,
+	_In_ LPCVOID address
 );
 
 BOOLEAN _app_getcachetable (
 	_Inout_ PR_HASHTABLE cache_table,
-	_In_ ULONG_PTR hash_code,
+	_In_ ULONG hash_code,
 	_In_ PR_QUEUED_LOCK spin_lock,
 	_Out_ PR_STRING_PTR string
 );
@@ -69,17 +75,17 @@ PR_STRING _app_formataddress (
 );
 
 PR_STRING _app_formataddress_interlocked (
-	_In_ PVOID volatile *string,
+	_In_ volatile PVOID_PTR string,
 	_In_ ADDRESS_FAMILY af,
 	_In_ LPCVOID address
 );
 
 _Success_ (NT_SUCCESS (return))
 NTSTATUS _app_formatip (
-	_In_ ADDRESS_FAMILY af,
-	_In_ LPCVOID address,
 	_Out_writes_to_ (buffer_length, buffer_length) LPWSTR buffer,
 	_In_ ULONG buffer_length,
+	_In_ ADDRESS_FAMILY af,
+	_In_ LPCVOID address,
 	_In_ BOOLEAN is_checkempty
 );
 
@@ -90,20 +96,20 @@ PR_STRING _app_formatport (
 
 _Ret_maybenull_
 PITEM_APP_INFO _app_getappinfobyhash2 (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 _Success_ (return)
 BOOLEAN _app_getappinfoparam2 (
-	_In_ ULONG_PTR app_hash,
+	_In_ ULONG app_hash,
 	_In_opt_ INT listview_id,
 	_In_ ENUM_INFO_DATA2 info_data,
-	_Out_writes_bytes_all_ (size) PVOID buffer,
-	_In_ ULONG_PTR size
+	_Out_writes_bytes_all_ (length) PVOID buffer,
+	_In_ ULONG_PTR length
 );
 
 BOOLEAN _app_isappsigned (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 BOOLEAN _app_isappvalidbinary (
@@ -121,7 +127,7 @@ PR_STRING _app_getappdisplayname (
 );
 
 _Ret_maybenull_
-PR_STRING _app_getappname (
+PR_STRING _app_getapppath (
 	_In_ PITEM_APP ptr_app
 );
 
@@ -130,40 +136,31 @@ VOID _app_getfileicon (
 );
 
 VOID _app_getfilesignatureinfo (
-	_In_ HANDLE hfile,
-	_Inout_ PITEM_APP_INFO ptr_app_info
+	_Inout_ PITEM_APP_INFO ptr_app_info,
+	_In_ HANDLE hfile
 );
 
 VOID _app_getfileversioninfo (
 	_Inout_ PITEM_APP_INFO ptr_app_info
 );
 
+_Ret_maybenull_
 PR_STRING _app_getfilehashinfo (
 	_In_ HANDLE hfile,
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
-ULONG_PTR _app_addcolor (
-	_In_ UINT locale_id,
+ULONG _app_addcolor (
+	_In_ ULONG locale_id,
 	_In_ LPCWSTR config_name,
-	_In_ BOOLEAN is_enabled,
 	_In_ LPCWSTR config_value,
-	_In_ COLORREF default_clr
+	_In_ COLORREF default_clr,
+	_In_ BOOLEAN is_enabled
 );
 
+_Success_ (return != 0)
 COLORREF _app_getcolorvalue (
-	_In_ ULONG_PTR color_hash
-);
-
-VOID _app_generate_rulescontrol (
-	_In_ HMENU hsubmenu,
-	_In_ ULONG_PTR app_hash,
-	_In_opt_ PITEM_LOG ptr_log
-);
-
-VOID _app_generate_timerscontrol (
-	_In_ HMENU hsubmenu,
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG color_hash
 );
 
 BOOLEAN _app_setruletoapp (
@@ -176,19 +173,13 @@ BOOLEAN _app_setruletoapp (
 
 _Success_ (return)
 BOOLEAN _app_parsenetworkstring (
-	_In_ LPCWSTR network_string,
+	_In_ PCR_STRINGREF network_string,
 	_Inout_ PITEM_ADDRESS address
 );
 
-_Success_ (return)
-BOOLEAN _app_preparserulestring (
-	_In_ PR_STRINGREF rule,
-	_Out_ PITEM_ADDRESS address
-);
-
 _Success_ (return)
 BOOLEAN _app_parserulestring (
-	_In_opt_ PR_STRINGREF rule,
+	_In_opt_ PCR_STRINGREF rule,
 	_Out_ PITEM_ADDRESS address
 );
 
@@ -199,7 +190,7 @@ PR_STRING _app_resolveaddress (
 );
 
 PR_STRING _app_resolveaddress_interlocked (
-	_In_ PVOID volatile *string,
+	_In_ volatile PVOID_PTR string,
 	_In_ ADDRESS_FAMILY af,
 	_In_ LPCVOID address,
 	_In_ BOOLEAN is_resolutionenabled
@@ -207,13 +198,13 @@ PR_STRING _app_resolveaddress_interlocked (
 
 VOID _app_fileloggingenable ();
 
-NTSTATUS NTAPI _app_timercallback (
+VOID NTAPI _app_timercallback (
 	_In_opt_ PVOID context
 );
 
 VOID _app_getfileinformation (
 	_In_ PR_STRING path,
-	_In_ ULONG_PTR app_hash,
+	_In_ ULONG app_hash,
 	_In_ ENUM_TYPE_DATA type,
 	_In_ INT listview_id
 );
@@ -221,23 +212,20 @@ VOID _app_getfileinformation (
 VOID _app_queue_resolver (
 	_In_ HWND hwnd,
 	_In_ INT listview_id,
-	_In_ ULONG_PTR hash_code,
+	_In_ ULONG hash_code,
 	_In_ PVOID base_address
 );
 
 VOID NTAPI _app_queue_fileinformation (
-	_In_ PVOID arglist,
-	_In_ ULONG busy_count
+	_In_ PVOID arglist
 );
 
 VOID NTAPI _app_queue_notifyinformation (
-	_In_ PVOID arglist,
-	_In_ ULONG busy_count
+	_In_ PVOID arglist
 );
 
 VOID NTAPI _app_queue_resolveinformation (
-	_In_ PVOID arglist,
-	_In_ ULONG busy_count
+	_In_ PVOID arglist
 );
 
 BOOLEAN _app_wufixenabled ();
@@ -252,4 +240,4 @@ VOID _app_wufixhelper (
 VOID _app_wufixenable (
 	_In_ HWND hwnd,
 	_In_ BOOLEAN is_install
-);
+);

src/icons.c

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #include "global.h"
 
@@ -12,38 +12,33 @@ PICON_INFORMATION _app_icons_getdefault ()
 
 	if (_r_initonce_begin (&init_once))
 	{
-		// load default icons
-		path = _r_obj_concatstrings (
-			2,
-			_r_sys_getsystemdirectory ()->buffer,
-			PATH_SVCHOST
-		);
-
-		_app_icons_loadfromfile (path, 0, &icon_info.app_icon_id, &icon_info.app_hicon, FALSE);
-
-		// load default service icons
-		_r_obj_dereference (path);
+		// load default app icon
+		_app_icons_loadfromfile (config.svchost_path, DATA_UNKNOWN, &icon_info.app_icon_id, &icon_info.app_hicon, FALSE);
 
+		// load default service icon
 		path = _r_obj_concatstrings (
 			2,
 			_r_sys_getsystemdirectory ()->buffer,
 			L"\\shell32.dll"
 		);
 
-		_app_icons_loadfromfile (path, 0, &icon_info.service_icon_id, &icon_info.service_hicon, FALSE);
+		_app_icons_loadfromfile (path, DATA_UNKNOWN, &icon_info.service_icon_id, &icon_info.service_hicon, FALSE);
 
 		_r_obj_dereference (path);
 
-		// load uwp icons
-		path = _r_obj_concatstrings (
-			2,
-			_r_sys_getsystemdirectory ()->buffer,
-			L"\\wsreset.exe"
-		);
+		// load default uwp icon
+		if (_r_sys_isosversiongreaterorequal (WINDOWS_8))
+		{
+			path = _r_obj_concatstrings (
+				2,
+				_r_sys_getsystemdirectory ()->buffer,
+				L"\\wsreset.exe"
+			);
 
-		_app_icons_loadfromfile (path, 0, &icon_info.uwp_icon_id, &icon_info.uwp_hicon, FALSE);
+			_app_icons_loadfromfile (path, DATA_UNKNOWN, &icon_info.uwp_icon_id, &icon_info.uwp_hicon, FALSE);
 
-		_r_obj_dereference (path);
+			_r_obj_dereference (path);
+		}
 
 		_r_initonce_end (&init_once);
 	}
@@ -54,14 +49,9 @@ PICON_INFORMATION _app_icons_getdefault ()
 _Ret_maybenull_
 HICON _app_icons_getdefaultapp_hicon ()
 {
-	PICON_INFORMATION icon_info;
+	PICON_INFORMATION icon_info = _app_icons_getdefault ();
 
-	icon_info = _app_icons_getdefault ();
-
-	if (icon_info->app_hicon)
-		return CopyIcon (icon_info->app_hicon);
-
-	return NULL;
+	return icon_info->app_hicon ? CopyIcon (icon_info->app_hicon) : NULL;
 }
 
 _Ret_maybenull_
@@ -70,67 +60,58 @@ HICON _app_icons_getdefaulttype_hicon (
 	_In_ PICON_INFORMATION icon_info
 )
 {
-	if (type == DATA_APP_UWP)
-	{
-		if (icon_info->uwp_hicon)
-			return CopyIcon (icon_info->uwp_hicon);
-	}
-	else if (type == DATA_APP_SERVICE)
+	if (type == DATA_APP_SERVICE)
 	{
 		if (icon_info->service_hicon)
 			return CopyIcon (icon_info->service_hicon);
 	}
+	else if (type == DATA_APP_UWP)
+	{
+		if (icon_info->uwp_hicon)
+			return CopyIcon (icon_info->uwp_hicon);
+	}
 
-	if (icon_info->app_hicon)
-		return CopyIcon (icon_info->app_hicon);
-
-	return NULL;
+	return icon_info->app_hicon ? CopyIcon (icon_info->app_hicon) : NULL;
 }
 
 LONG _app_icons_getdefaultapp_id (
 	_In_ ENUM_TYPE_DATA type
 )
 {
-	PICON_INFORMATION icon_info;
+	PICON_INFORMATION icon_info = _app_icons_getdefault ();
 
-	icon_info = _app_icons_getdefault ();
-
-	if (type == DATA_APP_UWP)
-	{
-		return icon_info->uwp_icon_id;
-	}
-	else if (type == DATA_APP_SERVICE)
+	if (type == DATA_APP_SERVICE)
 	{
 		return icon_info->service_icon_id;
 	}
+	else if (type == DATA_APP_UWP)
+	{
+		return icon_info->uwp_icon_id;
+	}
 
 	return icon_info->app_icon_id;
 }
 
+_Ret_maybenull_
 HICON _app_icons_getsafeapp_hicon (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 )
 {
 	PICON_INFORMATION icon_info;
 	PITEM_APP ptr_app;
 	HICON hicon;
 	LONG icon_id;
-	BOOLEAN is_iconshidded;
 
 	icon_info = _app_icons_getdefault ();
 	ptr_app = _app_getappitem (app_hash);
 
 	if (!ptr_app)
-	{
-		if (icon_info->app_hicon)
-			return CopyIcon (icon_info->app_hicon);
+		return icon_info->app_hicon ? CopyIcon (icon_info->app_hicon) : NULL;
 
+	if (_r_obj_isstringempty (ptr_app->real_path))
 		return NULL;
-	}
 
-	is_iconshidded = _r_config_getboolean (L"IsIconsHidden", FALSE);
-
-	if (is_iconshidded || !_app_isappvalidbinary (ptr_app->real_path))
+	if (_r_config_getboolean (L"IsIconsHidden", FALSE, NULL) || !_app_isappvalidbinary (ptr_app->real_path))
 	{
 		hicon = _app_icons_getdefaulttype_hicon (ptr_app->type, icon_info);
 
@@ -141,7 +122,7 @@ HICON _app_icons_getsafeapp_hicon (
 
 	_app_icons_loadfromfile (ptr_app->real_path, ptr_app->type, &icon_id, &hicon, TRUE);
 
-	if (!icon_id || ((ptr_app->type == DATA_APP_UWP || ptr_app->type == DATA_APP_SERVICE) && icon_id == icon_info->app_icon_id))
+	if (!icon_id || ((ptr_app->type == DATA_APP_SERVICE || ptr_app->type == DATA_APP_UWP) && icon_id == icon_info->app_icon_id))
 	{
 		if (hicon)
 			DestroyIcon (hicon);
@@ -156,46 +137,46 @@ HICON _app_icons_getsafeapp_hicon (
 
 VOID _app_icons_loaddefaults (
 	_In_ ENUM_TYPE_DATA type,
-	_Inout_opt_ PLONG icon_id_ptr,
-	_Inout_opt_ HICON_PTR hicon_ptr
+	_Inout_opt_ HICON_PTR out_hicon,
+	_Inout_opt_ PLONG out_icon_id
 )
 {
 	PICON_INFORMATION icon_info;
 
 	icon_info = _app_icons_getdefault ();
 
-	if (icon_id_ptr)
+	if (out_hicon)
 	{
-		if (*icon_id_ptr == 0 || (type == DATA_APP_UWP && *icon_id_ptr == icon_info->app_icon_id) || (type == DATA_APP_SERVICE && *icon_id_ptr == icon_info->app_icon_id))
-		{
-			if (type == DATA_APP_UWP)
-			{
-				*icon_id_ptr = icon_info->uwp_icon_id;
-			}
-			else if (type == DATA_APP_SERVICE)
-			{
-				*icon_id_ptr = icon_info->service_icon_id;
-			}
-			else
-			{
-				*icon_id_ptr = icon_info->app_icon_id;
-			}
-		}
-	}
-
-	if (hicon_ptr)
-	{
-		if (*hicon_ptr == NULL || type == DATA_APP_UWP)
+		if (*out_hicon == NULL && type == DATA_APP_UWP)
 		{
 			if (type == DATA_APP_UWP)
 			{
 				if (icon_info->uwp_hicon)
-					*hicon_ptr = CopyIcon (icon_info->uwp_hicon);
+					*out_hicon = CopyIcon (icon_info->uwp_hicon);
 			}
 			else
 			{
 				if (icon_info->app_hicon)
-					*hicon_ptr = CopyIcon (icon_info->app_hicon);
+					*out_hicon = CopyIcon (icon_info->app_hicon);
+			}
+		}
+	}
+
+	if (out_icon_id)
+	{
+		if (*out_icon_id == 0 || ((type == DATA_APP_SERVICE && *out_icon_id == icon_info->app_icon_id) || (type == DATA_APP_UWP && *out_icon_id == icon_info->app_icon_id)))
+		{
+			if (type == DATA_APP_SERVICE)
+			{
+				*out_icon_id = icon_info->service_icon_id;
+			}
+			else if (type == DATA_APP_UWP)
+			{
+				*out_icon_id = icon_info->uwp_icon_id;
+			}
+			else
+			{
+				*out_icon_id = icon_info->app_icon_id;
 			}
 		}
 	}
@@ -204,45 +185,23 @@ VOID _app_icons_loaddefaults (
 VOID _app_icons_loadfromfile (
 	_In_opt_ PR_STRING path,
 	_In_ ENUM_TYPE_DATA type,
-	_Out_opt_ PLONG icon_id_ptr,
-	_Out_opt_ HICON_PTR hicon_ptr,
+	_Out_opt_ PLONG out_icon_id,
+	_Out_opt_ HICON_PTR out_hicon,
 	_In_ BOOLEAN is_loaddefaults
 )
 {
-	SHFILEINFO shfi = {0};
-	UINT flags;
+	if (!out_icon_id && !out_hicon)
+		return; // STATUS_INVALID_PARAMETER_MIX
 
-	if (!icon_id_ptr && !hicon_ptr)
-		return;
+	if (out_icon_id)
+		*out_icon_id = 0;
 
-	flags = SHGFI_LARGEICON;
+	if (out_hicon)
+		*out_hicon = NULL;
 
-	if (icon_id_ptr)
-	{
-		flags |= SHGFI_SYSICONINDEX;
-
-		*icon_id_ptr = 0;
-	}
-
-	if (hicon_ptr)
-	{
-		flags |= SHGFI_ICON;
-
-		*hicon_ptr = NULL;
-	}
-
-	if (path)
-	{
-		if (SHGetFileInfoW (path->buffer, 0, &shfi, sizeof (shfi), flags))
-		{
-			if (icon_id_ptr)
-				*icon_id_ptr = shfi.iIcon;
-
-			if (hicon_ptr)
-				*hicon_ptr = shfi.hIcon;
-		}
-	}
+	if (!_r_obj_isstringempty (path))
+		_r_path_geticon (&path->sr, out_hicon, out_icon_id);
 
 	if (is_loaddefaults)
-		_app_icons_loaddefaults (type, icon_id_ptr, hicon_ptr);
+		_app_icons_loaddefaults (type, out_hicon, out_icon_id);
 }

src/icons.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -18,20 +18,21 @@ LONG _app_icons_getdefaultapp_id (
 	_In_ ENUM_TYPE_DATA type
 );
 
+_Ret_maybenull_
 HICON _app_icons_getsafeapp_hicon (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 VOID _app_icons_loaddefaults (
 	_In_ ENUM_TYPE_DATA type,
-	_Inout_opt_ PLONG icon_id_ptr,
-	_Inout_opt_ HICON_PTR hicon_ptr
+	_Inout_opt_ HICON_PTR out_hicon,
+	_Inout_opt_ PLONG out_icon_id
 );
 
 VOID _app_icons_loadfromfile (
 	_In_opt_ PR_STRING path,
 	_In_ ENUM_TYPE_DATA type,
-	_Out_opt_ PLONG icon_id_ptr,
-	_Out_opt_ HICON_PTR hicon_ptr,
+	_Out_opt_ PLONG out_icon_id,
+	_Out_opt_ HICON_PTR out_hicon,
 	_In_ BOOLEAN is_loaddefaults
 );

src/listview.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -25,11 +25,8 @@ typedef struct _ITEM_LISTVIEW_CONTEXT
 #define PR_UPDATE_NOREDRAW 0x0020
 #define PR_UPDATE_NOSETVIEW 0x0040
 
-INT _app_listview_getcurrent (
-	_In_ HWND hwnd
-);
-
-INT _app_listview_getbytab (
+_Ret_maybenull_
+PITEM_TAB_CONTEXT _app_listview_getcontext (
 	_In_ HWND hwnd,
 	_In_ INT tab_id
 );
@@ -43,10 +40,6 @@ VOID _app_listview_additems (
 	_In_ HWND hwnd
 );
 
-VOID _app_listview_clearitems (
-	_In_ HWND hwnd
-);
-
 VOID _app_listview_addappitem (
 	_In_ HWND hwnd,
 	_In_ PITEM_APP ptr_app
@@ -61,12 +54,17 @@ VOID _app_listview_addruleitem (
 
 VOID _app_listview_addnetworkitem (
 	_In_ HWND hwnd,
-	_In_ ULONG_PTR network_hash
+	_In_ ULONG network_hash
 );
 
 VOID _app_listview_addlogitem (
 	_In_ HWND hwnd,
-	_In_ ULONG_PTR log_hash
+	_In_ PITEM_LOG ptr_log,
+	_In_ ULONG log_hash
+);
+
+VOID _app_listview_clearitems (
+	_In_ HWND hwnd
 );
 
 BOOLEAN _app_listview_islocked (
@@ -74,13 +72,17 @@ BOOLEAN _app_listview_islocked (
 	_In_ INT ctrl_id
 );
 
-VOID _app_listview_lock (
+BOOLEAN _app_listview_lock (
 	_In_ HWND hwnd,
-	_In_ INT ctrl_id,
-	_In_ BOOLEAN is_lock
+	_In_ INT ctrl_id
 );
 
-LPARAM _app_listview_createcontext (
+BOOLEAN _app_listview_unlock (
+	_In_ HWND hwnd,
+	_In_ INT ctrl_id
+);
+
+LONG_PTR _app_listview_createcontext (
 	_In_ ULONG_PTR id_code
 );
 
@@ -89,43 +91,40 @@ VOID _app_listview_destroycontext (
 );
 
 ULONG_PTR _app_listview_getcontextcode (
-	_In_ LPARAM lparam
+	_In_ LONG_PTR lparam
 );
 
-ULONG_PTR _app_listview_getappcontext (
+_Success_ (return != 0)
+ULONG _app_listview_getappcontext (
 	_In_ HWND hwnd,
 	_In_ INT listview_id,
 	_In_ INT item_id
 );
 
+_Success_ (return != 0)
 ULONG_PTR _app_listview_getitemcontext (
 	_In_ HWND hwnd,
 	_In_ INT listview_id,
 	_In_ INT item_id
 );
 
+_Success_ (return)
 BOOLEAN _app_listview_isitemhidden (
 	_In_ LPARAM lparam
 );
 
-_Success_ (return != -1)
+_Success_ (return != INT_ERROR)
 INT _app_listview_finditem (
 	_In_ HWND hwnd,
 	_In_ INT listview_id,
 	_In_ ULONG_PTR id_code
 );
 
-VOID _app_listview_removeitem (
-	_In_ HWND hwnd,
-	_In_ ULONG_PTR id_code,
-	_In_ ENUM_TYPE_DATA type
-);
-
 VOID _app_listview_showitemby_id (
 	_In_ HWND hwnd,
 	_In_ INT listview_id,
 	_In_ INT item_id,
-	_In_ INT scroll_pos
+	_In_opt_ LONG scroll_pos
 );
 
 VOID _app_listview_showitemby_param (

src/log.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -21,7 +21,7 @@ typedef ULONG (WINAPI *FWPMNES3)(
 	_Out_ PHANDLE events_handle
 	);
 
-// FwpmNetEventSubscribe2 (win10rs1+)
+// FwpmNetEventSubscribe2 (win10th1+)
 typedef ULONG (WINAPI *FWPMNES2)(
 	_In_ HANDLE engine_handle,
 	_In_ const FWPM_NET_EVENT_SUBSCRIPTION0 *subscription,
@@ -30,6 +30,15 @@ typedef ULONG (WINAPI *FWPMNES2)(
 	_Out_ PHANDLE events_handle
 	);
 
+// FwpmNetEventSubscribe1 (win8+)
+typedef ULONG (WINAPI *FWPMNES1)(
+	_In_ HANDLE engine_handle,
+	_In_ const FWPM_NET_EVENT_SUBSCRIPTION0 *subscription,
+	_In_ FWPM_NET_EVENT_CALLBACK1 callback,
+	_In_opt_ PVOID context,
+	_Out_ PHANDLE events_handle
+	);
+
 VOID _app_loginit (
 	_In_ BOOLEAN is_install
 );
@@ -38,16 +47,18 @@ VOID _app_loginitfile (
 	_In_ HANDLE hfile
 );
 
-ULONG_PTR _app_getloghash (
+ULONG _app_getloghash (
 	_In_ PITEM_LOG ptr_log
 );
 
+_Ret_maybenull_
 PR_STRING _app_getlogpath ();
 
+_Ret_maybenull_
 PR_STRING _app_getlogviewer ();
 
 BOOLEAN _app_islogfound (
-	_In_ ULONG_PTR log_hash
+	_In_ ULONG log_hash
 );
 
 BOOLEAN _app_logislimitreached (
@@ -88,31 +99,36 @@ VOID CALLBACK _wfp_logcallback (
 	_In_ PITEM_LOG_CALLBACK log
 );
 
+// win7+ callback
+VOID CALLBACK _wfp_logcallback0 (
+	_Inout_ PVOID context,
+	_In_ const FWPM_NET_EVENT1* event_data
+);
+
 // win8+ callback
 VOID CALLBACK _wfp_logcallback1 (
-	_In_ PVOID context,
+	_Inout_ PVOID context,
 	_In_ const FWPM_NET_EVENT2* event_data
 );
 
 // win10rs1+ callback
 VOID CALLBACK _wfp_logcallback2 (
-	_In_ PVOID context,
+	_Inout_ PVOID context,
 	_In_ const FWPM_NET_EVENT3* event_data
 );
 
-// win10rs4+ callback
+// win10rs2+ callback
 VOID CALLBACK _wfp_logcallback3 (
-	_In_ PVOID context,
+	_Inout_ PVOID context,
 	_In_ const FWPM_NET_EVENT4* event_data
 );
 
 // win10rs5+ callback
 VOID CALLBACK _wfp_logcallback4 (
-	_In_ PVOID context,
+	_Inout_ PVOID context,
 	_In_ const FWPM_NET_EVENT5* event_data
 );
 
 VOID NTAPI _app_logthread (
-	_In_ PVOID arglist,
-	_In_ ULONG busy_count
+	_In_ PVOID arglist
 );

src/main.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -22,13 +22,11 @@
 #pragma comment(lib, "wintrust.lib")
 
 // log
-#define __FILENAME__ (_r_path_getbasename (TEXT (__FILE__)))
-
-#define DBG_ARG __FILENAME__, __LINE__
+#define DBG_ARG _r_path_getbasename2 (TEXT (__FILE__)), __LINE__
 #define DBG_ARG_VAR file_name, line
 
 // guids
-DEFINE_GUID (GUID_TrayIcon, 0xdab4837e, 0xcb0f, 0x47da, 0x92, 0x22, 0x21, 0x20, 0x74, 0x9f, 0x5c, 0x41);
+DEFINE_GUID (GUID_TrayIcon, 0xDAB4837E, 0xCB0F, 0x47DA, 0x92, 0x22, 0x21, 0x20, 0x74, 0x9F, 0x5C, 0x41);
 
 // enums
 typedef enum _ENUM_TYPE_DATA
@@ -77,13 +75,12 @@ typedef enum _ENUM_INFO_DATA
 
 typedef enum _ENUM_INFO_DATA2
 {
-	INFO_ICON_ID,
+	INFO_ICON_ID = 0,
 	INFO_SIGNATURE_STRING, // dereference required
 	INFO_VERSION_STRING, // dereference required
 } ENUM_INFO_DATA2;
 
-#define LOG_PATH_EXT L"log"
-#define LOG_PATH_DEFAULT L"%USERPROFILE%\\" APP_NAME_SHORT L"." LOG_PATH_EXT
+#define LOG_PATH_DEFAULT L"%USERPROFILE%\\" APP_NAME_SHORT L".csv"
 #define LOG_VIEWER_DEFAULT L"%SystemRoot%\\notepad.exe"
 #define LOG_SIZE_LIMIT_DEFAULT _r_calc_kilobytes2bytes (1)
 
@@ -93,25 +90,17 @@ typedef enum _ENUM_INFO_DATA2
 #define PROC_SYSTEM_PID 4
 #define PROC_SYSTEM_NAME L"System"
 
-#define PATH_NTOSKRNL L"\\ntoskrnl.exe"
 #define PATH_SVCHOST L"\\svchost.exe"
 #define PATH_WUSVC L"\\wusvc.exe"
 
+#define WINDOWSSPYBLOCKER_TITLE L"Author: <a href=\"%s\">WindowsSpyBlocker</a> - block spying and tracking on Windows systems."
 #define WINDOWSSPYBLOCKER_URL L"https://github.com/crazy-max/WindowsSpyBlocker"
 
 #define SZ_TAB L"    "
 #define SZ_CRLF L"\r\n"
 #define SZ_TAB_CRLF SZ_CRLF SZ_TAB
-#define SZ_EMPTY L"<empty>"
 #define SZ_RULE_INTERNAL_MENU L"*"
-#define SZ_RULE_INTERNAL_TITLE L"Internal rule"
-#define SZ_RULE_NEW_TITLE L"<new rule>"
-#define SZ_UNKNOWN L"unknown"
-#define SZ_LOADING L"Loading..."
-#define SZ_MAXTEXT L"Limit reached."
 
-#define SZ_DIRECTION_REMOTE L"Remote"
-#define SZ_DIRECTION_LOCAL L"Local"
 #define SZ_STATE_ALLOW L"Allowed"
 #define SZ_STATE_BLOCK L"Blocked"
 #define SZ_DIRECTION_IN L"Inbound"
@@ -119,17 +108,13 @@ typedef enum _ENUM_INFO_DATA2
 #define SZ_DIRECTION_ANY L"Any"
 #define SZ_DIRECTION_LOOPBACK L"Loopback"
 
-#define SZ_LOG_TITLE L"Date,Username,Path,Address (" SZ_DIRECTION_LOCAL L")," \
-	L"Port (" SZ_DIRECTION_LOCAL L"),Address (" SZ_DIRECTION_REMOTE L"),Port (" SZ_DIRECTION_REMOTE L")," \
+#define SZ_LOG_TITLE L"Date,Username,Path,Address (Local)," \
+	L"Port (Local),Address (Remote),Port (Remote)," \
 	L"Protocol,Layer,Filter name,Filter ID,Direction,State" SZ_CRLF
 
 #define SZ_LOG_BODY L"\"%s\",\"%s\",\"%s\",\"%s\",\"%s\",\"%s\",\"%s\",\"%s\"," \
 	L"\"%s\",\"%s\",\"#%" TEXT (PRIu64) L"\",\"%s\",\"%s\"" SZ_CRLF
 
-#define SZ_WARNING_ME L"If you disallow this, you cannot use resolve network addresses option. Continue?"
-#define SZ_WARNING_SVCHOST L"Be careful, through service host (svchost.exe)" \
-	L"internet traffic can let out through unexpected ways. Continue?"
-
 #define SZ_HELP L"\"simplewall.exe -install\" - enable filtering." SZ_CRLF \
 	L"\"simplewall.exe -install -temp\" - enable filtering until reboot." SZ_CRLF \
 	L"\"simplewall.exe -install -silent\" - enable filtering without prompt." SZ_CRLF \
@@ -142,15 +127,16 @@ typedef enum _ENUM_INFO_DATA2
 #define DIVIDER_RULE_RANGE L'-'
 #define DIVIDER_TRIM SZ_CRLF L" "
 
-#define BACKUP_HOURS_PERIOD _r_calc_hours2seconds (4) // make backup every X hour(s) (default)
+#define BACKUP_HOURS_PERIOD _r_calc_hours2seconds (4) // made backup every X hour(s) (default)
 
-#define LEN_IP_MAX 68
-#define MAP_CACHE_MAX 900 // limit for caching hashtable
+#define LEN_IP_MAX 0x44
+#define MAP_CACHE_MAX 0x0384 // limit for caching hashtable
 
 #define TRANSACTION_TIMEOUT 9000
 
 // ui
 #define ICONS_MENU 6
+#define LANG_SUBMENU 2
 #define LANG_MENU 7
 #define NOTIFICATIONS_ID 4
 #define LOGGING_ID 5
@@ -159,108 +145,151 @@ typedef enum _ENUM_INFO_DATA2
 #define REBAR_TOOLBAR_ID 0
 #define REBAR_SEARCH_ID 1
 
-#define LV_HIDDEN_GROUP_ID 13
+#define LV_HIDDEN_GROUP_ID GENERAL_ID
 
 #define STATUSBAR_PARTS_COUNT 3
 
 // notifications
-#define NOTIFY_TIMER_SAFETY_ID 666
 #define NOTIFY_TIMER_SAFETY_TIMEOUT 900
-
 #define NOTIFY_TIMEOUT_DEFAULT 60 // sec.
-
 #define NOTIFY_SOUND_NAME L"MailBeep"
 
 // default colors
-#define LV_COLOR_INVALID RGB (255, 125, 148)
-#define LV_COLOR_SPECIAL RGB (255, 255, 170)
-#define LV_COLOR_SIGNED RGB (175, 228, 163)
-#define LV_COLOR_PICO RGB (51, 153, 255)
-#define LV_COLOR_SYSTEM RGB(151, 196, 251)
-#define LV_COLOR_CONNECTION RGB(255, 168, 242)
-#define LV_COLOR_UNDELETE RGB(211, 211, 211)
+#define LV_COLOR_INVALID RGB(0xFF, 0x7C, 0x94)
+#define LV_COLOR_SPECIAL RGB(0xFF, 0xFF, 0xAA)
+#define LV_COLOR_SIGNED RGB(0xAE, 0xE4, 0xA2)
+#define LV_COLOR_PICO RGB(0x32, 0x98, 0xFF)
+#define LV_COLOR_SYSTEM RGB(0x96, 0xC4, 0xFA)
+#define LV_COLOR_CONNECTION RGB(0xFF, 0xA8, 0xF2)
+#define LV_COLOR_UNDELETE RGB(0xD4, 0xD4, 0xD4)
 
 // memory limitation for 1 rule
-#define RULE_NAME_CCH_MAX 64
-#define RULE_RULE_CCH_MAX 256
+#define RULE_NAME_CCH_MAX 0x0040 // 64
+#define RULE_RULE_CCH_MAX 0x0400 // 1024
 
 typedef struct _STATIC_DATA
 {
-	WCHAR windows_dir_buffer[256];
 	R_STRINGREF windows_dir;
 
-	PR_STRING search_string;
+	GUID session_key;
 
-	PR_STRING my_path;
+	PR_STRING search_string;
 	PR_STRING ntoskrnl_path;
 	PR_STRING svchost_path;
-	PR_STRING wusvc_path;
 	PR_STRING system_path;
+	PR_STRING wusvc_path;
+	PR_STRING my_path;
+
+	PR_BYTE service_wdiservicehost_sid;
+	PR_BYTE service_policyagent_sid;
+	PR_BYTE service_mpssvc_sid;
+	PR_BYTE service_nlasvc_sid;
+	PR_BYTE service_rpcss_sid;
+
+	HIMAGELIST himg_rules_small;
+	HIMAGELIST himg_rules_large;
+	HIMAGELIST himg_toolbar;
+
+	HBITMAP hbmp_disable;
+	HBITMAP hbmp_enable;
+	HBITMAP hbmp_allow;
+	HBITMAP hbmp_block;
+
+	HANDLE hmonitor_thread;
+	HANDLE hnotify_evt;
+
+	HFONT wnd_font;
+	HFONT hfont;
+
+	HWND hsearchbar;
+	HWND htoolbar;
+	HWND hrebar;
 
 	PSID builtin_current_sid;
 	PSID builtin_netops_sid;
 	PSID builtin_admins_sid;
 
-	PR_BYTE service_mpssvc_sid;
-	PR_BYTE service_nlasvc_sid;
-	PR_BYTE service_policyagent_sid;
-	PR_BYTE service_rpcss_sid;
-	PR_BYTE service_wdiservicehost_sid;
-
-	HIMAGELIST himg_toolbar;
-	HIMAGELIST himg_rules_small;
-	HIMAGELIST himg_rules_large;
-
-	HBITMAP hbmp_enable;
-	HBITMAP hbmp_disable;
-	HBITMAP hbmp_allow;
-	HBITMAP hbmp_block;
-
-	HANDLE hmonitor_thread;
-
-	HANDLE hnotify_evt;
-
-	volatile HANDLE hlogfile;
-	volatile HANDLE hnetevent;
 	volatile HWND hnotification;
-	volatile HICON htray_icon;
+	volatile HANDLE hnetevent;
+	volatile HANDLE hlogfile;
+	volatile LONG log_id;
 
-	HFONT hfont;
-	HFONT wnd_font;
+	ULONG color_nonremovable;
+	ULONG color_network;
+	ULONG color_invalid;
+	ULONG color_special;
+	ULONG color_signed;
+	ULONG color_system;
+	ULONG color_pico;
 
-	HWND hrebar;
-	HWND htoolbar;
-	HWND hsearchbar;
-
-	ULONG_PTR color_invalid;
-	ULONG_PTR color_special;
-	ULONG_PTR color_signed;
-	ULONG_PTR color_pico;
-	ULONG_PTR color_system;
-	ULONG_PTR color_network;
-	ULONG_PTR color_nonremovable;
-
-	ULONG_PTR ntoskrnl_hash;
-	ULONG_PTR svchost_hash;
-	ULONG_PTR wusvc_hash;
-	ULONG_PTR my_hash;
+	ULONG ntoskrnl_hash;
+	ULONG svchost_hash;
+	ULONG wusvc_hash;
+	ULONG my_hash;
 
+	BOOLEAN is_filterstemporary;
+	BOOLEAN is_neteventenabled;
 	BOOLEAN is_notifytimeout;
 	BOOLEAN is_notifymouse;
-	BOOLEAN is_neteventenabled;
 	BOOLEAN is_neteventset;
-	BOOLEAN is_filterstemporary;
 } STATIC_DATA, *PSTATIC_DATA;
 
 typedef struct _PROFILE_DATA
 {
-	PR_STRING profile_path;
-	PR_STRING profile_path_backup;
 	PR_STRING profile_path_internal;
+	PR_STRING profile_path_backup;
+	PR_STRING profile_path;
 
 	LONG64 profile_internal_timestamp;
 } PROFILE_DATA, *PPROFILE_DATA;
 
+typedef struct _ITEM_LOG
+{
+	union
+	{
+		IN6_ADDR remote_addr6;
+		IN_ADDR remote_addr;
+	} DUMMYUNIONNAME;
+
+	union
+	{
+		IN6_ADDR local_addr6;
+		IN_ADDR local_addr;
+	} DUMMYUNIONNAME2;
+
+	PR_STRING protocol_str;
+	PR_STRING filter_name;
+	PR_STRING layer_name;
+	PR_STRING username;
+	PR_STRING path;
+
+	volatile PR_STRING remote_addr_str;
+	volatile PR_STRING local_addr_str;
+	volatile PR_STRING remote_host_str;
+	volatile PR_STRING local_host_str;
+
+	LONG64 timestamp;
+	UINT64 filter_id;
+
+	ULONG app_hash;
+
+	volatile LONG log_id;
+
+	FWP_DIRECTION direction;
+	ADDRESS_FAMILY af;
+
+	UINT16 remote_port;
+	UINT16 local_port;
+	UINT8 protocol;
+
+	BOOLEAN is_myprovider;
+	BOOLEAN is_blocklist;
+	BOOLEAN is_loopback;
+	BOOLEAN is_custom;
+	BOOLEAN is_system;
+	BOOLEAN is_allow;
+} ITEM_LOG, *PITEM_LOG;
+
 typedef struct _ITEM_APP
 {
 	PR_ARRAY guids;
@@ -272,16 +301,16 @@ typedef struct _ITEM_APP
 	PR_STRING comment;
 	PR_STRING hash;
 
-	PVOID notification; // PITEM_LOG
+	PITEM_LOG notification;
 	PR_BYTE bytes; // service - PSECURITY_DESCRIPTOR / uwp - PSID (win8+)
 
 	PTP_TIMER htimer;
 
+	LONG64 last_notify;
 	LONG64 timestamp;
 	LONG64 timer;
-	LONG64 last_notify;
 
-	ULONG_PTR app_hash;
+	ULONG app_hash;
 
 	ENUM_TYPE_DATA type;
 
@@ -289,27 +318,23 @@ typedef struct _ITEM_APP
 
 	struct
 	{
-		ULONG is_enabled : 1;
-		ULONG is_haveerrors : 1;
-		ULONG is_silent : 1;
 		ULONG is_undeletable : 1;
+		ULONG is_haveerrors : 1;
+		ULONG is_enabled : 1;
+		ULONG is_silent : 1;
 		ULONG spare_bits : 28;
 	} DUMMYSTRUCTNAME;
 } ITEM_APP, *PITEM_APP;
 
 typedef struct _ITEM_APP_INFO
 {
-	PR_STRING path;
-
 	PR_STRING signature_info;
 	PR_STRING version_info;
+	PR_STRING path;
 
-	ULONG_PTR app_hash;
-
+	ULONG app_hash;
 	LONG icon_id;
-
 	ENUM_TYPE_DATA type;
-
 	INT listview_id;
 
 	BOOLEAN is_loaded;
@@ -327,21 +352,11 @@ typedef struct _ITEM_RULE
 	PR_HASHTABLE apps;
 	PR_ARRAY guids;
 
-	PR_STRING name;
-	PR_STRING comment;
+	PR_STRING protocol_str;
 	PR_STRING rule_remote;
 	PR_STRING rule_local;
-	PR_STRING protocol_str;
-
-	struct
-	{
-		ULONG is_enabled : 1;
-		ULONG is_haveerrors : 1;
-		ULONG is_forservices : 1;
-		ULONG is_readonly : 1;
-		ULONG is_enabled_default : 1;
-		ULONG spare_bits : 27;
-	} DUMMYSTRUCTNAME;
+	PR_STRING comment;
+	PR_STRING name;
 
 	union
 	{
@@ -355,8 +370,21 @@ typedef struct _ITEM_RULE
 		} DUMMYSTRUCTNAME2;
 	} DUMMYUNIONNAME;
 
+	struct
+	{
+		ULONG is_enabled_default : 1;
+		ULONG is_forservice : 1;
+		ULONG is_fordriver : 1;
+		ULONG is_haveerrors : 1;
+		ULONG is_readonly : 1;
+		ULONG is_enabled : 1;
+		ULONG spare_bits : 26;
+	} DUMMYSTRUCTNAME2;
+
+	ULONG rule_hash;
 	ENUM_TYPE_DATA type;
 	FWP_ACTION_TYPE action;
+
 	UINT8 profile; // reserved ffu!
 	UINT8 weight;
 } ITEM_RULE, *PITEM_RULE;
@@ -383,17 +411,15 @@ typedef struct _ITEM_NETWORK
 		IN6_ADDR local_addr6;
 	} DUMMYUNIONNAME2;
 
-	PR_STRING path;
-
 	volatile PR_STRING local_addr_str;
 	volatile PR_STRING remote_addr_str;
-
 	volatile PR_STRING local_host_str;
 	volatile PR_STRING remote_host_str;
 
 	PR_STRING protocol_str;
+	PR_STRING path;
 
-	ULONG_PTR app_hash;
+	ULONG app_hash;
 	ULONG state;
 
 	FWP_DIRECTION direction;
@@ -402,70 +428,34 @@ typedef struct _ITEM_NETWORK
 
 	UINT16 remote_port;
 	UINT16 local_port;
-
 	UINT8 protocol;
 
+	BOOLEAN is_stats_initialized;
+	BOOLEAN is_stats_enabled;
 	BOOLEAN is_connection;
+
+	volatile LONG64 download_speed;
+	volatile LONG64 upload_speed;
+	volatile LONG64 download_total;
+	volatile LONG64 upload_total;
+
+	ULONG64 last_bytes_in;
+	ULONG64 last_bytes_out;
+	ULONG64 last_stats_tick;
+	ULONG64 udp_created;
+
+	volatile LONG traffic_error;
 } ITEM_NETWORK, *PITEM_NETWORK;
 
-typedef struct _ITEM_LOG
-{
-	union
-	{
-		IN_ADDR remote_addr;
-		IN6_ADDR remote_addr6;
-	} DUMMYUNIONNAME;
-
-	union
-	{
-		IN_ADDR local_addr;
-		IN6_ADDR local_addr6;
-	} DUMMYUNIONNAME2;
-
-	PR_STRING path;
-	PR_STRING filter_name;
-	PR_STRING layer_name;
-	PR_STRING username;
-	PR_STRING protocol_str;
-
-	volatile PR_STRING local_addr_str;
-	volatile PR_STRING remote_addr_str;
-
-	volatile PR_STRING local_host_str;
-	volatile PR_STRING remote_host_str;
-
-	LONG64 timestamp;
-
-	UINT64 filter_id;
-
-	ULONG_PTR app_hash;
-
-	FWP_DIRECTION direction;
-
-	ADDRESS_FAMILY af;
-
-	UINT16 remote_port;
-	UINT16 local_port;
-
-	UINT8 protocol;
-
-	BOOLEAN is_allow;
-	BOOLEAN is_loopback;
-	BOOLEAN is_blocklist;
-	BOOLEAN is_custom;
-	BOOLEAN is_system;
-	BOOLEAN is_myprovider;
-} ITEM_LOG, *PITEM_LOG;
-
 typedef struct _ITEM_STATUS
 {
-	ULONG_PTR apps_count;
-	ULONG_PTR apps_timer_count;
-	ULONG_PTR apps_unused_count;
-	ULONG_PTR rules_count;
-	ULONG_PTR rules_global_count;
 	ULONG_PTR rules_predefined_count;
+	ULONG_PTR apps_unused_count;
+	ULONG_PTR apps_timer_count;
+	ULONG_PTR rules_global_count;
 	ULONG_PTR rules_user_count;
+	ULONG_PTR rules_count;
+	ULONG_PTR apps_count;
 } ITEM_STATUS, *PITEM_STATUS;
 
 typedef struct _ITEM_CONTEXT
@@ -485,19 +475,13 @@ typedef struct _ITEM_CONTEXT
 	} DUMMYUNIONNAME;
 } ITEM_CONTEXT, *PITEM_CONTEXT;
 
-typedef struct _PACKAGE_CONTEXT
-{
-	WCHAR path[128];
-	BOOLEAN is_byname;
-} PACKAGE_CONTEXT, *PPACKAGE_CONTEXT;
-
 typedef struct _ITEM_COLOR
 {
-	PR_STRING config_name;
 	PR_STRING config_value;
+	PR_STRING config_name;
 	COLORREF default_clr;
 	COLORREF new_clr;
-	UINT locale_id;
+	ULONG locale_id;
 	BOOLEAN is_enabled;
 } ITEM_COLOR, *PITEM_COLOR;
 
@@ -513,17 +497,17 @@ typedef struct _ITEM_ADDRESS
 
 		struct
 		{
-			FWP_RANGE range;
+			FWP_RANGE0 range;
 
-			UINT8 addr6_low[FWP_V6_ADDR_SIZE];
 			UINT8 addr6_high[FWP_V6_ADDR_SIZE];
+			UINT8 addr6_low[FWP_V6_ADDR_SIZE];
 		} DUMMYSTRUCTNAME;
 	} DUMMYUNIONNAME;
 
-	UINT16 port;
-
-	ENUM_TYPE_DATA type;
 	NET_ADDRESS_FORMAT format;
+	ENUM_TYPE_DATA type;
+
+	UINT16 port;
 
 	BOOLEAN is_range;
 } ITEM_ADDRESS, *PITEM_ADDRESS;
@@ -533,13 +517,13 @@ typedef struct _ITEM_LOG_CALLBACK
 	union
 	{
 		const FWP_BYTE_ARRAY16 *remote_addr6;
-		ULONG_PTR remote_addr4;
+		ULONG remote_addr4;
 	} DUMMYUNIONNAME;
 
 	union
 	{
 		const FWP_BYTE_ARRAY16 *local_addr6;
-		ULONG_PTR local_addr4;
+		ULONG local_addr4;
 	} DUMMYUNIONNAME2;
 
 	FILETIME timestamp;
@@ -551,14 +535,86 @@ typedef struct _ITEM_LOG_CALLBACK
 
 	FWP_IP_VERSION version;
 
-	UINT32 flags;
 	UINT32 direction;
-
+	UINT32 flags;
 	UINT16 remote_port;
 	UINT16 local_port;
 	UINT16 layer_id;
 	UINT8 protocol;
 
-	BOOLEAN is_allow;
 	BOOLEAN is_loopback;
+	BOOLEAN is_allow;
 } ITEM_LOG_CALLBACK, *PITEM_LOG_CALLBACK;
+
+typedef struct _ITEM_TAB_CONTEXT
+{
+	INT listview_id;
+	INT locale_id;
+} ITEM_TAB_CONTEXT, *PITEM_TAB_CONTEXT;
+
+typedef struct _UDP_ENDPOINT
+{
+	BYTE address[0x10];
+	ULONG64 created; // UDP owner table bind timestamp, in FILETIME units
+	ULONG scope_id;
+	ULONG pid;
+	ADDRESS_FAMILY af;
+	USHORT port; // host byte order
+} UDP_ENDPOINT, *PUDP_ENDPOINT;
+
+typedef struct UDP_ENTRY
+{
+	struct UDP_ENTRY *next;
+	UDP_ENDPOINT endpoint;
+	ULONG64 since;
+	ULONG64 received;
+	ULONG64 sent;
+	ULONG error_code;
+	ULONG epoch;
+	BOOLEAN is_observed;
+} UDP_ENTRY, *PUDP_ENTRY;
+
+typedef struct UDP_AFD_SOCKET
+{
+	struct UDP_AFD_SOCKET *next;
+	UDP_ENDPOINT endpoint;
+	ULONG64 handle;
+	BOOLEAN is_bound;
+	BOOLEAN is_unsupported;
+} UDP_AFD_SOCKET, *PUDP_AFD_SOCKET;
+
+typedef struct _UDP_TRACE_PROPERTIES
+{
+	EVENT_TRACE_PROPERTIES properties;
+	WCHAR name[0x40];
+} UDP_TRACE_PROPERTIES, *PUDP_TRACE_PROPERTIES;
+
+#define UDP_SESSION_SEMAPHORE L"Global\\simplewall-UDP-owner"
+#define UDP_SESSION_NAME L"simplewall-UDP"
+#define UDP_MAX_ENDPOINTS 0x2000
+#define UDP_BUCKETS 0x100
+
+typedef struct _SW_UDP_STATS
+{
+	RTL_SRWLOCK control_lock;
+	RTL_SRWLOCK lock;
+	UDP_ENTRY *buckets[UDP_BUCKETS];
+	UDP_AFD_SOCKET *sockets[UDP_BUCKETS]; // owned by the ETW consumer thread
+	HANDLE hthread;
+	HANDLE hguard;
+	TRACEHANDLE hsession;
+	TRACEHANDLE hconsumer;
+	ULONG socket_count;
+	ULONG count;
+	ULONG epoch;
+	volatile LONG error_code;
+	volatile LONG stopping;
+	BOOLEAN is_owns_guard;
+} SW_UDP_STATS, *PSW_UDP_STATS;
+
+typedef struct _UDP_SNAPSHOT
+{
+	ULONG64 received;
+	ULONG64 sent;
+	ULONG error_code; // nonzero means totals must not be presented as complete
+} UDP_SNAPSHOT, *PUDP_SNAPSHOT;

src/messages.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2021-2024 Henry++
+// Copyright (c) 2021-2026 Henry++
 
 #pragma once
 
@@ -7,19 +7,33 @@ VOID _app_message_initialize (
 	_In_ HWND hwnd
 );
 
-VOID _app_message_localize (
+FORCEINLINE VOID _app_message_uninitialize (
 	_In_ HWND hwnd
-);
+)
+{
+	_r_tray_destroy (hwnd, &GUID_TrayIcon);
+}
 
-VOID _app_message_uninitialize (
+VOID _app_message_localize (
 	_In_ HWND hwnd
 );
 
 VOID _app_generate_appmenu (
 	_In_ HMENU hmenu,
-	_In_ HMENU hsubmenu_rules,
-	_In_ HMENU hsubmenu_timers,
-	_In_ ULONG_PTR app_hash
+	_In_opt_ HMENU hsubmenu_rules,
+	_In_opt_ HMENU hsubmenu_timers,
+	_In_ ULONG app_hash
+);
+
+VOID _app_generate_rulescontrol (
+	_In_ HMENU hsubmenu,
+	_In_ ULONG app_hash,
+	_In_opt_ PITEM_LOG ptr_log
+);
+
+VOID _app_generate_timerscontrol (
+	_In_ HMENU hsubmenu,
+	_In_ ULONG app_hash
 );
 
 VOID _app_message_contextmenu (

src/network.c

@@ -1,9 +1,166 @@
 // simplewall
-// Copyright (c) 2019-2024 Henry++
+// Copyright (c) 2019-2026 Henry++
 
 #include "global.h"
 
-_Ret_maybenull_
+static VOID _app_network_update_stats_values (
+	_Inout_ PITEM_NETWORK ptr_network,
+	_In_ ULONG64 bytes_in,
+	_In_ ULONG64 bytes_out
+)
+{
+	ULONG64 bytes_delta, current_tick, elapsed;
+
+	current_tick = _r_sys_gettickcount64 ();
+
+	if (!ptr_network->is_stats_initialized)
+	{
+		ptr_network->last_bytes_in = bytes_in;
+		ptr_network->last_bytes_out = bytes_out;
+		ptr_network->last_stats_tick = current_tick;
+		ptr_network->is_stats_initialized = TRUE;
+
+		return;
+	}
+
+	elapsed = current_tick - ptr_network->last_stats_tick;
+
+	if (!elapsed)
+		return;
+
+	bytes_delta = bytes_in >= ptr_network->last_bytes_in ? bytes_in - ptr_network->last_bytes_in : 0;
+
+	_InterlockedExchangeAdd64 (&ptr_network->download_total, bytes_delta);
+	_InterlockedExchange64 (&ptr_network->download_speed, (bytes_delta * 1000) / elapsed);
+
+	bytes_delta = bytes_out >= ptr_network->last_bytes_out ? bytes_out - ptr_network->last_bytes_out : 0;
+
+	_InterlockedExchangeAdd64 (&ptr_network->upload_total, bytes_delta);
+	_InterlockedExchange64 (&ptr_network->upload_speed, (bytes_delta * 1000) / elapsed);
+
+	ptr_network->last_bytes_in = bytes_in;
+	ptr_network->last_bytes_out = bytes_out;
+	ptr_network->last_stats_tick = current_tick;
+}
+
+static VOID _app_network_update_tcp4_stats (
+	_Inout_ PITEM_NETWORK ptr_network,
+	_In_ PMIB_TCPROW_OWNER_MODULE row
+)
+{
+	TCP_ESTATS_DATA_ROD_v0 data_rod = {0};
+	TCP_ESTATS_DATA_RW_v0 data_rw = {0};
+	MIB_TCPROW tcp_row = {0};
+	ULONG status;
+
+	tcp_row.dwState = row->dwState;
+	tcp_row.dwLocalAddr = row->dwLocalAddr;
+	tcp_row.dwLocalPort = row->dwLocalPort;
+	tcp_row.dwRemoteAddr = row->dwRemoteAddr;
+	tcp_row.dwRemotePort = row->dwRemotePort;
+
+	if (!ptr_network->is_stats_enabled)
+	{
+		data_rw.EnableCollection = TRUE;
+
+		status = SetPerTcpConnectionEStats (&tcp_row, TcpConnectionEstatsData, (PUCHAR)&data_rw, 0, sizeof (TCP_ESTATS_DATA_RW_v0), 0);
+
+		if (status != NO_ERROR)
+			return;
+
+		ptr_network->is_stats_enabled = TRUE;
+	}
+
+	status = GetPerTcpConnectionEStats (&tcp_row, TcpConnectionEstatsData, (PUCHAR)&data_rw, 0, sizeof (data_rw), NULL, 0, 0, (PUCHAR)&data_rod, 0, sizeof (TCP_ESTATS_DATA_ROD_v0));
+
+	if (status == NO_ERROR && data_rw.EnableCollection)
+		_app_network_update_stats_values (ptr_network, data_rod.DataBytesIn, data_rod.DataBytesOut);
+}
+
+static VOID _app_network_update_tcp6_stats (
+	_Inout_ PITEM_NETWORK ptr_network,
+	_In_ PMIB_TCP6ROW_OWNER_MODULE row
+)
+{
+	TCP_ESTATS_DATA_ROD_v0 data_rod = {0};
+	TCP_ESTATS_DATA_RW_v0 data_rw = {0};
+	MIB_TCP6ROW tcp_row = {0};
+	ULONG status;
+
+	RtlCopyMemory (&tcp_row.LocalAddr, row->ucLocalAddr, sizeof (IN6_ADDR));
+	tcp_row.dwLocalScopeId = row->dwLocalScopeId;
+	tcp_row.dwLocalPort = row->dwLocalPort;
+	RtlCopyMemory (&tcp_row.RemoteAddr, row->ucRemoteAddr, sizeof (IN6_ADDR));
+	tcp_row.dwRemoteScopeId = row->dwRemoteScopeId;
+	tcp_row.dwRemotePort = row->dwRemotePort;
+	tcp_row.State = row->dwState;
+
+	if (!ptr_network->is_stats_enabled)
+	{
+		data_rw.EnableCollection = TRUE;
+
+		status = SetPerTcp6ConnectionEStats (&tcp_row, TcpConnectionEstatsData, (PUCHAR)&data_rw, 0, sizeof (TCP_ESTATS_DATA_RW_v0), 0);
+
+		if (status != NO_ERROR)
+			return;
+
+		ptr_network->is_stats_enabled = TRUE;
+	}
+
+	status = GetPerTcp6ConnectionEStats (&tcp_row, TcpConnectionEstatsData, (PUCHAR)&data_rw, 0, sizeof (TCP_ESTATS_DATA_RW_v0), NULL, 0, 0, (PUCHAR)&data_rod, 0, sizeof (TCP_ESTATS_DATA_ROD_v0));
+
+	if (status == NO_ERROR && data_rw.EnableCollection)
+		_app_network_update_stats_values (ptr_network, data_rod.DataBytesIn, data_rod.DataBytesOut);
+}
+
+static VOID _app_network_update_udp_stats (
+	_Inout_ PITEM_NETWORK ptr_network,
+	_In_ PITEM_NETWORK_CONTEXT context,
+	_In_ ULONG pid,
+	_In_ ULONG64 created,
+	_In_ ULONG scope_id
+)
+{
+	UDP_ENDPOINT endpoint = {0};
+	UDP_SNAPSHOT snapshot;
+
+	if (!context->udp_stats)
+		return;
+
+	endpoint.pid = pid;
+	endpoint.af = ptr_network->af;
+	endpoint.port = ptr_network->local_port;
+	endpoint.created = created;
+	endpoint.scope_id = scope_id;
+
+	RtlCopyMemory (endpoint.address, &ptr_network->local_addr, endpoint.af == AF_INET ? 4 : 16); // set correct sizes
+
+	udp_stats_read (context->udp_stats, &endpoint, &snapshot);
+
+	_InterlockedExchange (&ptr_network->traffic_error, snapshot.error_code);
+
+	if (snapshot.error_code)
+	{
+		ptr_network->is_stats_initialized = FALSE;
+
+		return;
+	}
+
+	if (ptr_network->udp_created != created)
+	{
+		ptr_network->udp_created = created;
+		ptr_network->is_stats_initialized = FALSE;
+
+		_InterlockedExchange64 (&ptr_network->download_speed, 0);
+		_InterlockedExchange64 (&ptr_network->upload_speed, 0);
+	}
+
+	_app_network_update_stats_values (ptr_network, snapshot.received, snapshot.sent);
+
+	_InterlockedExchange64 (&ptr_network->download_total, snapshot.received);
+	_InterlockedExchange64 (&ptr_network->upload_total, snapshot.sent);
+}
+
 PITEM_NETWORK_CONTEXT _app_network_getcontext ()
 {
 	static R_INITONCE init_once = PR_INITONCE_INIT;
@@ -11,10 +168,10 @@ PITEM_NETWORK_CONTEXT _app_network_getcontext ()
 
 	if (_r_initonce_begin (&init_once))
 	{
-		network_context = _r_mem_allocate (sizeof (ITEM_NETWORK_CONTEXT));
+		network_context = (PITEM_NETWORK_CONTEXT)_r_mem_allocate (sizeof (ITEM_NETWORK_CONTEXT));
 
-		network_context->network_ptr = _r_obj_createhashtablepointer (256);
-		network_context->checker_ptr = _r_obj_createhashtablepointer (256);
+		network_context->network_ptr = _r_obj_createhashtablepointer (0x100);
+		network_context->checker_ptr = _r_obj_createhashtablepointer (0x100);
 
 		_r_initonce_end (&init_once);
 	}
@@ -22,26 +179,41 @@ PITEM_NETWORK_CONTEXT _app_network_getcontext ()
 	return network_context;
 }
 
+VOID _app_network_stop ()
+{
+	// the original network worker lives until process exit. keep the stopped context valid for that worker; stop/join only our independent ETW consumer.
+	udp_stats_stop (_app_network_getcontext ()->udp_stats);
+}
+
 VOID _app_network_initialize (
 	_In_ HWND hwnd
 )
 {
 	PITEM_NETWORK_CONTEXT network_context;
 	R_ENVIRONMENT environment;
-	BOOLEAN is_enabled;
+	ULONG status;
 
-	is_enabled = _r_config_getboolean (L"IsNetworkMonitorEnabled", TRUE);
-
-	if (!is_enabled)
+	if (!_r_config_getboolean (L"IsNetworkMonitorEnabled", TRUE, NULL))
 		return;
 
 	network_context = _app_network_getcontext ();
 
-	if (!network_context)
+	if (!network_context) // USELESS!
 		return;
 
 	network_context->hwnd = hwnd;
 
+	// opt-in: sockets created before capture cannot be mapped by AFD events
+	if (_r_config_getboolean (L"IsUdpTrafficEnabled", FALSE, NULL))
+	{
+		network_context->udp_stats = udp_stats_create ();
+
+		status = udp_stats_start (network_context->udp_stats);
+
+		if (status != STATUS_SUCCESS && status != STATUS_ALREADY_INITIALIZED)
+			_r_log (LOG_LEVEL_WARNING, NULL, L"udp_stats_start", NULL, status);
+	}
+
 	_r_queuedlock_acquireexclusive (&network_context->lock_network);
 	_r_obj_clearhashtable (network_context->network_ptr);
 	_r_queuedlock_releaseexclusive (&network_context->lock_network);
@@ -53,7 +225,7 @@ VOID _app_network_initialize (
 	// create network monitor thread
 	_r_sys_setenvironment (&environment, THREAD_PRIORITY_ABOVE_NORMAL, IoPriorityNormal, MEMORY_PRIORITY_NORMAL);
 
-	_r_sys_createthread (&_app_network_threadproc, network_context, NULL, &environment, L"NetMonitor");
+	_r_sys_createthread (NULL, NtCurrentProcess (), &_app_network_threadproc, network_context, &environment, L"NetworkMonitor");
 }
 
 VOID _app_network_uninitialize (
@@ -69,28 +241,39 @@ VOID _app_network_uninitialize (
 	_r_queuedlock_releaseexclusive (&context->lock_checker);
 }
 
+FORCEINLINE BOOLEAN _app_network_iswaitingconnection (
+	_In_ ULONG pid
+)
+{
+	if (pid == PROC_WAITING_PID && !_r_config_getboolean (L"IsNetworkShowWaitConnections", TRUE, NULL))
+		return TRUE;
+
+	return FALSE;
+}
+
 VOID _app_network_generatetable (
 	_Inout_ PITEM_NETWORK_CONTEXT network_context
 )
 {
-	PITEM_NETWORK ptr_network;
-	IN_ADDR remote_addr;
-	IN_ADDR local_addr;
-	PMIB_TCPTABLE_OWNER_MODULE tcp4_table;
 	PMIB_TCP6TABLE_OWNER_MODULE tcp6_table;
-	PMIB_UDPTABLE_OWNER_MODULE udp4_table;
 	PMIB_UDP6TABLE_OWNER_MODULE udp6_table;
-	ULONG_PTR network_hash;
+	PMIB_TCPTABLE_OWNER_MODULE tcp4_table;
+	PMIB_UDPTABLE_OWNER_MODULE udp4_table;
+	IN_ADDR local_addr, remote_addr;
+	PITEM_NETWORK ptr_network;
 	PVOID buffer;
-	ULONG allocated_size;
-	ULONG required_size;
+	ULONG allocated_size, network_hash, required_size = 0;
+	BOOL udp4_complete = FALSE, udp6_complete = FALSE;
 	ULONG status;
 
+	udp_stats_poll (network_context->udp_stats);
+	udp_stats_begin_refresh (network_context->udp_stats);
+
 	_r_queuedlock_acquireexclusive (&network_context->lock_checker);
 	_r_obj_clearhashtable (network_context->checker_ptr);
 	_r_queuedlock_releaseexclusive (&network_context->lock_checker);
 
-	required_size = 0;
+	// TCP IPv4
 	GetExtendedTcpTable (NULL, &required_size, FALSE, AF_INET, TCP_TABLE_OWNER_MODULE_ALL, 0);
 
 	allocated_size = required_size;
@@ -98,15 +281,18 @@ VOID _app_network_generatetable (
 
 	if (required_size)
 	{
-		tcp4_table = buffer;
+		tcp4_table = (PMIB_TCPTABLE_OWNER_MODULE)buffer;
 		status = GetExtendedTcpTable (tcp4_table, &required_size, FALSE, AF_INET, TCP_TABLE_OWNER_MODULE_ALL, 0);
 
 		if (status == NO_ERROR)
 		{
 			for (ULONG i = 0; i < tcp4_table->dwNumEntries; i++)
 			{
-				RtlZeroMemory (&remote_addr, sizeof (remote_addr));
-				RtlZeroMemory (&local_addr, sizeof (local_addr));
+				if (_app_network_iswaitingconnection (tcp4_table->table[i].dwOwningPid))
+					continue;
+
+				RtlZeroMemory (&remote_addr, sizeof (IN_ADDR));
+				RtlZeroMemory (&local_addr, sizeof (IN_ADDR));
 
 				remote_addr.S_un.S_addr = tcp4_table->table[i].dwRemoteAddr;
 				local_addr.S_un.S_addr = tcp4_table->table[i].dwLocalAddr;
@@ -122,16 +308,22 @@ VOID _app_network_generatetable (
 					tcp4_table->table[i].dwState
 				);
 
-				if (_app_network_isitemfound (network_hash))
+				ptr_network = _app_network_getitem (network_hash);
+
+				if (ptr_network)
 				{
+					_app_network_update_tcp4_stats (ptr_network, &tcp4_table->table[i]);
+
 					_r_queuedlock_acquireexclusive (&network_context->lock_checker);
 					_r_obj_addhashtablepointer (network_context->checker_ptr, network_hash, NULL);
 					_r_queuedlock_releaseexclusive (&network_context->lock_checker);
 
+					_r_obj_dereference (ptr_network);
+
 					continue;
 				}
 
-				ptr_network = _r_obj_allocate (sizeof (ITEM_NETWORK), &_app_dereferencenetwork);
+				ptr_network = (PITEM_NETWORK)_r_obj_allocate (sizeof (ITEM_NETWORK), &_app_dereferencenetwork);
 
 				if (!_app_network_getpath (ptr_network, tcp4_table->table[i].dwOwningPid, tcp4_table->table[i].OwningModuleInfo))
 				{
@@ -142,16 +334,17 @@ VOID _app_network_generatetable (
 
 				ptr_network->af = AF_INET;
 				ptr_network->protocol = IPPROTO_TCP;
-				ptr_network->protocol_str = _app_db_getprotoname (ptr_network->protocol, ptr_network->af, FALSE);
+				ptr_network->protocol_str = _r_obj_createstring (_app_db_getprotoname (ptr_network->protocol, ptr_network->af, L"<unknown protocol>"));
 
 				ptr_network->remote_addr.S_un.S_addr = tcp4_table->table[i].dwRemoteAddr;
 				ptr_network->remote_port = _r_byteswap_ushort ((USHORT)tcp4_table->table[i].dwRemotePort);
-
 				ptr_network->local_addr.S_un.S_addr = tcp4_table->table[i].dwLocalAddr;
 				ptr_network->local_port = _r_byteswap_ushort ((USHORT)tcp4_table->table[i].dwLocalPort);
 
 				ptr_network->state = tcp4_table->table[i].dwState;
 
+				_app_network_update_tcp4_stats (ptr_network, &tcp4_table->table[i]);
+
 				if (tcp4_table->table[i].dwState == MIB_TCP_STATE_ESTAB)
 				{
 					if (_app_network_isvalidconnection (ptr_network->af, &ptr_network->remote_addr) || _app_network_isvalidconnection (ptr_network->af, &ptr_network->local_addr))
@@ -169,6 +362,7 @@ VOID _app_network_generatetable (
 		}
 	}
 
+	// TCP IPv6
 	required_size = 0;
 	GetExtendedTcpTable (NULL, &required_size, FALSE, AF_INET6, TCP_TABLE_OWNER_MODULE_ALL, 0);
 
@@ -181,13 +375,16 @@ VOID _app_network_generatetable (
 			allocated_size = required_size;
 		}
 
-		tcp6_table = buffer;
+		tcp6_table = (PMIB_TCP6TABLE_OWNER_MODULE)buffer;
 		status = GetExtendedTcpTable (tcp6_table, &required_size, FALSE, AF_INET6, TCP_TABLE_OWNER_MODULE_ALL, 0);
 
 		if (status == NO_ERROR)
 		{
 			for (ULONG i = 0; i < tcp6_table->dwNumEntries; i++)
 			{
+				if (_app_network_iswaitingconnection (tcp6_table->table[i].dwOwningPid))
+					continue;
+
 				network_hash = _app_network_gethash (
 					AF_INET6,
 					tcp6_table->table[i].dwOwningPid,
@@ -199,16 +396,22 @@ VOID _app_network_generatetable (
 					tcp6_table->table[i].dwState
 				);
 
-				if (_app_network_isitemfound (network_hash))
+				ptr_network = _app_network_getitem (network_hash);
+
+				if (ptr_network)
 				{
+					_app_network_update_tcp6_stats (ptr_network, &tcp6_table->table[i]);
+
 					_r_queuedlock_acquireexclusive (&network_context->lock_checker);
 					_r_obj_addhashtablepointer (network_context->checker_ptr, network_hash, NULL);
 					_r_queuedlock_releaseexclusive (&network_context->lock_checker);
 
+					_r_obj_dereference (ptr_network);
+
 					continue;
 				}
 
-				ptr_network = _r_obj_allocate (sizeof (ITEM_NETWORK), &_app_dereferencenetwork);
+				ptr_network = (PITEM_NETWORK)_r_obj_allocate (sizeof (ITEM_NETWORK), &_app_dereferencenetwork);
 
 				if (!_app_network_getpath (ptr_network, tcp6_table->table[i].dwOwningPid, tcp6_table->table[i].OwningModuleInfo))
 				{
@@ -219,16 +422,17 @@ VOID _app_network_generatetable (
 
 				ptr_network->af = AF_INET6;
 				ptr_network->protocol = IPPROTO_TCP;
-				ptr_network->protocol_str = _app_db_getprotoname (ptr_network->protocol, ptr_network->af, FALSE);
+				ptr_network->protocol_str = _r_obj_createstring (_app_db_getprotoname (ptr_network->protocol, ptr_network->af, L"<unknown protocol>"));
 
 				RtlCopyMemory (ptr_network->remote_addr6.u.Byte, tcp6_table->table[i].ucRemoteAddr, FWP_V6_ADDR_SIZE);
 				ptr_network->remote_port = _r_byteswap_ushort ((USHORT)tcp6_table->table[i].dwRemotePort);
-
 				RtlCopyMemory (ptr_network->local_addr6.u.Byte, tcp6_table->table[i].ucLocalAddr, FWP_V6_ADDR_SIZE);
 				ptr_network->local_port = _r_byteswap_ushort ((USHORT)tcp6_table->table[i].dwLocalPort);
 
 				ptr_network->state = tcp6_table->table[i].dwState;
 
+				_app_network_update_tcp6_stats (ptr_network, &tcp6_table->table[i]);
+
 				if (tcp6_table->table[i].dwState == MIB_TCP_STATE_ESTAB)
 				{
 					if (_app_network_isvalidconnection (ptr_network->af, &ptr_network->remote_addr6) || _app_network_isvalidconnection (ptr_network->af, &ptr_network->local_addr6))
@@ -246,6 +450,7 @@ VOID _app_network_generatetable (
 		}
 	}
 
+	// UDP IPv4
 	required_size = 0;
 	GetExtendedUdpTable (NULL, &required_size, FALSE, AF_INET, UDP_TABLE_OWNER_MODULE, 0);
 
@@ -254,41 +459,44 @@ VOID _app_network_generatetable (
 		if (allocated_size < required_size)
 		{
 			buffer = _r_mem_reallocate (buffer, required_size);
+
 			allocated_size = required_size;
 		}
 
-		udp4_table = buffer;
+		udp4_table = (PMIB_UDPTABLE_OWNER_MODULE)buffer;
 		status = GetExtendedUdpTable (udp4_table, &required_size, FALSE, AF_INET, UDP_TABLE_OWNER_MODULE, 0);
 
 		if (status == NO_ERROR)
 		{
+			udp4_complete = TRUE;
+
 			for (ULONG i = 0; i < udp4_table->dwNumEntries; i++)
 			{
-				RtlZeroMemory (&local_addr, sizeof (local_addr));
+				RtlZeroMemory (&local_addr, sizeof (IN_ADDR));
 
 				local_addr.S_un.S_addr = udp4_table->table[i].dwLocalAddr;
 
-				network_hash = _app_network_gethash (
-					AF_INET,
-					udp4_table->table[i].dwOwningPid,
-					NULL,
-					0,
-					&local_addr,
-					udp4_table->table[i].dwLocalPort,
-					IPPROTO_UDP,
-					0
-				);
+				network_hash = _app_network_gethash (AF_INET, udp4_table->table[i].dwOwningPid, NULL, 0, &local_addr, udp4_table->table[i].dwLocalPort, IPPROTO_UDP, 0);
 
-				if (_app_network_isitemfound (network_hash))
+				ptr_network = _app_network_getitem (network_hash);
+
+				if (ptr_network)
 				{
+					_app_network_update_udp_stats (ptr_network, network_context, udp4_table->table[i].dwOwningPid, udp4_table->table[i].liCreateTimestamp.QuadPart, 0);
+
 					_r_queuedlock_acquireexclusive (&network_context->lock_checker);
 					_r_obj_addhashtablepointer (network_context->checker_ptr, network_hash, NULL);
 					_r_queuedlock_releaseexclusive (&network_context->lock_checker);
 
+					_r_obj_dereference (ptr_network);
+
 					continue;
 				}
 
-				ptr_network = _r_obj_allocate (sizeof (ITEM_NETWORK), &_app_dereferencenetwork);
+				if (_app_network_iswaitingconnection (udp4_table->table[i].dwOwningPid))
+					continue;
+
+				ptr_network = (PITEM_NETWORK)_r_obj_allocate (sizeof (ITEM_NETWORK), &_app_dereferencenetwork);
 
 				if (!_app_network_getpath (ptr_network, udp4_table->table[i].dwOwningPid, udp4_table->table[i].OwningModuleInfo))
 				{
@@ -299,11 +507,13 @@ VOID _app_network_generatetable (
 
 				ptr_network->af = AF_INET;
 				ptr_network->protocol = IPPROTO_UDP;
-				ptr_network->protocol_str = _app_db_getprotoname (ptr_network->protocol, ptr_network->af, FALSE);
+				ptr_network->protocol_str = _r_obj_createstring (_app_db_getprotoname (ptr_network->protocol, ptr_network->af, L"<unknown protocol>"));
 
 				ptr_network->local_addr.S_un.S_addr = udp4_table->table[i].dwLocalAddr;
 				ptr_network->local_port = _r_byteswap_ushort ((USHORT)udp4_table->table[i].dwLocalPort);
 
+				_app_network_update_udp_stats (ptr_network, network_context, udp4_table->table[i].dwOwningPid, udp4_table->table[i].liCreateTimestamp.QuadPart, 0);
+
 				if (_app_network_isvalidconnection (ptr_network->af, &ptr_network->local_addr))
 					ptr_network->is_connection = TRUE;
 
@@ -318,6 +528,7 @@ VOID _app_network_generatetable (
 		}
 	}
 
+	// UDP IPv6
 	required_size = 0;
 	GetExtendedUdpTable (NULL, &required_size, FALSE, AF_INET6, UDP_TABLE_OWNER_MODULE, 0);
 
@@ -329,34 +540,36 @@ VOID _app_network_generatetable (
 			allocated_size = required_size;
 		}
 
-		udp6_table = buffer;
+		udp6_table = (PMIB_UDP6TABLE_OWNER_MODULE)buffer;
 		status = GetExtendedUdpTable (udp6_table, &required_size, FALSE, AF_INET6, UDP_TABLE_OWNER_MODULE, 0);
 
 		if (status == NO_ERROR)
 		{
+			udp6_complete = TRUE;
+
 			for (ULONG i = 0; i < udp6_table->dwNumEntries; i++)
 			{
-				network_hash = _app_network_gethash (
-					AF_INET6,
-					udp6_table->table[i].dwOwningPid,
-					NULL,
-					0,
-					udp6_table->table[i].ucLocalAddr,
-					udp6_table->table[i].dwLocalPort,
-					IPPROTO_UDP,
-					0
-				);
+				network_hash = _app_network_gethash (AF_INET6, udp6_table->table[i].dwOwningPid, NULL, 0, udp6_table->table[i].ucLocalAddr, udp6_table->table[i].dwLocalPort, IPPROTO_UDP, 0);
 
-				if (_app_network_isitemfound (network_hash))
+				ptr_network = _app_network_getitem (network_hash);
+
+				if (ptr_network)
 				{
+					_app_network_update_udp_stats (ptr_network, network_context, udp6_table->table[i].dwOwningPid, udp6_table->table[i].liCreateTimestamp.QuadPart, udp6_table->table[i].dwLocalScopeId);
+
 					_r_queuedlock_acquireexclusive (&network_context->lock_checker);
 					_r_obj_addhashtablepointer (network_context->checker_ptr, network_hash, NULL);
 					_r_queuedlock_releaseexclusive (&network_context->lock_checker);
 
+					_r_obj_dereference (ptr_network);
+
 					continue;
 				}
 
-				ptr_network = _r_obj_allocate (sizeof (ITEM_NETWORK), &_app_dereferencenetwork);
+				if (_app_network_iswaitingconnection (udp6_table->table[i].dwOwningPid))
+					continue;
+
+				ptr_network = (PITEM_NETWORK)_r_obj_allocate (sizeof (ITEM_NETWORK), &_app_dereferencenetwork);
 
 				if (!_app_network_getpath (ptr_network, udp6_table->table[i].dwOwningPid, udp6_table->table[i].OwningModuleInfo))
 				{
@@ -367,11 +580,13 @@ VOID _app_network_generatetable (
 
 				ptr_network->af = AF_INET6;
 				ptr_network->protocol = IPPROTO_UDP;
-				ptr_network->protocol_str = _app_db_getprotoname (ptr_network->protocol, ptr_network->af, FALSE);
+				ptr_network->protocol_str = _r_obj_createstring (_app_db_getprotoname (ptr_network->protocol, ptr_network->af, L"<unknown protocol>"));
 
 				RtlCopyMemory (ptr_network->local_addr6.u.Byte, udp6_table->table[i].ucLocalAddr, FWP_V6_ADDR_SIZE);
 				ptr_network->local_port = _r_byteswap_ushort ((USHORT)udp6_table->table[i].dwLocalPort);
 
+				_app_network_update_udp_stats (ptr_network, network_context, udp6_table->table[i].dwOwningPid, udp6_table->table[i].liCreateTimestamp.QuadPart, udp6_table->table[i].dwLocalScopeId);
+
 				if (_app_network_isvalidconnection (ptr_network->af, &ptr_network->local_addr6))
 					ptr_network->is_connection = TRUE;
 
@@ -386,13 +601,15 @@ VOID _app_network_generatetable (
 		}
 	}
 
+	udp_stats_end_refresh (network_context->udp_stats, udp4_complete, udp6_complete);
+
 	if (buffer)
 		_r_mem_free (buffer);
 }
 
 _Ret_maybenull_
 PITEM_NETWORK _app_network_getitem (
-	_In_ ULONG_PTR network_hash
+	_In_ ULONG network_hash
 )
 {
 	PITEM_NETWORK_CONTEXT network_context;
@@ -404,19 +621,19 @@ PITEM_NETWORK _app_network_getitem (
 		return NULL;
 
 	_r_queuedlock_acquireshared (&network_context->lock_network);
-	ptr_network = _r_obj_findhashtablepointer (network_context->network_ptr, network_hash);
+	ptr_network = (PITEM_NETWORK)_r_obj_findhashtablepointer (network_context->network_ptr, network_hash);
 	_r_queuedlock_releaseshared (&network_context->lock_network);
 
 	return ptr_network;
 }
 
 _Success_ (return != 0)
-ULONG_PTR _app_network_getappitem (
-	_In_ ULONG_PTR network_hash
+ULONG _app_network_getappitem (
+	_In_ ULONG network_hash
 )
 {
 	PITEM_NETWORK ptr_network;
-	ULONG_PTR hash_code;
+	ULONG hash_code;
 
 	ptr_network = _app_network_getitem (network_hash);
 
@@ -430,7 +647,7 @@ ULONG_PTR _app_network_getappitem (
 	return hash_code;
 }
 
-ULONG_PTR _app_network_gethash (
+ULONG _app_network_gethash (
 	_In_ ADDRESS_FAMILY af,
 	_In_ ULONG pid,
 	_In_opt_ LPCVOID remote_addr,
@@ -441,20 +658,18 @@ ULONG_PTR _app_network_gethash (
 	_In_opt_ ULONG state
 )
 {
-	WCHAR remote_address[LEN_IP_MAX] = {0};
-	WCHAR local_address[LEN_IP_MAX] = {0};
-	PR_STRING network_string;
-	ULONG_PTR network_hash;
+	WCHAR local_address[LEN_IP_MAX] = {0}, remote_address[LEN_IP_MAX] = {0}, network_string[0x100];
 
 	if (remote_addr)
-		_app_formatip (af, remote_addr, remote_address, RTL_NUMBER_OF (remote_address), FALSE);
+		_app_formatip (remote_address, RTL_NUMBER_OF (remote_address), af, remote_addr, FALSE);
 
 	if (local_addr)
-		_app_formatip (af, local_addr, local_address, RTL_NUMBER_OF (local_address), FALSE);
+		_app_formatip (local_address, RTL_NUMBER_OF (local_address), af, local_addr, FALSE);
 
-	network_string = _r_format_string (
-		L"%" TEXT (PRIu8) L"_%" TEXT (PR_ULONG) L"_%s_%" TEXT (PR_ULONG) \
-		L"_%s_%" TEXT (PR_ULONG) L"_%" TEXT (PRIu8) L"_%" TEXT (PR_ULONG),
+	_r_str_printf (
+		network_string,
+		RTL_NUMBER_OF (network_string),
+		L"%" TEXT (PRIu8) L"_%" TEXT (PR_ULONG) L"_%s_%" TEXT (PR_ULONG) L"_%s_%" TEXT (PR_ULONG) L"_%" TEXT (PRIu8) L"_%" TEXT (PR_ULONG),
 		af,
 		pid,
 		remote_address,
@@ -465,11 +680,7 @@ ULONG_PTR _app_network_gethash (
 		state
 	);
 
-	network_hash = _r_str_gethash2 (network_string, TRUE);
-
-	_r_obj_dereference (network_string);
-
-	return network_hash;
+	return _r_str_gethash2 (network_string, TRUE);
 }
 
 BOOLEAN _app_network_getpath (
@@ -480,8 +691,7 @@ BOOLEAN _app_network_getpath (
 {
 	PTOKEN_APPCONTAINER_INFORMATION app_container = NULL;
 	PR_STRING process_name = NULL;
-	HANDLE hprocess;
-	HANDLE htoken;
+	HANDLE hprocess, htoken;
 	NTSTATUS status;
 
 	if (pid == PROC_WAITING_PID)
@@ -503,7 +713,7 @@ BOOLEAN _app_network_getpath (
 
 	if (modules)
 	{
-		process_name = _r_sys_querytaginformation (UlongToHandle (pid), UlongToPtr (*(PULONG)modules));
+		process_name = _r_sys_querytaginformation (pid, ULongToPtr (*(PULONG)modules));
 
 		if (process_name)
 			ptr_network->type = DATA_APP_SERVICE;
@@ -511,18 +721,11 @@ BOOLEAN _app_network_getpath (
 
 	if (!process_name)
 	{
-		status = _r_sys_openprocess (ULongToHandle (pid), PROCESS_QUERY_LIMITED_INFORMATION, &hprocess);
+		status = _r_sys_openprocess (&hprocess, pid, PROCESS_QUERY_LIMITED_INFORMATION);
 
 		if (NT_SUCCESS (status))
 		{
-			if (_r_sys_isprocessimmersive (hprocess))
-			{
-				ptr_network->type = DATA_APP_UWP;
-			}
-			else
-			{
-				ptr_network->type = DATA_APP_REGULAR;
-			}
+			ptr_network->type = _r_sys_isprocessimmersive (hprocess) ? DATA_APP_UWP : DATA_APP_REGULAR;
 
 			if (ptr_network->type == DATA_APP_UWP)
 			{
@@ -530,11 +733,11 @@ BOOLEAN _app_network_getpath (
 
 				if (NT_SUCCESS (status))
 				{
-					status = _r_sys_querytokeninformation (htoken, TokenAppContainerSid, &app_container);
+					status = _r_sys_querytokeninformation ((PVOID_PTR)&app_container, htoken, TokenAppContainerSid);
 
 					if (NT_SUCCESS (status))
 					{
-						_r_str_fromsid (app_container->TokenAppContainer, &process_name);
+						_r_str_fromsid (&process_name, app_container->TokenAppContainer);
 
 						_r_mem_free (app_container);
 					}
@@ -545,11 +748,11 @@ BOOLEAN _app_network_getpath (
 
 			if (!process_name)
 			{
-				status = _r_sys_queryprocessstring (hprocess, ProcessImageFileNameWin32, &process_name);
+				status = _r_sys_queryprocessstring (&process_name, hprocess, ProcessImageFileNameWin32);
 
 				// fix for WSL processes (issue #606)
 				if (status == STATUS_UNSUCCESSFUL)
-					status = _r_sys_queryprocessstring (hprocess, ProcessImageFileName, &process_name);
+					status = _r_sys_queryprocessstring (&process_name, hprocess, ProcessImageFileName);
 			}
 
 			NtClose (hprocess);
@@ -558,7 +761,7 @@ BOOLEAN _app_network_getpath (
 
 	if (process_name)
 	{
-		ptr_network->app_hash = _r_str_gethash2 (process_name, TRUE);
+		ptr_network->app_hash = _r_str_gethash (&process_name->sr, TRUE);
 		ptr_network->path = process_name;
 
 		return TRUE;
@@ -568,7 +771,7 @@ BOOLEAN _app_network_getpath (
 }
 
 BOOLEAN _app_network_isapphaveconnection (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 )
 {
 	PITEM_NETWORK_CONTEXT network_context;
@@ -582,7 +785,7 @@ BOOLEAN _app_network_isapphaveconnection (
 
 	_r_queuedlock_acquireshared (&network_context->lock_network);
 
-	while (_r_obj_enumhashtablepointer (network_context->network_ptr, &ptr_network, NULL, &enum_key))
+	while (_r_obj_enumhashtablepointer (network_context->network_ptr, (PVOID_PTR)&ptr_network, NULL, &enum_key))
 	{
 		if (ptr_network->app_hash != app_hash)
 			continue;
@@ -601,7 +804,7 @@ BOOLEAN _app_network_isapphaveconnection (
 }
 
 BOOLEAN _app_network_isitemfound (
-	_In_ ULONG_PTR network_hash
+	_In_ ULONG network_hash
 )
 {
 	PITEM_NETWORK_CONTEXT network_context;
@@ -624,14 +827,14 @@ BOOLEAN _app_network_isvalidconnection (
 	_In_ LPCVOID address
 )
 {
-	PIN_ADDR p4addr;
 	PIN6_ADDR p6addr;
+	PIN_ADDR p4addr;
 
 	switch (af)
 	{
 		case AF_INET:
 		{
-			p4addr = (PIN_ADDR)address;
+			p4addr = (const PIN_ADDR)address;
 
 			return (!IN4_IS_ADDR_UNSPECIFIED (p4addr) &&
 					!IN4_IS_ADDR_LOOPBACK (p4addr) &&
@@ -643,18 +846,21 @@ BOOLEAN _app_network_isvalidconnection (
 
 		case AF_INET6:
 		{
-			p6addr = (PIN6_ADDR)address;
+			p6addr = (const PIN6_ADDR)address;
 
 			return (!IN6_IS_ADDR_UNSPECIFIED (p6addr) &&
-					 !IN6_IS_ADDR_LOOPBACK (p6addr) &&
-					 !IN6_IS_ADDR_LINKLOCAL (p6addr) &&
-					 !IN6_IS_ADDR_MULTICAST (p6addr) &&
-					 !IN6_IS_ADDR_SITELOCAL (p6addr) &&
-					 !IN6_IS_ADDR_ANYCAST (p6addr));
+					!IN6_IS_ADDR_LOOPBACK (p6addr) &&
+					!IN6_IS_ADDR_ANYCAST (p6addr) &&
+					!IN6_IS_ADDR_LINKLOCAL (p6addr) &&
+					!IN6_IS_ADDR_MULTICAST (p6addr) &&
+					!IN6_IS_ADDR_SITELOCAL (p6addr));
+		}
+
+		default:
+		{
+			return FALSE; // unknown address family
 		}
 	}
-
-	return FALSE;
 }
 
 VOID _app_network_printlistviewtable (
@@ -663,29 +869,27 @@ VOID _app_network_printlistviewtable (
 {
 	PITEM_NETWORK ptr_network = NULL;
 	PR_STRING string;
-	ULONG_PTR app_hash;
-	ULONG_PTR network_hash;
 	ULONG_PTR enum_key = 0;
+	ULONG app_hash, network_hash;
 	INT item_count;
-	BOOLEAN is_highlight = FALSE;
-	BOOLEAN is_refresh = FALSE;
+	BOOLEAN is_highlight = FALSE, is_refresh = FALSE;
 
-	if (_r_config_getboolean (L"IsEnableHighlighting", TRUE) && _r_config_getboolean_ex (L"IsHighlightConnection", TRUE, L"colors"))
+	if (_r_config_getboolean (L"IsEnableHighlighting", TRUE, NULL) && _r_config_getboolean (L"IsHighlightConnection", TRUE, L"colors"))
 		is_highlight = TRUE;
 
 	// add new connections into listview
 	_r_queuedlock_acquireshared (&network_context->lock_network);
 
-	while (_r_obj_enumhashtablepointer (network_context->network_ptr, &ptr_network, &network_hash, &enum_key))
+	while (_r_obj_enumhashtablepointer (network_context->network_ptr, (PVOID_PTR)&ptr_network, &network_hash, &enum_key))
 	{
-		string = _r_obj_findhashtablepointer (network_context->checker_ptr, network_hash);
+		string = (PR_STRING)_r_obj_findhashtablepointer (network_context->checker_ptr, network_hash);
 
 		if (!string)
 			continue;
 
 		_app_listview_addnetworkitem (network_context->hwnd, network_hash);
 
-		if (ptr_network->path && ptr_network->app_hash)
+		if (ptr_network->app_hash && ptr_network->path)
 			_app_getfileinformation (ptr_network->path, ptr_network->app_hash, ptr_network->type, IDC_NETWORK);
 
 		// resolve network address
@@ -698,9 +902,16 @@ VOID _app_network_printlistviewtable (
 
 	_r_queuedlock_releaseshared (&network_context->lock_network);
 
-	// refresh network tab
+	// refresh network tab (traffic counters change on every pass)
 	if (is_refresh)
+	{
 		_app_listview_updateby_id (network_context->hwnd, IDC_NETWORK, PR_UPDATE_NORESIZE);
+	}
+	else
+	{
+		_r_listview_redraw (network_context->hwnd, IDC_NETWORK);
+		_app_listview_sort (network_context->hwnd, IDC_NETWORK, INT_ERROR, FALSE);
+	}
 
 	// remove closed connections from list
 	item_count = _r_listview_getitemcount (network_context->hwnd, IDC_NETWORK);
@@ -708,9 +919,9 @@ VOID _app_network_printlistviewtable (
 	if (!item_count)
 		return;
 
-	for (INT i = item_count - 1; i != -1; i--)
+	for (INT i = item_count - 1; i != INT_ERROR; i--)
 	{
-		network_hash = _app_listview_getitemcontext (network_context->hwnd, IDC_NETWORK, i);
+		network_hash = (ULONG)_app_listview_getitemcontext (network_context->hwnd, IDC_NETWORK, i);
 
 		if (_r_obj_findhashtable (network_context->checker_ptr, network_hash))
 			continue;
@@ -721,16 +932,13 @@ VOID _app_network_printlistviewtable (
 
 		_app_network_removeitem (network_hash);
 
-		// redraw listview item
-		if (!is_highlight || !app_hash)
-			continue;
-
-		_app_listview_updateby_param (network_context->hwnd, app_hash, PR_SETITEM_REDRAW, TRUE);
+		if (app_hash && is_highlight)
+			_app_listview_updateby_param (network_context->hwnd, app_hash, PR_SETITEM_REDRAW, TRUE); // redraw listview item
 	}
 }
 
 VOID _app_network_removeitem (
-	_In_ ULONG_PTR network_hash
+	_In_ ULONG network_hash
 )
 {
 	PITEM_NETWORK_CONTEXT network_context;
@@ -745,7 +953,7 @@ VOID _app_network_removeitem (
 	_r_queuedlock_releaseexclusive (&network_context->lock_network);
 }
 
-NTSTATUS NTAPI _app_network_threadproc (
+VOID NTAPI _app_network_threadproc (
 	_In_ PVOID arglist
 )
 {
@@ -759,10 +967,8 @@ NTSTATUS NTAPI _app_network_threadproc (
 		_app_network_generatetable (network_context);
 		_app_network_printlistviewtable (network_context);
 
-		_r_sys_waitforsingleobject (NtCurrentThread (), NETWORK_TIMEOUT);
+		_r_sys_waitforsingleobject (NtCurrentThread (), 2000);
 	}
 
 	_app_network_uninitialize (network_context);
-
-	return STATUS_SUCCESS;
 }

src/network.h

@@ -1,21 +1,27 @@
 // simplewall
-// Copyright (c) 2019-2024 Henry++
+// Copyright (c) 2019-2026 Henry++
 
 #pragma once
 
-#define NETWORK_TIMEOUT 3500
+#include "udpstats.h"
 
 typedef struct _ITEM_NETWORK_CONTEXT
 {
-	HWND hwnd;
-
 	R_QUEUED_LOCK lock_network;
 	R_QUEUED_LOCK lock_checker;
 
 	PR_HASHTABLE network_ptr;
 	PR_HASHTABLE checker_ptr;
+
+	SW_UDP_STATS *udp_stats;
+
+	HWND hwnd;
 } ITEM_NETWORK_CONTEXT, *PITEM_NETWORK_CONTEXT;
 
+PITEM_NETWORK_CONTEXT _app_network_getcontext ();
+
+VOID _app_network_stop ();
+
 VOID _app_network_initialize (
 	_In_ HWND hwnd
 );
@@ -30,15 +36,15 @@ VOID _app_network_generatetable (
 
 _Ret_maybenull_
 PITEM_NETWORK _app_network_getitem (
-	_In_ ULONG_PTR network_hash
+	_In_ ULONG network_hash
 );
 
 _Success_ (return != 0)
-ULONG_PTR _app_network_getappitem (
-	_In_ ULONG_PTR network_hash
+ULONG _app_network_getappitem (
+	_In_ ULONG network_hash
 );
 
-ULONG_PTR _app_network_gethash (
+ULONG _app_network_gethash (
 	_In_ ADDRESS_FAMILY af,
 	_In_ ULONG pid,
 	_In_opt_ LPCVOID remote_addr,
@@ -56,11 +62,11 @@ BOOLEAN _app_network_getpath (
 );
 
 BOOLEAN _app_network_isapphaveconnection (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 BOOLEAN _app_network_isitemfound (
-	_In_ ULONG_PTR network_hash
+	_In_ ULONG network_hash
 );
 
 BOOLEAN _app_network_isvalidconnection (
@@ -73,9 +79,9 @@ VOID _app_network_printlistviewtable (
 );
 
 VOID _app_network_removeitem (
-	_In_ ULONG_PTR network_hash
+	_In_ ULONG network_hash
 );
 
-NTSTATUS NTAPI _app_network_threadproc (
+VOID NTAPI _app_network_threadproc (
 	_In_ PVOID arglist
 );

src/notifications.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -7,11 +7,11 @@ typedef struct _NOTIFY_CONTEXT
 {
 	HWND hwnd;
 
-	HBITMAP hbmp_allow;
-	HBITMAP hbmp_block;
-	HBITMAP hbmp_cross;
-	HBITMAP hbmp_next;
-	HBITMAP hbmp_rules;
+	HICON hico_allow;
+	HICON hico_block;
+	HICON hico_cross;
+	HICON hico_next;
+	HICON hico_rules;
 
 	HFONT hfont_title;
 	HFONT hfont_link;
@@ -19,7 +19,7 @@ typedef struct _NOTIFY_CONTEXT
 
 	HICON hicon;
 
-	ULONG_PTR app_hash;
+	ULONG app_hash;
 } NOTIFY_CONTEXT, *PNOTIFY_CONTEXT;
 
 _Ret_maybenull_
@@ -34,7 +34,7 @@ PNOTIFY_CONTEXT _app_notify_getcontext (
 
 VOID _app_notify_setcontext (
 	_In_ HWND hwnd,
-	_In_opt_ PNOTIFY_CONTEXT context
+	_Inout_opt_ PNOTIFY_CONTEXT context
 );
 
 BOOLEAN _app_notify_command (
@@ -61,14 +61,16 @@ HICON _app_notify_getapp_icon (
 
 _Ret_maybenull_
 PITEM_LOG _app_notify_getobject (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
-ULONG_PTR _app_notify_getapp_id (
+_Success_ (return != 0)
+ULONG _app_notify_getapp_id (
 	_In_ HWND hwnd
 );
 
-ULONG_PTR _app_notify_getnextapp_id (
+_Success_ (return != 0)
+ULONG _app_notify_getnextapp_id (
 	_In_ HWND hwnd
 );
 
@@ -79,7 +81,7 @@ VOID _app_notify_setapp_icon (
 
 VOID _app_notify_setapp_id (
 	_In_ HWND hwnd,
-	_In_opt_ ULONG_PTR app_hash
+	_In_opt_ ULONG app_hash
 );
 
 VOID _app_notify_show (

src/packages.c

@@ -1,54 +1,43 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #include "global.h"
 
 BOOLEAN _app_package_isnotexists (
-	_In_ PR_STRING package_sid,
-	_In_opt_ ULONG_PTR app_hash
+	_In_ PR_STRING package_sid
 )
 {
-	if (!app_hash)
-		app_hash = _r_str_gethash2 (package_sid, TRUE);
+	ULONG app_hash;
+
+	app_hash = _r_str_gethash (&package_sid->sr, TRUE);
 
 	if (_app_isappfound (app_hash))
 		return TRUE;
 
-	// there we try to found new package (HACK!!!)
-	_app_package_getpackageslist ();
+	// there we try to found new packages (HACK!!!)
+	_app_package_getpackageslist (_r_app_gethwnd ());
 
-	if (_app_isappfound (app_hash))
-		return TRUE;
-
-	return FALSE;
+	return _app_isappfound (app_hash);
 }
 
 VOID _app_package_parsepath (
 	_Inout_ PR_STRING_PTR package_root_folder
 )
 {
-	static R_STRINGREF appx_names[] = {
-		PR_STRINGREF_INIT (L"AppxManifest.xml"),
-		PR_STRINGREF_INIT (L"VSAppxManifest.xml"),
-	};
-
-	static R_STRINGREF separator_sr = PR_STRINGREF_INIT (L"\\");
-
+	R_STRINGREF appx_names[] = {PR_STRINGREF_INIT (L"AppxManifest.xml"), PR_STRINGREF_INIT (L"VSAppxManifest.xml")}, separator_sr = PR_STRINGREF_INIT (L"\\");
 	R_XML_LIBRARY xml_library = {0};
-	PR_STRING manifest_path = NULL;
-	PR_STRING result_path = NULL;
-	PR_STRING path_string;
+	PR_STRING manifest_path = NULL, path_string, result_path = NULL;
 	R_STRINGREF executable_sr;
-	HRESULT status;
 	BOOLEAN is_success = FALSE;
+	HRESULT status;
 
 	path_string = *package_root_folder;
 
 	for (ULONG_PTR i = 0; i < RTL_NUMBER_OF (appx_names); i++)
 	{
-		_r_obj_movereference (&manifest_path, _r_obj_concatstringrefs (3, &path_string->sr, &separator_sr, &appx_names[i]));
+		_r_obj_movereference ((PVOID_PTR)&manifest_path, _r_obj_concatstringrefs (3, &path_string->sr, &separator_sr, &appx_names[i]));
 
-		if (_r_fs_exists (manifest_path->buffer))
+		if (_r_fs_isexists (&manifest_path->sr))
 		{
 			is_success = TRUE;
 			break;
@@ -75,12 +64,11 @@ VOID _app_package_parsepath (
 			if (FAILED (_r_xml_getattribute (&xml_library, L"Executable", &executable_sr)))
 				continue;
 
-			_r_obj_movereference (&result_path, _r_obj_concatstringrefs (3, &path_string->sr, &separator_sr, &executable_sr));
+			_r_obj_movereference ((PVOID_PTR)&result_path, _r_obj_concatstringrefs (3, &path_string->sr, &separator_sr, &executable_sr));
 
-			if (_r_fs_exists (result_path->buffer))
+			if (_r_fs_isexists (&result_path->sr))
 			{
-				_r_obj_swapreference (package_root_folder, result_path);
-
+				_r_obj_swapreference ((PVOID_PTR)package_root_folder, result_path);
 				break;
 			}
 		}
@@ -88,12 +76,12 @@ VOID _app_package_parsepath (
 
 CleanupExit:
 
-	if (result_path)
-		_r_obj_dereference (result_path);
-
 	if (manifest_path)
 		_r_obj_dereference (manifest_path);
 
+	if (result_path)
+		_r_obj_dereference (result_path);
+
 	_r_xml_destroylibrary (&xml_library);
 }
 
@@ -103,36 +91,38 @@ VOID _app_package_getpackagebyname (
 	_In_ PR_STRING key_name
 )
 {
-	WCHAR buffer[256];
-	PR_STRING display_name = NULL;
-	PR_STRING package_sid_string = NULL;
-	PR_STRING real_path = NULL;
+	PR_STRING display_name = NULL, package_sid_string = NULL, real_path = NULL;
 	PR_BYTE package_sid = NULL;
 	PITEM_APP ptr_app;
+	WCHAR buffer[0x100];
 	HANDLE hsubkey;
-	ULONG_PTR app_hash;
 	LONG64 timestamp;
+	ULONG app_hash;
 	NTSTATUS status;
 
 	_r_str_printf (buffer, RTL_NUMBER_OF (buffer), L"%s\\%s", path, key_name->buffer);
 
-	status = _r_reg_openkey (hroot, buffer, KEY_READ, &hsubkey);
+	status = _r_reg_openkey (&hsubkey, hroot, buffer, 0, KEY_READ);
 
 	if (!NT_SUCCESS (status))
+	{
+		_r_log (LOG_LEVEL_ERROR, NULL, TEXT (__FUNCTION__), buffer, status);
+
 		goto CleanupExit;
+	}
 
 	status = _r_reg_querybinary (hsubkey, L"PackageSid", &package_sid);
 
 	if (!NT_SUCCESS (status))
 		goto CleanupExit;
 
-	status = _r_str_fromsid (package_sid->buffer, &package_sid_string);
+	status = _r_str_fromsid (&package_sid_string, (PSID)(package_sid->buffer));
 
 	if (!NT_SUCCESS (status))
 		goto CleanupExit;
 
 	// already exists (skip)
-	app_hash = _r_str_gethash2 (package_sid_string, TRUE);
+	app_hash = _r_str_gethash (&package_sid_string->sr, TRUE);
 
 	if (_app_isappfound (app_hash))
 		goto CleanupExit;
@@ -145,37 +135,32 @@ VOID _app_package_getpackagebyname (
 		_app_package_parsepath (&real_path);
 
 	//_r_queuedlock_acquireexclusive (&lock_apps);
-	app_hash = _app_addapplication (NULL, DATA_APP_UWP, package_sid_string, display_name, real_path);
+	ptr_app = _app_addapplication (NULL, DATA_APP_UWP, package_sid_string, display_name, real_path);
 	//_r_queuedlock_releaseexclusive (&lock_apps);
 
-	if (app_hash)
+	if (ptr_app)
 	{
-		ptr_app = _app_getappitem (app_hash);
+		status = _r_reg_queryinfo (hsubkey, NULL, &timestamp);
 
-		if (ptr_app)
-		{
-			status = _r_reg_queryinfo (hsubkey, NULL, &timestamp);
+		if (NT_SUCCESS (status))
+			_app_setappinfo (ptr_app, INFO_TIMESTAMP, &timestamp);
 
-			if (NT_SUCCESS (status))
-				_app_setappinfo (ptr_app, INFO_TIMESTAMP, &timestamp);
+		_app_setappinfo (ptr_app, INFO_BYTES_DATA, _r_obj_reference (package_sid));
 
-			_app_setappinfo (ptr_app, INFO_BYTES_DATA, _r_obj_reference (package_sid));
-
-			_r_obj_dereference (ptr_app);
-		}
+		_r_obj_dereference (ptr_app);
 	}
 
 CleanupExit:
 
+	if (package_sid_string)
+		_r_obj_dereference (package_sid_string);
+
 	if (display_name)
 		_r_obj_dereference (display_name);
 
 	if (package_sid)
 		_r_obj_dereference (package_sid);
 
-	if (package_sid_string)
-		_r_obj_dereference (package_sid_string);
-
 	if (real_path)
 		_r_obj_dereference (real_path);
 
@@ -189,29 +174,31 @@ VOID _app_package_getpackagebysid (
 	_In_ PR_STRING key_name
 )
 {
-	WCHAR buffer[256];
-	PR_STRING display_name = NULL;
-	PR_STRING real_path = NULL;
-	PR_STRING moniker = NULL;
+	PR_STRING display_name = NULL, moniker = NULL, real_path = NULL;
 	PR_BYTE package_sid = NULL;
 	PITEM_APP ptr_app;
+	WCHAR buffer[0x100];
 	HANDLE hsubkey;
-	ULONG_PTR app_hash;
 	LONG64 timestamp = 0;
+	ULONG app_hash;
 	NTSTATUS status;
 
 	// already exists (skip)
-	app_hash = _r_str_gethash2 (key_name, TRUE);
+	app_hash = _r_str_gethash (&key_name->sr, TRUE);
 
 	if (_app_isappfound (app_hash))
 		return;
 
 	_r_str_printf (buffer, RTL_NUMBER_OF (buffer), L"%s\\%s", path, key_name->buffer);
 
-	status = _r_reg_openkey (hroot, buffer, KEY_READ, &hsubkey);
+	status = _r_reg_openkey (&hsubkey, hroot, buffer, 0, KEY_READ);
 
 	if (!NT_SUCCESS (status))
+	{
+		_r_log (LOG_LEVEL_ERROR, NULL, TEXT (__FUNCTION__), buffer, status);
+
 		goto CleanupExit;
+	}
 
 	package_sid = _r_str_tosid (key_name);
 
@@ -219,7 +206,7 @@ VOID _app_package_getpackagebysid (
 		goto CleanupExit;
 
 	// query package moniker
-	status = _r_reg_querystring (hsubkey, L"Moniker", &moniker);
+	status = _r_reg_querystring (hsubkey, L"Moniker", &moniker, NULL);
 
 	if (!NT_SUCCESS (status))
 		goto CleanupExit;
@@ -232,191 +219,306 @@ VOID _app_package_getpackagebysid (
 		_app_package_parsepath (&real_path);
 
 	//_r_queuedlock_acquireexclusive (&lock_apps);
-	app_hash = _app_addapplication (NULL, DATA_APP_UWP, key_name, display_name, NULL);
+	ptr_app = _app_addapplication (NULL, DATA_APP_UWP, key_name, display_name, NULL);
 	//_r_queuedlock_releaseexclusive (&lock_apps);
 
-	if (app_hash)
+	if (ptr_app)
 	{
-		ptr_app = _app_getappitem (app_hash);
+		status = _r_reg_queryinfo (hsubkey, NULL, &timestamp);
 
-		if (ptr_app)
-		{
-			status = _r_reg_queryinfo (hsubkey, NULL, &timestamp);
+		if (NT_SUCCESS (status))
+			_app_setappinfo (ptr_app, INFO_TIMESTAMP, &timestamp);
 
-			if (NT_SUCCESS (status))
-				_app_setappinfo (ptr_app, INFO_TIMESTAMP, &timestamp);
+		_app_setappinfo (ptr_app, INFO_BYTES_DATA, _r_obj_reference (package_sid));
 
-			_app_setappinfo (ptr_app, INFO_BYTES_DATA, _r_obj_reference (package_sid));
-
-			_r_obj_dereference (ptr_app);
-		}
+		_r_obj_dereference (ptr_app);
 	}
 
 CleanupExit:
 
-	if (moniker)
-		_r_obj_dereference (moniker);
-
 	if (display_name)
 		_r_obj_dereference (display_name);
 
+	if (package_sid)
+		_r_obj_dereference (package_sid);
+
 	if (real_path)
 		_r_obj_dereference (real_path);
 
-	if (package_sid)
-		_r_obj_dereference (package_sid);
+	if (moniker)
+		_r_obj_dereference (moniker);
 
 	if (hsubkey)
 		NtClose (hsubkey);
 }
 
-BOOLEAN _app_parse_callback (
-	_In_ HANDLE hroot,
-	_In_ PVOID buffer,
-	_In_opt_ PVOID context
+VOID NTAPI _app_package_threadproc (
+	_In_ PVOID arglist
 )
 {
-	PKEY_BASIC_INFORMATION basic_info;
-	PPACKAGE_CONTEXT mycntx;
-	PR_STRING key_name;
-
-	basic_info = buffer;
-
-	if (!context)
-		return FALSE;
-
-	mycntx = context;
-
-	key_name = _r_obj_createstring_ex (basic_info->Name, basic_info->NameLength);
-
-	if (mycntx->is_byname)
-	{
-		_app_package_getpackagebyname (HKEY_CURRENT_USER, mycntx->path, key_name);
-	}
-	else
-	{
-		_app_package_getpackagebysid (HKEY_CURRENT_USER, mycntx->path, key_name);
-	}
-
-	_r_obj_dereference (key_name);
-
-	return TRUE;
-}
-
-VOID _app_package_getpackageslist ()
-{
-	static LPWSTR reg_byname = L"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages";
-	static LPWSTR reg_bysid = L"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings";
-
-	PACKAGE_CONTEXT context = {0};
-	HANDLE hkey;
+	HANDLE hpackages_key = NULL, hservices_key = NULL, event_handle1 = NULL, event_handle2 = NULL, hevents[2] = {0};
+	PITEM_APP ptr_app = NULL;
+	IO_STATUS_BLOCK isb;
+	HWND hwnd;
+	LONG64 current_time;
+	ULONG_PTR enum_key = 0;
+	ULONG flags = REG_NOTIFY_CHANGE_NAME;
 	NTSTATUS status;
 
-	// query packages by name
-	status = _r_reg_openkey (HKEY_CURRENT_USER, reg_byname, KEY_READ, &hkey);
+	hwnd = (HWND)arglist;
+
+	status = NtCreateEvent (&event_handle1, EVENT_ALL_ACCESS, NULL, NotificationEvent, FALSE);
 
 	if (!NT_SUCCESS (status))
 	{
-		_r_log (LOG_LEVEL_WARNING, NULL, L"_r_reg_openkey", status, reg_byname);
+		_r_show_errormessage (hwnd, L"Could not create event!", NULL, status, ET_NATIVE);
+
+		return;
+	}
+
+	status = NtCreateEvent (&event_handle2, EVENT_ALL_ACCESS, NULL, NotificationEvent, FALSE);
+
+	if (!NT_SUCCESS (status))
+	{
+		_r_show_errormessage (hwnd, L"Could not create event!", NULL, status, ET_NATIVE);
+
+		NtClose (event_handle1); // do not left handle opened!
+
+		return;
+	}
+
+	hevents[0] = event_handle1;
+	hevents[1] = event_handle2;
+
+	status = _r_reg_openkey (&hservices_key, HKEY_LOCAL_MACHINE, L"System\\CurrentControlSet\\Services", 0, KEY_NOTIFY);
+
+	if (_r_sys_isosversiongreaterorequal (WINDOWS_8))
+	{
+		_r_reg_openkey (&hpackages_key, HKEY_CURRENT_USER, L"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages", 0, KEY_NOTIFY);
+
+		flags |= REG_NOTIFY_THREAD_AGNOSTIC;
+	}
+
+	if (NT_SUCCESS (status))
+	{
+		NtNotifyChangeKey (hservices_key, event_handle1, NULL, NULL, &isb, flags, TRUE, NULL, 0, TRUE);
+
+		if (hpackages_key)
+			NtNotifyChangeKey (hpackages_key, event_handle2, NULL, NULL, &isb, flags, TRUE, NULL, 0, TRUE);
+
+		while (TRUE)
+		{
+			status = _r_sys_waitformultipleobjects (RTL_NUMBER_OF (hevents), hevents, INFINITE, FALSE);
+
+			if (status == STATUS_WAIT_0)
+			{
+				_r_listview_deleteallitems (hwnd, IDC_APPS_SERVICE);
+
+				_app_package_getserviceslist (hwnd);
+
+				// add apps
+				current_time = _r_unixtime_now ();
+
+				enum_key = 0;
+
+				_r_queuedlock_acquireshared (&lock_apps);
+
+				while (_r_obj_enumhashtablepointer (apps_table, (PVOID_PTR)&ptr_app, NULL, &enum_key))
+				{
+					if (ptr_app->type == DATA_APP_SERVICE)
+					{
+						_app_listview_addappitem (hwnd, ptr_app);
+
+						// install timer
+						if (ptr_app->timer)
+							_app_timer_set (hwnd, ptr_app, ptr_app->timer - current_time);
+					}
+				}
+
+				_r_queuedlock_releaseshared (&lock_apps);
+
+				NtNotifyChangeKey (hservices_key, event_handle1, NULL, NULL, &isb, flags, TRUE, NULL, 0, TRUE); // reset
+			}
+			else if (status == STATUS_WAIT_1)
+			{
+				_r_listview_deleteallitems (hwnd, IDC_APPS_UWP);
+
+				_app_package_getpackageslist (hwnd);
+
+				// add apps
+				current_time = _r_unixtime_now ();
+
+				enum_key = 0;
+
+				_r_queuedlock_acquireshared (&lock_apps);
+
+				while (_r_obj_enumhashtablepointer (apps_table, (PVOID_PTR)&ptr_app, NULL, &enum_key))
+				{
+					if (ptr_app->type == DATA_APP_UWP)
+					{
+						_app_listview_addappitem (hwnd, ptr_app);
+
+						// install timer
+						if (ptr_app->timer)
+							_app_timer_set (hwnd, ptr_app, ptr_app->timer - current_time);
+					}
+				}
+
+				_r_queuedlock_releaseshared (&lock_apps);
+
+				if (hpackages_key)
+					NtNotifyChangeKey (hpackages_key, event_handle2, NULL, NULL, &isb, flags, TRUE, NULL, 0, TRUE); // reset
+			}
+			else
+			{
+				break;
+			}
+		}
+	}
+
+	if (hservices_key)
+		NtClose (hservices_key);
+
+	if (hpackages_key)
+		NtClose (hpackages_key);
+
+	NtClose (event_handle1);
+	NtClose (event_handle2);
+}
+
+VOID _app_package_getpackageslist (
+	_In_opt_ HWND hwnd
+)
+{
+	LPCWSTR reg_byname = L"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages";
+	LPCWSTR reg_bysid = L"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings";
+	PR_STRING name;
+	HANDLE hkey;
+	ULONG index = 0;
+	NTSTATUS status;
+
+	// query packages by name
+	status = _r_reg_openkey (&hkey, HKEY_CURRENT_USER, reg_byname, 0, KEY_READ);
+
+	if (!NT_SUCCESS (status))
+	{
+		if (hwnd && status != STATUS_OBJECT_NAME_NOT_FOUND)
+			_r_show_errormessage (hwnd, L"Could not query packages by name!", reg_byname, status, ET_NATIVE);
 	}
 	else
 	{
-		_r_str_copy (context.path, RTL_NUMBER_OF (context.path), reg_byname);
-		context.is_byname = TRUE;
+		while (TRUE)
+		{
+			status = _r_reg_enumkey (hkey, index, &name, NULL);
 
-		status = _r_reg_enumkey (hkey, KeyBasicInformation, &_app_parse_callback, &context);
+			if (!NT_SUCCESS (status))
+				break;
 
-		if (!NT_SUCCESS (status))
-			_r_log (LOG_LEVEL_WARNING, NULL, L"_r_reg_enumkey", status, reg_byname);
+			_app_package_getpackagebyname (HKEY_CURRENT_USER, reg_byname, name);
+
+			_r_obj_dereference (name);
+
+			index += 1;
+		}
 
 		NtClose (hkey);
 	}
 
 	// query packages by sid
-	status = _r_reg_openkey (HKEY_CURRENT_USER, reg_bysid, KEY_READ, &hkey);
+	status = _r_reg_openkey (&hkey, HKEY_CURRENT_USER, reg_bysid, 0, KEY_READ);
 
 	if (!NT_SUCCESS (status))
 	{
-		_r_log (LOG_LEVEL_WARNING, NULL, L"_r_reg_openkey", status, reg_bysid);
+		if (hwnd && status != STATUS_OBJECT_NAME_NOT_FOUND)
+			_r_show_errormessage (hwnd, L"Could not query packages by sid!", reg_bysid, status, ET_NATIVE);
 	}
 	else
 	{
-		_r_str_copy (context.path, RTL_NUMBER_OF (context.path), reg_bysid);
-		context.is_byname = FALSE;
+		index = 0;
 
-		status = _r_reg_enumkey (hkey, KeyBasicInformation, &_app_parse_callback, &context);
+		while (TRUE)
+		{
+			status = _r_reg_enumkey (hkey, index, &name, NULL);
 
-		if (!NT_SUCCESS (status))
-			_r_log (LOG_LEVEL_WARNING, NULL, L"_r_reg_enumkey", status, reg_bysid);
+			if (!NT_SUCCESS (status))
+				break;
+
+			_app_package_getpackagebysid (HKEY_CURRENT_USER, reg_bysid, name);
+
+			_r_obj_dereference (name);
+
+			index += 1;
+		}
 
 		NtClose (hkey);
 	}
 }
 
-VOID _app_package_getserviceslist ()
+VOID _app_package_getserviceslist (
+	_In_opt_ HWND hwnd
+)
 {
-	static ULONG initial_buffer_size = 0x8000;
-
-	SC_HANDLE hsvcmgr;
-	WCHAR general_key[256];
-	EXPLICIT_ACCESS ea;
-	LPENUM_SERVICE_STATUS_PROCESS service;
-	LPENUM_SERVICE_STATUS_PROCESS services;
-	PVOID service_sd;
-	PR_STRING service_name;
-	PR_STRING service_path;
-	PR_BYTE service_sid;
-	LONG64 service_timestamp;
-	ULONG_PTR app_hash;
-	ULONG service_type;
-	ULONG service_state;
-	ULONG sd_length;
-	PR_STRING name_string;
-	PITEM_APP ptr_app;
+	PR_STRING converted_path, name_string, service_name, service_path;
+	LPENUM_SERVICE_STATUS_PROCESS service, services;
+	PVOID buffer, service_sd = NULL;
 	R_STRINGREF dummy_filename;
-	R_STRINGREF dummy_argument;
-	PR_STRING converted_path;
-	PVOID buffer;
+	WCHAR general_key[0x100];
+	PR_BYTE service_sid;
+	EXPLICIT_ACCESS ea;
+	PITEM_APP ptr_app;
+	SC_HANDLE hsvcmgr;
 	HANDLE hkey;
-	ULONG buffer_size;
-	ULONG return_length;
-	ULONG services_returned;
+	LONG64 service_timestamp;
+	ULONG buffer_size, return_length, sd_length, services_returned, service_type = SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS;
 	NTSTATUS status;
 
 	hsvcmgr = OpenSCManagerW (NULL, NULL, SC_MANAGER_CONNECT | SC_MANAGER_ENUMERATE_SERVICE);
 
 	if (!hsvcmgr)
-		return;
+	{
+		if (hwnd)
+		{
+			_r_show_errormessage (hwnd, L"Could not open service manager!", NULL, NtLastError (), ET_WINDOWS);
+		}
+		else
+		{
+			_r_log (LOG_LEVEL_ERROR, NULL, L"OpenSCManagerW", NULL, NtLastError ());
+		}
 
-	service_type = SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS;
-	service_state = SERVICE_STATE_ALL;
+		return;
+	}
 
 	// win10+
 	if (_r_sys_isosversiongreaterorequal (WINDOWS_10))
+	{
 		service_type |= SERVICE_INTERACTIVE_PROCESS | SERVICE_USER_SERVICE;
 
-	buffer_size = initial_buffer_size;
+		if (_r_config_getboolean (L"IsCollectUserServiceInstance", FALSE, NULL))
+			service_type |= SERVICE_USERSERVICE_INSTANCE;
+	}
+
+	buffer_size = PR_SIZE_BUFFER;
 	buffer = _r_mem_allocate (buffer_size);
 
-	if (!EnumServicesStatusExW (hsvcmgr, SC_ENUM_PROCESS_INFO, service_type, service_state, buffer, buffer_size, &return_length, &services_returned, NULL, NULL))
+	if (!EnumServicesStatusExW (hsvcmgr, SC_ENUM_PROCESS_INFO, service_type, SERVICE_STATE_ALL, (PBYTE)buffer, buffer_size, &return_length, &services_returned, NULL, NULL))
 	{
 		if (NtLastError () == ERROR_MORE_DATA)
 		{
-			// Set the buffer
+			// reallocate new buffer
 			buffer_size += return_length;
 			buffer = _r_mem_reallocate (buffer, buffer_size);
 
-			// Now query again for services
-			if (!EnumServicesStatusExW (hsvcmgr, SC_ENUM_PROCESS_INFO, service_type, service_state, buffer, buffer_size, &return_length, &services_returned, NULL, NULL))
+			// now query again for services
+			if (!EnumServicesStatusExW (hsvcmgr, SC_ENUM_PROCESS_INFO, service_type, SERVICE_STATE_ALL, (PBYTE)buffer, buffer_size, &return_length, &services_returned, NULL, NULL))
 			{
-				_r_mem_free (buffer);
+				_r_mem_free (buffer); // cleanup!
 
 				buffer = NULL;
 			}
 		}
 		else
 		{
-			_r_mem_free (buffer);
+			_r_mem_free (buffer); // cleanup!
 
 			buffer = NULL;
 		}
@@ -425,7 +527,6 @@ VOID _app_package_getserviceslist ()
 	if (!buffer)
 	{
 		CloseServiceHandle (hsvcmgr);
-
 		return;
 	}
 
@@ -436,106 +537,83 @@ VOID _app_package_getserviceslist ()
 	{
 		service = &services[i];
 
-		app_hash = _r_str_gethash (service->lpServiceName, TRUE);
-
-		if (_app_isappfound (app_hash))
+		if (_app_isappfound (_r_str_gethash2 (service->lpServiceName, TRUE)))
 			continue;
 
-		_r_str_printf (general_key, RTL_NUMBER_OF (general_key), L"System\\CurrentControlSet\\Services\\%s", service->lpServiceName);
+		_r_str_printf (general_key, RTL_NUMBER_OF (general_key), L"SYSTEM\\CurrentControlSet\\Services\\%s", service->lpServiceName);
 
-		service_name = _r_obj_createstring (service->lpServiceName);
-
-		status = _r_reg_openkey (HKEY_LOCAL_MACHINE, general_key, KEY_READ, &hkey);
+		status = _r_reg_openkey (&hkey, HKEY_LOCAL_MACHINE, general_key, 0, KEY_READ);
 
 		if (!NT_SUCCESS (status))
-		{
-			_r_obj_dereference (service_name);
-
 			continue;
-		}
 
 		// skip userservice instances service types (win10+)
-		if (_r_sys_isosversiongreaterorequal (WINDOWS_10))
+		if (_r_sys_isosversiongreaterorequal (WINDOWS_10) && !_r_config_getboolean (L"IsCollectUserServiceInstance", FALSE, NULL))
 		{
 			status = _r_reg_queryulong (hkey, L"Type", &service_type);
 
 			if (!NT_SUCCESS (status) || (service_type & SERVICE_USERSERVICE_INSTANCE) != 0)
 			{
-				_r_obj_dereference (service_name);
-
 				NtClose (hkey);
-
 				continue;
 			}
 		}
 
 		// query service path
-		status = _r_reg_querystring (hkey, L"ImagePath", &service_path);
+		status = _r_reg_querystring (hkey, L"ImagePath", &service_path, NULL);
 
 		if (NT_SUCCESS (status))
 		{
-			_r_path_parsecommandlinefuzzy (&service_path->sr, &dummy_filename, &dummy_argument, &converted_path);
+			_r_path_parsecommandlinefuzzy (&service_path->sr, &dummy_filename, NULL, &converted_path);
 
 			if (converted_path)
 			{
-				_r_obj_movereference (&service_path, converted_path);
+				_r_obj_movereference ((PVOID_PTR)&service_path, converted_path);
 			}
 			else
 			{
-				converted_path = _r_path_dospathfromnt (service_path);
-
-				if (converted_path)
-					_r_obj_movereference (&service_path, converted_path);
+				_r_obj_movereference ((PVOID_PTR)&service_path, _r_path_dospathfromnt (&service_path->sr));
 			}
 
 			// query service sid
-			status = _r_sys_getservicesid (service->lpServiceName, &service_sid);
+			status = _r_sys_getservicesid (&service_sid, service->lpServiceName);
 
 			if (NT_SUCCESS (status))
 			{
-				// When evaluating SECURITY_DESCRIPTOR conditions, the filter engine
-				// checks for FWP_ACTRL_MATCH_FILTER access. If the DACL grants access,
-				// it does not mean that the traffic is allowed; it just means that the
-				// condition evaluates to true. Likewise if it denies access, the
-				// condition evaluates to false.
-
-				_app_setexplicitaccess (&ea, GRANT_ACCESS, FWP_ACTRL_MATCH_FILTER, NO_INHERITANCE, service_sid->buffer);
-
-				// Security descriptors must be in self-relative form (i.e., contiguous).
-				// The security descriptor returned by BuildSecurityDescriptorW is
-				// already self-relative, but if you're using another mechanism to build
-				// the descriptor, you may have to convert it. See MakeSelfRelativeSD for
-				// details.
+				// when evaluating SECURITY_DESCRIPTOR conditions, the filter engine checks for FWP_ACTRL_MATCH_FILTER access.
+				// if the DACL grants access, it does not mean that the traffic is allowed; it just means that the condition
+				// evaluates to true. likewise if it denies access, the condition evaluates to FALSE.
+				_app_setexplicitaccess (&ea, NO_INHERITANCE, GRANT_ACCESS, FWP_ACTRL_MATCH_FILTER, (PSID)(service_sid->buffer));
 
+				// security descriptors must be in self-relative form (i.e., contiguous). the security descriptor returned
+				// by BuildSecurityDescriptorW is already self-relative, but if you're using another mechanism to build
+				// the descriptor, you may have to convert it. see MakeSelfRelativeSD for details.
 				status = BuildSecurityDescriptorW (NULL, NULL, 1, &ea, 0, NULL, NULL, &sd_length, &service_sd);
 
 				if (status == ERROR_SUCCESS && service_sd)
 				{
+					service_name = _r_obj_createstring (service->lpServiceName);
 					name_string = _r_obj_createstring (service->lpDisplayName);
 
-					app_hash = _app_addapplication (NULL, DATA_APP_SERVICE, service_name, name_string, service_path);
+					ptr_app = _app_addapplication (NULL, DATA_APP_SERVICE, service_name, name_string, service_path);
 
-					if (app_hash)
+					if (ptr_app)
 					{
-						ptr_app = _app_getappitem (app_hash);
+						// query service timestamp
+						status = _r_reg_queryinfo (hkey, NULL, &service_timestamp);
 
-						if (ptr_app)
-						{
-							// query service timestamp
-							status = _r_reg_queryinfo (hkey, NULL, &service_timestamp);
+						if (NT_SUCCESS (status))
+							_app_setappinfo (ptr_app, INFO_TIMESTAMP, &service_timestamp);
 
-							if (NT_SUCCESS (status))
-								_app_setappinfo (ptr_app, INFO_TIMESTAMP, &service_timestamp);
+						_app_setappinfo (ptr_app, INFO_BYTES_DATA, _r_obj_createbyte_ex ((LPCSTR)service_sd, sd_length));
 
-							_app_setappinfo (ptr_app, INFO_BYTES_DATA, _r_obj_createbyte_ex (service_sd, sd_length));
-
-							_r_obj_dereference (ptr_app);
-						}
+						_r_obj_dereference (ptr_app);
 					}
 
-					LocalFree (service_sd);
-
+					_r_obj_dereference (service_name);
 					_r_obj_dereference (name_string);
+
+					LocalFree (service_sd);
 				}
 
 				_r_obj_dereference (service_sid);
@@ -544,12 +622,10 @@ VOID _app_package_getserviceslist ()
 			_r_obj_dereference (service_path);
 		}
 
-		_r_obj_dereference (service_name);
-
 		NtClose (hkey);
 	}
 
-	_r_mem_free (buffer);
-
 	CloseServiceHandle (hsvcmgr);
+
+	_r_mem_free (buffer);
 }

src/packages.h

@@ -1,11 +1,10 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
 BOOLEAN _app_package_isnotexists (
-	_In_ PR_STRING package_sid,
-	_In_opt_ ULONG_PTR app_hash
+	_In_ PR_STRING package_sid
 );
 
 VOID _app_package_parsepath (
@@ -24,5 +23,14 @@ VOID _app_package_getpackagebysid (
 	_In_ PR_STRING key_name
 );
 
-VOID _app_package_getpackageslist ();
-VOID _app_package_getserviceslist ();
+VOID NTAPI _app_package_threadproc (
+	_In_ PVOID arglist
+);
+
+VOID _app_package_getpackageslist (
+	_In_opt_ HWND hwnd
+);
+
+VOID _app_package_getserviceslist (
+	_In_opt_ HWND hwnd
+);

src/profile.h

@@ -1,8 +1,18 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
+FORCEINLINE BOOLEAN _app_isdisabledremoval (
+	_In_ ULONG app_hash
+)
+{
+	if (app_hash == config.my_hash || app_hash == config.ntoskrnl_hash || app_hash == config.svchost_hash || app_hash == config.wusvc_hash)
+		return TRUE;
+
+	return FALSE;
+}
+
 _Success_ (return)
 BOOLEAN _app_getappinfo (
 	_In_ PITEM_APP ptr_app,
@@ -13,20 +23,22 @@ BOOLEAN _app_getappinfo (
 
 _Success_ (return)
 BOOLEAN _app_getappinfobyhash (
-	_In_ ULONG_PTR app_hash,
+	_In_ ULONG app_hash,
 	_In_ ENUM_INFO_DATA info_data,
 	_Out_writes_bytes_all_ (length) PVOID buffer,
 	_In_ ULONG_PTR length
 );
 
-VOID _app_setappinfo (
+_Success_ (return)
+BOOLEAN _app_setappinfo (
 	_In_ PITEM_APP ptr_app,
 	_In_ ENUM_INFO_DATA info_data,
 	_In_opt_ PVOID value
 );
 
-VOID _app_setappinfobyhash (
-	_In_ ULONG_PTR app_hash,
+_Success_ (return)
+BOOLEAN _app_setappinfobyhash (
+	_In_ ULONG app_hash,
 	_In_ ENUM_INFO_DATA info_data,
 	_In_opt_ PVOID value
 );
@@ -47,8 +59,8 @@ BOOLEAN _app_getruleinfobyid (
 	_In_ ULONG_PTR length
 );
 
-_Success_ (return != 0)
-ULONG_PTR _app_addapplication (
+_Ret_maybenull_
+PITEM_APP _app_addapplication (
 	_In_opt_ HWND hwnd,
 	_In_ ENUM_TYPE_DATA type,
 	_In_ PR_STRING path,
@@ -69,14 +81,14 @@ PITEM_RULE _app_addrule (
 _Ret_maybenull_
 PITEM_RULE_CONFIG _app_addruleconfigtable (
 	_In_ PR_HASHTABLE hashtable,
-	_In_ ULONG_PTR rule_hash,
+	_In_ ULONG rule_hash,
 	_In_ PR_STRING rule_name,
 	_In_ BOOLEAN is_enabled
 );
 
 _Ret_maybenull_
 PITEM_APP _app_getappitem (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 _Ret_maybenull_
@@ -86,39 +98,46 @@ PITEM_RULE _app_getrulebyid (
 
 _Ret_maybenull_
 PITEM_RULE _app_getrulebyhash (
-	_In_ ULONG_PTR rule_hash
+	_In_ ULONG rule_hash
 );
 
 _Ret_maybenull_
 PITEM_RULE_CONFIG _app_getruleconfigitem (
-	_In_ ULONG_PTR rule_hash
+	_In_ ULONG rule_hash
 );
 
 _Ret_maybenull_
 PITEM_LOG _app_getlogitem (
-	_In_ ULONG_PTR log_hash
+	_In_ ULONG log_hash
 );
 
 _Success_ (return != 0)
-ULONG_PTR _app_getlogapp (
-	_In_ ULONG_PTR index
+ULONG _app_getlogapp (
+	_In_ ULONG index
 );
 
+_Success_ (return != 0)
 COLORREF _app_getappcolor (
 	_In_ INT listview_id,
-	_In_ ULONG_PTR app_hash,
+	_In_ ULONG app_hash,
 	_In_ BOOLEAN is_systemapp,
 	_In_ BOOLEAN is_validconnection
 );
 
+VOID _app_deleteappitem (
+	_In_ HWND hwnd,
+	_In_ ENUM_TYPE_DATA type,
+	_In_ ULONG_PTR id_code
+);
+
 VOID _app_freeapplication (
 	_In_opt_ HWND hwnd,
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 BOOLEAN _app_isappfromsystem (
 	_In_opt_ PR_STRING path,
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 BOOLEAN _app_isapphavedrive (
@@ -126,7 +145,7 @@ BOOLEAN _app_isapphavedrive (
 );
 
 BOOLEAN _app_isapphaverule (
-	_In_ ULONG_PTR app_hash,
+	_In_ ULONG app_hash,
 	_In_ BOOLEAN is_countdisabled
 );
 
@@ -135,7 +154,7 @@ BOOLEAN _app_isappexists (
 );
 
 BOOLEAN _app_isappfound (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 BOOLEAN _app_isappunused (
@@ -147,13 +166,14 @@ BOOLEAN _app_isappused (
 );
 
 BOOLEAN _app_issystemhash (
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 VOID _app_getcount (
 	_Out_ PITEM_STATUS status
 );
 
+_Success_ (return != 0)
 COLORREF _app_getrulecolor (
 	_In_ INT listview_id,
 	_In_ ULONG_PTR rule_idx
@@ -180,18 +200,11 @@ VOID _app_ruleenable (
 	_In_ BOOLEAN is_createconfig
 );
 
-//VOID _app_rulecleanapp (
-//	_In_opt_ HWND hwnd,
-//	_In_ ULONG_PTR item_id,
-//	_In_ PITEM_RULE ptr_rule,
-//	_In_opt_ ULONG_PTR app_hash
-//);
-
 VOID _app_ruleremoveapp (
 	_In_opt_ HWND hwnd,
 	_In_ ULONG_PTR item_id,
 	_In_ PITEM_RULE ptr_rule,
-	_In_ ULONG_PTR app_hash
+	_In_ ULONG app_hash
 );
 
 BOOLEAN _app_ruleblocklistsetchange (
@@ -216,42 +229,31 @@ VOID _app_ruleblocklistset (
 
 _Ret_maybenull_
 PR_STRING _app_appexpandrules (
-	_In_ ULONG_PTR app_hash,
-	_In_ LPWSTR delimeter
+	_In_ ULONG app_hash,
+	_In_ LPCWSTR delimeter
 );
 
 _Ret_maybenull_
 PR_STRING _app_rulesexpandapps (
 	_In_ PITEM_RULE ptr_rule,
 	_In_ BOOLEAN is_fordisplay,
-	_In_ LPWSTR delimeter
+	_In_ LPCWSTR delimeter
 );
 
 _Ret_maybenull_
 PR_STRING _app_rulesexpandrules (
-	_In_opt_ PR_STRING rule,
-	_In_ LPWSTR delimeter
+	_In_opt_ PR_STRING rule
 );
 
 BOOLEAN _app_isrulesupportedbyos (
-	_In_ PR_STRINGREF os_version
+	_In_ PCR_STRINGREF os_version
 );
 
-FORCEINLINE BOOLEAN _app_isdisabledremoval (
-	_In_ ULONG_PTR app_hash
-)
-{
-	if (app_hash == config.my_hash || app_hash == config.ntoskrnl_hash || app_hash == config.svchost_hash || app_hash == config.wusvc_hash)
-		return TRUE;
-
-	return FALSE;
-}
-
 VOID _app_profile_initialize ();
 
 NTSTATUS _app_profile_load_fromresource (
-	_In_ LPCWSTR resource_name,
-	_Out_ PDB_INFORMATION out_buffer
+	_Out_ PDB_INFORMATION db_info,
+	_In_ LPCWSTR resource_name
 );
 
 VOID _app_profile_load_fallback ();

src/res/manifest.xml

@@ -6,7 +6,7 @@
 		</dependentAssembly>
 	</dependency>
 
-	<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
+	<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
 		<security>
 			<requestedPrivileges>
 				<requestedExecutionLevel level="asInvoker" uiAccess="false" />
@@ -16,9 +16,11 @@
 
 	<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
 		<application>
-			<maxversiontested Id="10.0.19045.0"/>
-			<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" /> <!-- win8.1 -->
-			<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" /> <!-- win10 -->
+			<maxversiontested Id="10.0.26200.0" />
+			<supportedOS Id="{35138B9A-5D96-4FBD-8E2D-A2440225F93A}" /> <!-- win7 -->
+			<supportedOS Id="{4A2F28E3-53B9-4441-BA9C-D69D4A4A6E38}" /> <!-- win8 -->
+			<supportedOS Id="{1F676C76-80E1-4239-95BB-83D0F6D0DA78}" /> <!-- win8.1 -->
+			<supportedOS Id="{8E0F7A12-BFB3-4FE8-B9A5-48FD50A15A9A}" /> <!-- win10 -->
 		</application>
 	</compatibility>
 

src/resource.h

@@ -84,221 +84,227 @@
 
 #define IDC_USESTEALTHMODE_CHK 145
 #define IDC_INSTALLBOOTTIMEFILTERS_CHK 146
+#define IDC_ALLOWIPFORWARDING_CHK 147
 
-#define IDC_USECERTIFICATES_CHK 147
-#define IDC_USEHASHES_CHK 148
+#define IDC_USECERTIFICATES_CHK 148
+#define IDC_USEHASHES_CHK 149
 
-#define IDC_USENETWORKRESOLUTION_CHK 149
+#define IDC_USENETWORKRESOLUTION_CHK 150
 
-#define IDC_BLOCKLIST_SPY_DISABLE 150
-#define IDC_BLOCKLIST_SPY_ALLOW 151
-#define IDC_BLOCKLIST_SPY_BLOCK 152
+#define IDC_BLOCKLIST_SPY_DISABLE 151
+#define IDC_BLOCKLIST_SPY_ALLOW 152
+#define IDC_BLOCKLIST_SPY_BLOCK 153
 
-#define IDC_BLOCKLIST_UPDATE_DISABLE 153
-#define IDC_BLOCKLIST_UPDATE_ALLOW 154
-#define IDC_BLOCKLIST_UPDATE_BLOCK 155
+#define IDC_BLOCKLIST_UPDATE_DISABLE 154
+#define IDC_BLOCKLIST_UPDATE_ALLOW 155
+#define IDC_BLOCKLIST_UPDATE_BLOCK 156
 
-#define IDC_BLOCKLIST_EXTRA_DISABLE 156
-#define IDC_BLOCKLIST_EXTRA_ALLOW 157
-#define IDC_BLOCKLIST_EXTRA_BLOCK 158
+#define IDC_BLOCKLIST_EXTRA_DISABLE 157
+#define IDC_BLOCKLIST_EXTRA_ALLOW 158
+#define IDC_BLOCKLIST_EXTRA_BLOCK 159
 
-#define IDC_BLOCKLIST_INFO 159
+#define IDC_BLOCKLIST_INFO 160
 
-#define IDC_CONFIRMEXIT_CHK 160
-#define IDC_CONFIRMEXITTIMER_CHK 161
-#define IDC_CONFIRMLOGCLEAR_CHK 162
-#define IDC_CONFIRMALLOW_CHK 163
+#define IDC_CONFIRMEXIT_CHK 161
+#define IDC_CONFIRMEXITTIMER_CHK 162
+#define IDC_CONFIRMLOGCLEAR_CHK 163
+#define IDC_CONFIRMALLOW_CHK 164
 
-#define IDC_TRAYICONSINGLECLICK_CHK 164
+#define IDC_TRAYICONSINGLECLICK_CHK 165
 
-#define IDC_COLORS 165
-#define IDC_COLORS_HINT 166
+#define IDC_COLORS 166
+#define IDC_COLORS_HINT 167
 
-#define IDC_ENABLENOTIFICATIONS_CHK 167
-#define IDC_NOTIFICATIONSOUND_CHK 168
-#define IDC_NOTIFICATIONFULLSCREENSILENTMODE_CHK 169
-#define IDC_NOTIFICATIONONTRAY_CHK 170
-#define IDC_NOTIFICATIONTIMEOUT_HINT 171
-#define IDC_NOTIFICATIONTIMEOUT_CTRL 172
-#define IDC_NOTIFICATIONTIMEOUT 173
-#define IDC_EXCLUDESTEALTH_CHK 174
-#define IDC_EXCLUDECLASSIFYALLOW_CHK 175
-#define IDC_EXCLUDEBLOCKLIST_CHK 176
-#define IDC_EXCLUDECUSTOM_CHK 177
+#define IDC_ENABLENOTIFICATIONS_CHK 168
+#define IDC_NOTIFICATIONSOUND_CHK 169
+#define IDC_NOTIFICATIONFULLSCREENSILENTMODE_CHK 170
+#define IDC_NOTIFICATIONONTRAY_CHK 171
+#define IDC_NOTIFICATIONTIMEOUT_HINT 172
+#define IDC_NOTIFICATIONTIMEOUT_CTRL 173
+#define IDC_NOTIFICATIONTIMEOUT 174
+#define IDC_EXCLUDESTEALTH_CHK 175
+#define IDC_EXCLUDECLASSIFYALLOW_CHK 176
+#define IDC_EXCLUDEBLOCKLIST_CHK 177
+#define IDC_EXCLUDECUSTOM_CHK 178
+#define IDC_EXCLUDEINBOUND_CHK 179
 
-#define IDC_ENABLELOG_CHK 178
-#define IDC_LOGPATH 179
-#define IDC_LOGPATH_BTN 180
+#define IDC_ENABLELOG_CHK 180
+#define IDC_LOGPATH 181
+#define IDC_LOGPATH_BTN 182
 
-#define IDC_ENABLEUILOG_CHK 181
+#define IDC_LOGVIEWER 183
+#define IDC_LOGVIEWER_BTN 184
 
-#define IDC_LOGVIEWER 182
-#define IDC_LOGVIEWER_BTN 183
+#define IDC_ENABLEUILOG_CHK 185
 
-#define IDC_LOGSIZELIMIT_HINT 184
-#define IDC_LOGSIZELIMIT_CTRL 185
-#define IDC_LOGSIZELIMIT 186
+#define IDC_LOGSIZELIMIT_HINT 186
+#define IDC_LOGSIZELIMIT_CTRL 187
+#define IDC_LOGSIZELIMIT 188
 
 // Notification Dlg
-#define IDC_HEADER_ID 187
-#define IDC_FILE_TEXT 188
-#define IDC_SIGNATURE_TEXT 189
-#define IDC_ADDRESS_TEXT 190
-#define IDC_HOST_TEXT 191
-#define IDC_PORT_TEXT 192
-#define IDC_DIRECTION_TEXT 193
-#define IDC_FILTER_TEXT 194
-#define IDC_DATE_TEXT 195
-#define IDC_FILE_ID 196
-#define IDC_SIGNATURE_ID 197
-#define IDC_ADDRESS_ID 198
-#define IDC_HOST_ID 199
-#define IDC_PORT_ID 200
-#define IDC_DIRECTION_ID 201
-#define IDC_FILTER_ID 202
-#define IDC_DATE_ID 203
+#define IDC_HEADER_ID 189
+#define IDC_FILE_TEXT 190
+#define IDC_SIGNATURE_TEXT 191
+#define IDC_ADDRESS_TEXT 192
+#define IDC_HOST_TEXT 193
+#define IDC_PORT_TEXT 194
+#define IDC_DIRECTION_TEXT 195
+#define IDC_FILTER_TEXT 196
+#define IDC_DATE_TEXT 197
+#define IDC_FILE_ID 198
+#define IDC_SIGNATURE_ID 199
+#define IDC_ADDRESS_ID 200
+#define IDC_HOST_ID 201
+#define IDC_PORT_ID 202
+#define IDC_DIRECTION_ID 203
+#define IDC_FILTER_ID 204
+#define IDC_DATE_ID 205
 
-#define IDC_RULES_BTN 204
-#define IDC_KILLPROCESS_BTN 205
-#define IDC_ALLOW_BTN 206
-#define IDC_BLOCK_BTN 207
-#define IDC_NEXT_BTN 208
+#define IDC_RULES_BTN 206
+#define IDC_KILLPROCESS_BTN 207
+#define IDC_ALLOW_BTN 208
+#define IDC_BLOCK_BTN 209
+#define IDC_NEXT_BTN 210
 
 // Editor Dlg
-#define IDC_RULE_NAME 209
-#define IDC_RULE_NAME_ID 210
-#define IDC_RULE_COMMENT 211
-#define IDC_RULE_COMMENT_ID 212
-#define IDC_RULE_PROTOCOL 213
-#define IDC_RULE_PROTOCOL_ID 214
-#define IDC_RULE_VERSION 215
-#define IDC_RULE_VERSION_ID 216
-#define IDC_RULE_DIRECTION 217
-#define IDC_RULE_DIRECTION_ID 218
-#define IDC_RULE_ACTION 219
-#define IDC_RULE_ACTION_ID 220
-#define IDC_RULE_REMOTE 221
-#define IDC_RULE_REMOTE_ID 222
-#define IDC_RULE_REMOTE_ADD 223
-#define IDC_RULE_REMOTE_EDIT 224
-#define IDC_RULE_REMOTE_DELETE 225
-#define IDC_RULE_LOCAL 226
-#define IDC_RULE_LOCAL_ID 227
-#define IDC_RULE_LOCAL_ADD 228
-#define IDC_RULE_LOCAL_EDIT 229
-#define IDC_RULE_LOCAL_DELETE 230
-#define IDC_RULE_APPS_ID 231
-#define IDC_RULE_APPS_HINT 232
-#define IDC_RULE 233
-#define IDC_RULE_ID 234
-#define IDC_RULE_HINT 235
-#define IDC_APP_NAME 236
-#define IDC_APP_ICON_ID 237
-#define IDC_APP_NAME_ID 238
-#define IDC_APP_SIGNATURE_ID 239
-#define IDC_APP_PATH 240
-#define IDC_APP_PATH_ID 241
-#define IDC_APP_EXPLORE_ID 242
-#define IDC_APP_COMMENT 243
-#define IDC_APP_COMMENT_ID 244
-#define IDC_APP_HASH 245
-#define IDC_APP_HASH_ID 246
-#define IDC_APP_HASH_RECHECK_ID 247
-#define IDC_APP_RULES_ID 248
-#define IDC_APP_HINT 249
-#define IDC_ENABLE_CHK 250
+#define IDC_RULE_NAME 211
+#define IDC_RULE_NAME_ID 212
+#define IDC_RULE_COMMENT 213
+#define IDC_RULE_COMMENT_ID 214
+#define IDC_RULE_PROTOCOL 215
+#define IDC_RULE_PROTOCOL_ID 216
+#define IDC_RULE_VERSION 217
+#define IDC_RULE_VERSION_ID 218
+#define IDC_RULE_DIRECTION 219
+#define IDC_RULE_DIRECTION_ID 220
+#define IDC_RULE_ACTION 221
+#define IDC_RULE_ACTION_ID 222
+#define IDC_RULE_REMOTE 223
+#define IDC_RULE_REMOTE_ID 224
+#define IDC_RULE_REMOTE_ADD 225
+#define IDC_RULE_REMOTE_EDIT 226
+#define IDC_RULE_REMOTE_DELETE 227
+#define IDC_RULE_LOCAL 228
+#define IDC_RULE_LOCAL_ID 229
+#define IDC_RULE_LOCAL_ADD 230
+#define IDC_RULE_LOCAL_EDIT 231
+#define IDC_RULE_LOCAL_DELETE 232
+#define IDC_RULE_APPS_ID 233
+#define IDC_RULE_APPS_HINT 234
+#define IDC_RULE 235
+#define IDC_RULE_ID 236
+#define IDC_RULE_HINT 237
+#define IDC_APP_NAME 238
+#define IDC_APP_ICON_ID 239
+#define IDC_APP_NAME_ID 240
+#define IDC_APP_SIGNATURE_ID 241
+#define IDC_APP_PATH 242
+#define IDC_APP_PATH_ID 243
+#define IDC_APP_EXPLORE_ID 244
+#define IDC_APP_COMMENT 245
+#define IDC_APP_COMMENT_ID 246
+#define IDC_APP_HASH 247
+#define IDC_APP_HASH_ID 248
+#define IDC_APP_HASH_RECHECK_ID 249
+#define IDC_APP_RULES_ID 250
+#define IDC_APP_HINT 251
+#define IDC_ENABLE_CHK 252
 
 // Main Menu
-#define IDM_SETTINGS 251
-#define IDM_ADD_FILE 252
-#define IDM_IMPORT 253
-#define IDM_EXPORT 254
-#define IDM_EXIT 255
-#define IDM_PURGE_UNUSED 256
-#define IDM_PURGE_TIMERS 257
-#define IDM_LOGCLEAR 258
-#define IDM_FIND 259
-#define IDM_REFRESH 260
-#define IDM_ALWAYSONTOP_CHK 261
-#define IDM_SHOWFILENAMESONLY_CHK 262
-#define IDM_SHOWSEARCHBAR_CHK 263
-#define IDM_AUTOSIZECOLUMNS_CHK 264
-#define IDM_VIEW_DETAILS 265
-#define IDM_VIEW_ICON 266
-#define IDM_VIEW_TILE 267
-#define IDM_SIZE_SMALL 268
-#define IDM_SIZE_LARGE 269
-#define IDM_SIZE_EXTRALARGE 270
-#define IDM_ICONSISHIDDEN 271
-#define IDM_USEDARKTHEME_CHK 272
-#define IDM_FONT 273
-#define IDM_LOADONSTARTUP_CHK 274
-#define IDM_STARTMINIMIZED_CHK 275
-#define IDM_SKIPUACWARNING_CHK 276
-#define IDM_CHECKUPDATES_CHK 277
-#define IDM_RULE_BLOCKOUTBOUND 278
-#define IDM_RULE_BLOCKINBOUND 279
-#define IDM_RULE_ALLOWLOOPBACK 280
-#define IDM_RULE_ALLOW6TO4 281
-#define IDM_RULE_ALLOWWINDOWSUPDATE 282
-#define IDM_PROFILETYPE_PLAIN 283
-#define IDM_PROFILETYPE_COMPRESSED 284
-#define IDM_PROFILETYPE_ENCRYPTED 285
-#define IDM_USENETWORKRESOLUTION_CHK 286
-#define IDM_USECERTIFICATES_CHK 287
-#define IDM_USEHASHES_CHK 288
-#define IDM_USEAPPMONITOR_CHK 289
-#define IDM_BLOCKLIST_SPY_DISABLE 290
-#define IDM_BLOCKLIST_SPY_ALLOW 291
-#define IDM_BLOCKLIST_SPY_BLOCK 292
-#define IDM_BLOCKLIST_UPDATE_DISABLE 293
-#define IDM_BLOCKLIST_UPDATE_ALLOW 294
-#define IDM_BLOCKLIST_UPDATE_BLOCK 295
-#define IDM_BLOCKLIST_EXTRA_DISABLE 296
-#define IDM_BLOCKLIST_EXTRA_ALLOW 297
-#define IDM_BLOCKLIST_EXTRA_BLOCK 298
-#define IDM_WEBSITE 299
-#define IDM_CHECKUPDATES 300
-#define IDM_DONATE 301
-#define IDM_ABOUT 302
+#define IDM_SETTINGS 253
+#define IDM_ADD_FILE 254
+#define IDM_IMPORT 255
+#define IDM_EXPORT 256
+#define IDM_EXIT 257
+#define IDM_PURGE_UNUSED 258
+#define IDM_PURGE_TIMERS 259
+#define IDM_LOGCLEAR 260
+#define IDM_FIND 261
+#define IDM_REFRESH 262
+#define IDM_ALWAYSONTOP_CHK 263
+#define IDM_SHOWFILENAMESONLY_CHK 264
+#define IDM_SHOWSEARCHBAR_CHK 265
+#define IDM_AUTOSIZECOLUMNS_CHK 266
+#define IDM_VIEW_DETAILS 267
+#define IDM_VIEW_ICON 268
+#define IDM_VIEW_TILE 269
+#define IDM_SIZE_SMALL 270
+#define IDM_SIZE_LARGE 271
+#define IDM_SIZE_EXTRALARGE 272
+#define IDM_ICONSISHIDDEN 273
+#define IDM_USEDARKTHEME_CHK 274
+#define IDM_FONT 275
+#define IDM_LOADONSTARTUP_CHK 276
+#define IDM_STARTMINIMIZED_CHK 277
+#define IDM_SKIPUACWARNING_CHK 278
+#define IDM_CHECKUPDATES_CHK 279
+#define IDM_RULE_BLOCKOUTBOUND 280
+#define IDM_RULE_BLOCKINBOUND 281
+#define IDM_RULE_ALLOWLOOPBACK 282
+#define IDM_RULE_ALLOW6TO4 283
+#define IDM_RULE_ALLOWWINDOWSUPDATE 284
+#define IDM_PROFILETYPE_PLAIN 285
+#define IDM_PROFILETYPE_COMPRESSED 286
+#define IDM_PROFILETYPE_ENCRYPTED 287
+#define IDM_CONNECTIONS_ENABLE 288
+#define IDM_CONNECTIONS_SHOWAITCONNECTIONS 289
+#define IDM_CONNECTIONS_MEASUREUDPTRAFFIC 290
+#define IDM_USENETWORKRESOLUTION_CHK 291
+#define IDM_USECERTIFICATES_CHK 292
+#define IDM_KEEPUNUSED_CHK 293
+#define IDM_USEHASHES_CHK 294
+#define IDM_USEAPPMONITOR_CHK 295
+#define IDM_BLOCKLIST_SPY_DISABLE 296
+#define IDM_BLOCKLIST_SPY_ALLOW 297
+#define IDM_BLOCKLIST_SPY_BLOCK 298
+#define IDM_BLOCKLIST_UPDATE_DISABLE 299
+#define IDM_BLOCKLIST_UPDATE_ALLOW 300
+#define IDM_BLOCKLIST_UPDATE_BLOCK 301
+#define IDM_BLOCKLIST_EXTRA_DISABLE 302
+#define IDM_BLOCKLIST_EXTRA_ALLOW 303
+#define IDM_BLOCKLIST_EXTRA_BLOCK 304
+#define IDM_WEBSITE 305
+#define IDM_CHECKUPDATES 306
+#define IDM_DONATE 307
+#define IDM_ABOUT 308
 
 // Tray Menu
-#define IDM_TRAY_SHOW 303
-#define IDM_TRAY_START 304
-#define IDM_TRAY_ENABLENOTIFICATIONS_CHK 305
-#define IDM_TRAY_ENABLENOTIFICATIONSSOUND_CHK 306
-#define IDM_TRAY_NOTIFICATIONFULLSCREENSILENTMODE_CHK 307
-#define IDM_TRAY_NOTIFICATIONONTRAY_CHK 308
-#define IDM_TRAY_ENABLELOG_CHK 309
-#define IDM_TRAY_ENABLEUILOG_CHK 310
-#define IDM_TRAY_LOGSHOW 311
-#define IDM_TRAY_LOGCLEAR 312
-#define IDM_TRAY_LOGSHOW_ERR 313
-#define IDM_TRAY_LOGCLEAR_ERR 314
-#define IDM_TRAY_SETTINGS 315
-#define IDM_TRAY_WEBSITE 316
-#define IDM_TRAY_ABOUT 317
-#define IDM_TRAY_EXIT 318
+#define IDM_TRAY_SHOW 309
+#define IDM_TRAY_START 310
+#define IDM_TRAY_ENABLENOTIFICATIONS_CHK 311
+#define IDM_TRAY_ENABLENOTIFICATIONSSOUND_CHK 312
+#define IDM_TRAY_NOTIFICATIONFULLSCREENSILENTMODE_CHK 313
+#define IDM_TRAY_NOTIFICATIONONTRAY_CHK 314
+#define IDM_TRAY_ENABLELOG_CHK 315
+#define IDM_TRAY_ENABLEUILOG_CHK 316
+#define IDM_TRAY_LOGSHOW 317
+#define IDM_TRAY_LOGCLEAR 318
+#define IDM_TRAY_LOGSHOW_ERR 319
+#define IDM_TRAY_LOGCLEAR_ERR 320
+#define IDM_TRAY_SETTINGS 321
+#define IDM_TRAY_WEBSITE 322
+#define IDM_TRAY_ABOUT 323
+#define IDM_TRAY_EXIT 324
 
 // Listview Menu
-#define IDM_EXPLORE 319
-#define IDM_DISABLENOTIFICATIONS 320
-#define IDM_DISABLEREMOVAL 321
-#define IDM_OPENRULESEDITOR 322
-#define IDM_COPY 323
-#define IDM_COPY_VALUE 324
-#define IDM_CHECK 325
-#define IDM_UNCHECK 326
-#define IDM_DELETE 327
-#define IDM_DISABLETIMER 328
-#define IDM_PROPERTIES 329
+#define IDM_EXPLORE 325
+#define IDM_DISABLENOTIFICATIONS 326
+#define IDM_DISABLEREMOVAL 327
+#define IDM_OPENRULESEDITOR 328
+#define IDM_COPY 329
+#define IDM_COPY_VALUE 330
+#define IDM_CHECK 331
+#define IDM_UNCHECK 332
+#define IDM_DELETE 333
+#define IDM_DISABLETIMER 334
+#define IDM_PROPERTIES 335
 
-#define IDM_NOTIMER 330
+#define IDM_NOTIMER 336
 
-#define IDM_SELECT_ALL 331
-#define IDM_ZOOM 332
-#define IDM_TAB_NEXT 333
-#define IDM_TAB_PREV 334
+#define IDM_SELECT_ALL 337
+#define IDM_ZOOM 338
+#define IDM_TAB_NEXT 339
+#define IDM_TAB_PREV 340
 
 #define IDX_LANGUAGE 1000
 #define IDX_TIMER 1200
@@ -569,6 +575,32 @@
 #define IDS_USEHASHES_CHK 260
 #define IDS_COMMENT 261
 #define IDS_USEDARKTHEME 262
+#define IDS_KEEPUNUSED_CHK 263
+#define IDS_UPDATE_NO 264
+#define IDS_UPDATE_YES 265
+#define IDS_UPDATE_SPEED 266
+#define IDS_RULE_FOR_ALL 267
+#define IDS_RULE_FOR_APPS 268
+#define IDS_PROFILE_TYPE_PLAIN 269
+#define IDS_PROFILE_TYPE_COMPRESSED 270
+#define IDS_PROFILE_TYPE_ENCRYPTED 271
+#define IDS_SESSION_ONLY 272
+#define IDS_LIMIT_REACHED 273
+#define IDS_INTERNAL_RULE 274
+#define IDS_LOADING 275
+#define IDS_DIRECTION_REMOTE 276
+#define IDS_DIRECTION_LOCAL 277
+#define IDS_WARNING_UNEXPECTED 278
+#define IDS_WARNING_ME 279
+#define IDS_TOTAL 280
+#define IDS_ALLOWIPFORWARDING_CHK 281
+#define IDS_EXCLUDEINBOUND_CHK 282
+#define IDS_CONNECTIONS_ENABLE 283
+#define IDS_CONNECTIONS_SHOWAITCONNECTIONS 284
+#define IDS_CONNECTIONS_MEASUREUDPTRAFFIC 285
+#define IDS_UDP_ACCOUNTING 286
+#define IDS_UDP_UNAVAILABLE 287
+#define IDS_UDP_PENDING 288
 
 // RC data
 #define IDR_PROFILE_INTERNAL 1
@@ -591,6 +623,10 @@
 #define IDP_LOGUI 114
 #define IDP_SEARCH_LIGHT 115
 #define IDP_SEARCH_DARK 116
+#define IDP_REGEX_LIGHT 117
+#define IDP_REGEX_DARK 118
+#define IDP_CASE_LIGHT 119
+#define IDP_CASE_DARK 120
 
 // Icons
 #define IDI_MAIN 100

src/resource.rc

@@ -108,9 +108,16 @@ BEGIN
 			MENUITEM " ", IDM_PROFILETYPE_COMPRESSED
 			MENUITEM " ", IDM_PROFILETYPE_ENCRYPTED
 		END
+		POPUP " "
+		BEGIN
+			MENUITEM " ", IDM_CONNECTIONS_ENABLE
+			MENUITEM " ", IDM_CONNECTIONS_SHOWAITCONNECTIONS
+			MENUITEM " ", IDM_CONNECTIONS_MEASUREUDPTRAFFIC
+		END
 		MENUITEM SEPARATOR
 		MENUITEM " ", IDM_USENETWORKRESOLUTION_CHK
 		MENUITEM " ", IDM_USECERTIFICATES_CHK
+		MENUITEM " ", IDM_KEEPUNUSED_CHK
 		MENUITEM " ", IDM_USEHASHES_CHK
 		MENUITEM " ", IDM_USEAPPMONITOR_CHK
 	END
@@ -185,7 +192,7 @@ END
 //
 // Dialog resources
 //
-IDD_MAIN DIALOGEX 0, 0, 348, 196
+IDD_MAIN DIALOGEX 0, 0, 646, 242
 STYLE WS_OVERLAPPEDWINDOW | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | DS_SHELLFONT | DS_MODALFRAME | NOT WS_VISIBLE
 CAPTION APP_NAME
 MENU IDM_MAIN
@@ -193,16 +200,16 @@ FONT 8, "Ms Shell Dlg"
 BEGIN
 	CONTROL			"", IDC_REBAR, REBARCLASSNAME, WS_CHILD | WS_VISIBLE | WS_CLIPSIBLINGS | WS_CLIPCHILDREN | CCS_NODIVIDER | CCS_TOP | RBS_VARHEIGHT | RBS_AUTOSIZE, 0, 0, 0, 0
 
-	CONTROL			"", IDC_TAB, WC_TABCONTROL, WS_CHILD | WS_VISIBLE | WS_CLIPSIBLINGS | WS_CLIPCHILDREN | TCS_HOTTRACK | TCS_TOOLTIPS, 0, 0, 348, 158
+	CONTROL			"", IDC_TAB, WC_TABCONTROL, WS_CHILD | WS_VISIBLE | WS_CLIPSIBLINGS | WS_CLIPCHILDREN | TCS_HOTTRACK | TCS_TOOLTIPS | TCS_MULTILINE | TCS_FOCUSONBUTTONDOWN, 0, 0, 646, 204
 
-	CONTROL			"", IDC_APPS_PROFILE, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 348, 170
-	CONTROL			"", IDC_APPS_SERVICE, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 348, 170
-	CONTROL			"", IDC_APPS_UWP, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 348, 170
-	CONTROL			"", IDC_RULES_BLOCKLIST, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 348, 170
-	CONTROL			"", IDC_RULES_SYSTEM, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 348, 170
-	CONTROL			"", IDC_RULES_CUSTOM, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 348, 170
-	CONTROL			"", IDC_NETWORK, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 348, 170
-	CONTROL			"", IDC_LOG, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 348, 170
+	CONTROL			"", IDC_APPS_PROFILE, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 646, 216
+	CONTROL			"", IDC_APPS_SERVICE, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 646, 216
+	CONTROL			"", IDC_APPS_UWP, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 646, 216
+	CONTROL			"", IDC_RULES_BLOCKLIST, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 646, 216
+	CONTROL			"", IDC_RULES_SYSTEM, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 646, 216
+	CONTROL			"", IDC_RULES_CUSTOM, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 646, 216
+	CONTROL			"", IDC_NETWORK, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 646, 216
+	CONTROL			"", IDC_LOG, WC_LISTVIEW, WS_CHILD | NOT WS_VISIBLE | WS_TABSTOP | LVS_SHOWSELALWAYS | LVS_REPORT | LVS_SHAREIMAGELISTS | LVS_AUTOARRANGE, 0, 14, 646, 216
 
 	CONTROL			"", IDC_STATUSBAR, STATUSCLASSNAME, SBARS_TOOLTIPS, 0, 0, 0, 0
 END
@@ -238,10 +245,10 @@ BEGIN
 	LTEXT			"", IDC_DATE_ID, 8, 144, 144, 10, WS_CHILD | WS_VISIBLE | SS_ENDELLIPSIS | SS_CENTERIMAGE
 	EDITTEXT		IDC_DATE_TEXT, 168, 144, 144, 12, WS_CHILD | WS_VISIBLE | NOT WS_TABSTOP | NOT WS_BORDER | ES_READONLY | ES_AUTOHSCROLL | ES_RIGHT
 
-	PUSHBUTTON		"", IDC_RULES_BTN, 8, 170, 32, 15, WS_TABSTOP | WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON | BS_SPLITBUTTON | BS_ICON
+	PUSHBUTTON		"", IDC_RULES_BTN, 8, 170, 32, 15, WS_TABSTOP | WS_CHILD | WS_VISIBLE | BS_SPLITBUTTON | BS_ICON
 	PUSHBUTTON		"", IDC_KILLPROCESS_BTN, 44, 170, 26, 15, WS_TABSTOP | WS_CHILD | WS_VISIBLE | BS_ICON | BS_PUSHBUTTON
 
-	PUSHBUTTON		"", IDC_ALLOW_BTN, 114, 170, 82, 15, WS_TABSTOP | WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON | BS_SPLITBUTTON
+	PUSHBUTTON		"", IDC_ALLOW_BTN, 114, 170, 82, 15, WS_TABSTOP | WS_CHILD | WS_VISIBLE | BS_SPLITBUTTON
 	PUSHBUTTON		"", IDC_BLOCK_BTN, 200, 170, 82, 15, WS_TABSTOP | WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON
 	PUSHBUTTON		"", IDC_NEXT_BTN, 286, 170, 26, 15, WS_TABSTOP | WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON | BS_ICON
 END
@@ -255,8 +262,8 @@ BEGIN
 
 	AUTOCHECKBOX	"", IDC_ENABLE_CHK, 8, 202, 166, 14, BS_VCENTER
 
-	PUSHBUTTON		"", IDC_SAVE, 180, 202, 50, 14
-	PUSHBUTTON		"", IDC_CLOSE, 234, 202, 50, 14
+	DEFPUSHBUTTON	"", IDC_SAVE, 180, 202, 50, 14, WS_TABSTOP
+	PUSHBUTTON		"", IDC_CLOSE, 234, 202, 50, 14, WS_TABSTOP
 END
 
 IDD_EDITOR_GENERAL DIALOGEX 0, 0, 292, 210
@@ -352,16 +359,16 @@ BEGIN
 	LTEXT			"", IDC_APP_HINT, 6, 154, 256, 22
 END
 
-IDD_EDITOR_ADDRULE DIALOGEX 0, 0, 220, 166
+IDD_EDITOR_ADDRULE DIALOGEX 0, 0, 270, 148
 STYLE WS_CLIPSIBLINGS | WS_CLIPCHILDREN | WS_POPUP | WS_BORDER | WS_SYSMENU | WS_CAPTION | DS_SHELLFONT | DS_MODALFRAME
 FONT 8, "Ms Shell Dlg"
 BEGIN
-	EDITTEXT		IDC_RULE_ID, 8, 8, 204, 12, WS_TABSTOP | ES_AUTOHSCROLL
+	EDITTEXT		IDC_RULE_ID, 8, 8, 254, 24, WS_TABSTOP | ES_AUTOHSCROLL | ES_MULTILINE
 
-	EDITTEXT		IDC_RULE_HINT, 8, 26, 204, 104, WS_BORDER | NOT WS_TABSTOP | ES_AUTOVSCROLL | ES_READONLY | ES_MULTILINE
+	EDITTEXT		IDC_RULE_HINT, 8, 38, 254, 80, WS_VSCROLL | WS_BORDER | NOT WS_TABSTOP | ES_AUTOVSCROLL | ES_READONLY | ES_MULTILINE
 
-	PUSHBUTTON		"", IDC_SAVE, 108, 144, 50, 14
-	PUSHBUTTON		"", IDC_CLOSE, 162, 144, 50, 14
+	PUSHBUTTON		"", IDC_SAVE, 158, 126, 50, 14, WS_TABSTOP
+	PUSHBUTTON		"", IDC_CLOSE, 212, 126, 50, 14, WS_TABSTOP
 END
 
 IDD_SETTINGS_GENERAL DIALOGEX 0, 0, 262, 172
@@ -424,16 +431,17 @@ BEGIN
 	AUTOCHECKBOX	"", IDC_RULE_ALLOWLOOPBACK, 8, 36, 246, 12
 	AUTOCHECKBOX	"", IDC_RULE_ALLOW6TO4, 8, 48, 246, 12
 
-	GROUPBOX		"", IDC_TITLE_SECURITY, 0, 66, 262, 40, WS_GROUP
+	GROUPBOX		"", IDC_TITLE_SECURITY, 0, 66, 262, 52, WS_GROUP
 
 	AUTOCHECKBOX	"", IDC_USESTEALTHMODE_CHK, 8, 78, 246, 12
 	AUTOCHECKBOX	"", IDC_INSTALLBOOTTIMEFILTERS_CHK, 8, 90, 246, 12
+	AUTOCHECKBOX	"", IDC_ALLOWIPFORWARDING_CHK, 8, 102, 246, 12
 
-	GROUPBOX		"", IDC_TITLE_ADVANCED, 0, 108, 262, 52, WS_GROUP
+	GROUPBOX		"", IDC_TITLE_ADVANCED, 0, 120, 262, 52, WS_GROUP
 
-	AUTOCHECKBOX	"", IDC_USECERTIFICATES_CHK, 8, 120, 246, 12
-	AUTOCHECKBOX	"", IDC_USEHASHES_CHK, 8, 132, 246, 12
-	AUTOCHECKBOX	"", IDC_USENETWORKRESOLUTION_CHK, 8, 144, 246, 12
+	AUTOCHECKBOX	"", IDC_USECERTIFICATES_CHK, 8, 132, 246, 12
+	AUTOCHECKBOX	"", IDC_USEHASHES_CHK, 8, 144, 246, 12
+	AUTOCHECKBOX	"", IDC_USENETWORKRESOLUTION_CHK, 8, 156, 246, 12
 END
 
 IDD_SETTINGS_BLOCKLIST DIALOGEX 0, 0, 262, 172
@@ -489,20 +497,20 @@ BEGIN
 	AUTOCHECKBOX	"", IDC_ENABLELOG_CHK, 8, 12, 246, 12
 
 	EDITTEXT		IDC_LOGPATH, 8, 26, 218, 12, ES_AUTOHSCROLL | ES_MULTILINE
-	PUSHBUTTON		"...", IDC_LOGPATH_BTN, 230, 26, 24, 12
+	PUSHBUTTON		"...", IDC_LOGPATH_BTN, 230, 26, 24, 12, WS_TABSTOP
 
 	LTEXT			"", IDC_LOGSIZELIMIT_HINT, 8, 44, 198, 12, SS_CENTERIMAGE
 	EDITTEXT		IDC_LOGSIZELIMIT_CTRL, 210, 44, 44, 12, ES_AUTOHSCROLL | ES_NUMBER | ES_MULTILINE
 	CONTROL			"", IDC_LOGSIZELIMIT, UPDOWN_CLASS, UDS_ALIGNRIGHT | UDS_ARROWKEYS | UDS_AUTOBUDDY | UDS_HOTTRACK | UDS_SETBUDDYINT, 0, 0, 0, 0
 
-	GROUPBOX		"", IDC_TITLE_INTERFACE, 0, 68, 262, 32, WS_GROUP
+	GROUPBOX		"", IDC_TITLE_LOGVIEWER, 0, 68, 262, 34, WS_GROUP
 
-	AUTOCHECKBOX	"", IDC_ENABLEUILOG_CHK, 8, 80, 246, 12
+	EDITTEXT		IDC_LOGVIEWER, 8, 80, 218, 12, ES_AUTOHSCROLL | ES_MULTILINE
+	PUSHBUTTON		"...", IDC_LOGVIEWER_BTN, 230, 80, 24, 12, WS_TABSTOP
 
-	GROUPBOX		"", IDC_TITLE_LOGVIEWER, 0, 102, 262, 34, WS_GROUP
+	GROUPBOX		"", IDC_TITLE_INTERFACE, 0, 106, 262, 32, WS_GROUP
 
-	EDITTEXT		IDC_LOGVIEWER, 8, 114, 218, 12, ES_AUTOHSCROLL | ES_MULTILINE
-	PUSHBUTTON		"...", IDC_LOGVIEWER_BTN, 230, 114, 24, 12
+	AUTOCHECKBOX	"", IDC_ENABLEUILOG_CHK, 8, 118, 246, 12
 END
 
 IDD_SETTINGS_EXCLUDE DIALOGEX 0, 0, 262, 172
@@ -510,15 +518,16 @@ STYLE WS_CHILD | WS_SYSMENU | WS_TABSTOP | WS_GROUP | DS_SHELLFONT | DS_CONTROL
 EXSTYLE WS_EX_CONTROLPARENT
 FONT 8, "Ms Shell Dlg"
 BEGIN
-	GROUPBOX		"", IDC_TITLE_NOTIFICATIONS, 0, 0, 262, 42, WS_GROUP
+	GROUPBOX		"", IDC_TITLE_NOTIFICATIONS, 0, 0, 262, 54, WS_GROUP
 
 	AUTOCHECKBOX	"", IDC_EXCLUDEBLOCKLIST_CHK, 8, 12, 246, 12
 	AUTOCHECKBOX	"", IDC_EXCLUDECUSTOM_CHK, 8, 24, 246, 12
+	AUTOCHECKBOX	"", IDC_EXCLUDEINBOUND_CHK, 8, 36, 246, 12
 
-	GROUPBOX		"", IDC_TITLE_LOGGING, 0, 46, 262, 42, WS_GROUP
+	GROUPBOX		"", IDC_TITLE_LOGGING, 0, 58, 262, 42, WS_GROUP
 
-	AUTOCHECKBOX	"", IDC_EXCLUDESTEALTH_CHK, 8, 58, 246, 12
-	AUTOCHECKBOX	"", IDC_EXCLUDECLASSIFYALLOW_CHK, 8, 70, 246, 12
+	AUTOCHECKBOX	"", IDC_EXCLUDESTEALTH_CHK, 8, 70, 246, 12
+	AUTOCHECKBOX	"", IDC_EXCLUDECLASSIFYALLOW_CHK, 8, 82, 246, 12
 END
 
 //
@@ -526,6 +535,14 @@ END
 //
 STRINGTABLE
 BEGIN
+	IDS_UPDATE_NO "No updates available."
+	IDS_UPDATE_YES "Update available. Download and install now?"
+	IDS_UPDATE_DOWNLOAD "Downloading update..."
+	IDS_UPDATE_DONE "Downloading update finished."
+	IDS_UPDATE_ERROR "Update server connection error."
+	IDS_UPDATE_INIT "Checking for new releases..."
+	IDS_UPDATE_INSTALL "Update available. Do you want to install it now?"
+
 	IDS_FILE "File"
 	IDS_SETTINGS "Settings"
 	IDS_EXIT "Exit"
@@ -678,10 +695,12 @@ BEGIN
 	IDS_ENABLENOTIFICATIONS_CHK "Enable packets notifications"
 	IDS_NOTIFICATIONSOUND_CHK "Enable notifications sound"
 	IDS_NOTIFICATIONTIMEOUT_HINT "Timeout between similar notifications (sec.):"
+
 	IDS_EXCLUDESTEALTH_CHK "port scanner connections"
 	IDS_EXCLUDECLASSIFYALLOW_CHK "allowed connections"
 	IDS_EXCLUDEBLOCKLIST_CHK "blocklist"
 	IDS_EXCLUDECUSTOM_CHK "user rules"
+	IDS_EXCLUDEINBOUND_CHK "inbound multicast/broadcast"
 
 	IDS_NOTIFY_TOOLTIP "Set user rule to allow access to an address and/or port for this application."
 
@@ -700,7 +719,7 @@ BEGIN
 	IDS_STATUS_UNUSED_APPS "Unused apps"
 	IDS_STATUS_TIMER_APPS "Apps with timer"
 
-	IDS_STATUS_EMPTY ""
+	IDS_STATUS_EMPTY "Empty."
 	IDS_STATUS_ERROR ""
 
 	IDS_STATUS_SYNTAX_ERROR "Syntax error in rule!"
@@ -710,8 +729,8 @@ BEGIN
 	IDS_ADDRESS_REMOTE "Destination"
 
 	IDS_ICONSEXTRALARGE "Extra large"
-	IDS_SECUREFILTERS_CHK "Enable protection of installed filters" //removed
-	IDS_SECUREFILTERS_HINT "Prevent unauthorized applications from accessing the installed filters." //removed
+	IDS_SECUREFILTERS_CHK "Enable protection of installed filters" // removed
+	IDS_SECUREFILTERS_HINT "Prevent unauthorized applications from accessing the installed filters." // removed
 	IDS_USEREFRESHDEVICES_CHK "Refresh filters when (storage) devices are connected"
 
 	IDS_RULE_ALLOW6TO4 "Allow IPv6 redirections (6to4) for all"
@@ -805,12 +824,47 @@ BEGIN
 	IDS_COMMENT "Comments"
 
 	IDS_USEDARKTHEME "Use dark theme"
+
+	IDS_KEEPUNUSED_CHK "Keep unused apps"
+
+	IDS_UPDATE_SPEED "Speed"
+
+	IDS_RULE_FOR_ALL "for all"
+	IDS_RULE_FOR_APPS "for apps"
+
+	IDS_PROFILE_TYPE_PLAIN "Plain"
+	IDS_PROFILE_TYPE_COMPRESSED "Compressed"
+	IDS_PROFILE_TYPE_ENCRYPTED "Encrypted"
+
+	IDS_SESSION_ONLY "session only"
+
+	IDS_LIMIT_REACHED "Limit reached."
+	IDS_INTERNAL_RULE "Internal rule"
+
+	IDS_LOADING "Loading..."
+
+	IDS_DIRECTION_REMOTE "Remote"
+	IDS_DIRECTION_LOCAL "Local"
+
+	IDS_WARNING_UNEXPECTED L"Be careful, through service/driver host (svchost.exe/System) internet traffic can let out through unexpected ways. Continue?"
+	IDS_WARNING_ME "If you disallow main process, you cannot use resolve network addresses option. Continue?"
+	IDS_TOTAL "Total"
+
+	IDS_ALLOWIPFORWARDING_CHK "Allow IP forwarding"
+
+	IDS_CONNECTIONS_ENABLE "Enable connections monitoring"
+	IDS_CONNECTIONS_SHOWAITCONNECTIONS "Show waiting connections"
+	IDS_CONNECTIONS_MEASUREUDPTRAFFIC "Measure UDP/QUIC traffic (experimental, restart required)"
+
+	IDS_UDP_ACCOUNTING "UDP (including QUIC): ETW bytes since this socket was first monitored."
+	IDS_UDP_UNAVAILABLE "UDP measurement unavailable or incomplete. Restart simplewall to retry. Error"
+	IDS_UDP_PENDING "UDP: no verified measurement yet. Sockets opened before monitoring must be reopened."
 END
 
 //
 // RC data
 //
-IDR_PROFILE_INTERNAL RCDATA		"..\\bin\\profile_internal.xml"
+IDR_PROFILE_INTERNAL RCDATA		"..\\bin\\profile_internal.bin"
 
 //
 // PNG resources
@@ -832,6 +886,10 @@ IDP_DONATE			PNG		"res\\paypal_fulllogo.png"
 IDP_LOGUI			PNG		"res\\eye.png"
 IDP_SEARCH_LIGHT	PNG		"res\\search_light.png"
 IDP_SEARCH_DARK		PNG		"res\\search_dark.png"
+IDP_REGEX_LIGHT		PNG		"res\\regex_light.png"
+IDP_REGEX_DARK		PNG		"res\\regex_dark.png"
+IDP_CASE_LIGHT		PNG		"res\\case_sensitive_light.png"
+IDP_CASE_DARK		PNG		"res\\case_sensitive_dark.png"
 
 //
 // Icon resources

src/search.c

@@ -1,6 +1,6 @@
 // simplewall
-// Copyright (c) 2012-2021 dmex
-// Copyright (c) 2021-2024 Henry++
+// Copyright (c) 2012-2026 dmex
+// Copyright (c) 2021-2026 Henry++
 
 #include "global.h"
 
@@ -13,14 +13,15 @@ VOID _app_search_initialize (
 	LONG cx_border;
 	HRESULT status;
 
-	GetWindowRect (context->hwnd, &rect);
+	if (!GetWindowRect (context->hwnd, &rect))
+		return;
 
 	cx_border = _r_dc_getsystemmetrics (SM_CXBORDER, context->dpi_value);
 
 	// initialize borders
 	context->cx_width = _r_dc_getdpi (20, context->dpi_value);
 	context->cx_border = cx_border;
-	context->dc_brush = GetStockObject (DC_BRUSH);
+	context->dc_brush = (HBRUSH)GetStockObject (DC_BRUSH);
 
 	if (IsThemeActive ())
 	{
@@ -43,9 +44,11 @@ VOID _app_search_create (
 )
 {
 	PSEARCH_CONTEXT context;
-	WCHAR buffer[128];
+	WCHAR buffer[0x80];
 
-	context = _r_mem_allocate (sizeof (SEARCH_CONTEXT));
+	context = (PSEARCH_CONTEXT)_r_mem_allocate (sizeof (SEARCH_CONTEXT));
+
+	BringWindowToTop (hwnd); // HACK!!!
 
 	context->hwnd = hwnd;
 	context->dpi_value = _r_dc_getwindowdpi (hwnd);
@@ -54,16 +57,17 @@ VOID _app_search_create (
 
 	_r_wnd_setcontext (context->hwnd, SHORT_MAX, context);
 
-	// Subclass the Edit control window procedure.
+	// subclass the edit control window procedure
 	context->wnd_proc = (WNDPROC)GetWindowLongPtrW (context->hwnd, GWLP_WNDPROC);
-	SetWindowLongPtrW (context->hwnd, GWLP_WNDPROC, (LONG_PTR)_app_search_subclass_proc);
+	SetWindowLongPtrW (context->hwnd, GWLP_WNDPROC, (LONG_PTR)&_app_search_subclass_proc);
 
+	// set cue banner
 	_r_str_printf (buffer, RTL_NUMBER_OF (buffer), L"%s...", _r_locale_getstring (IDS_FIND));
 
 	_r_edit_setcuebanner (context->hwnd, 0, buffer);
 
-	// Initialize the theme parameters.
-	_app_search_themechanged (hwnd, context);
+	// initialize the theme parameters
+	_app_search_themechanged (context->hwnd, context);
 }
 
 VOID _app_search_initializeimages (
@@ -79,15 +83,7 @@ VOID _app_search_initializeimages (
 	context->image_width = _r_dc_getsystemmetrics (SM_CXSMICON, context->dpi_value) + _r_dc_getdpi (4, context->dpi_value);
 	context->image_height = _r_dc_getsystemmetrics (SM_CYSMICON, context->dpi_value) + _r_dc_getdpi (4, context->dpi_value);
 
-	status = _r_res_loadimage (
-		_r_sys_getimagebase (),
-		L"PNG",
-		MAKEINTRESOURCEW (IDP_SEARCH_LIGHT),
-		&GUID_ContainerFormatPng,
-		context->image_width,
-		context->image_height,
-		&hbitmap
-	);
+	status = _r_res_loadimage (&hbitmap, _r_sys_getimagebase (), L"PNG", MAKEINTRESOURCE (IDP_SEARCH_LIGHT), &GUID_ContainerFormatPng, context->image_width, context->image_height);
 
 	if (NT_SUCCESS (status))
 	{
@@ -101,15 +97,7 @@ VOID _app_search_initializeimages (
 		DeleteObject (hbitmap);
 	}
 
-	status = _r_res_loadimage (
-		_r_sys_getimagebase (),
-		L"PNG",
-		MAKEINTRESOURCEW (IDP_SEARCH_DARK),
-		&GUID_ContainerFormatPng,
-		context->image_width,
-		context->image_height,
-		&hbitmap
-	);
+	status = _r_res_loadimage (&hbitmap, _r_sys_getimagebase (), L"PNG", MAKEINTRESOURCE (IDP_SEARCH_DARK), &GUID_ContainerFormatPng, context->image_width, context->image_height);
 
 	if (NT_SUCCESS (status))
 	{
@@ -126,40 +114,45 @@ VOID _app_search_initializeimages (
 
 VOID _app_search_themechanged (
 	_In_ HWND hwnd,
-	_In_ PSEARCH_CONTEXT context
+	_Inout_ PSEARCH_CONTEXT context
 )
 {
 	_app_search_initialize (context);
 	_app_search_initializeimages (context, hwnd);
 
-	// Reset the client area margins.
-	_r_ctrl_settextmargin (hwnd, 0, 0, 0);
+	// reset the client area margins
+	CallWindowProcW (context->wnd_proc, hwnd, EM_SETMARGINS, EC_LEFTMARGIN | EC_RIGHTMARGIN, MAKELPARAM (0, 0));
 
-	// Refresh the non-client area.
+	// refresh the non-client area
 	SetWindowPos (hwnd, NULL, 0, 0, 0, 0, SWP_NOACTIVATE | SWP_NOMOVE | SWP_NOSIZE | SWP_FRAMECHANGED);
 
-	// Force the edit control to update its non-client area.
+	// force the edit control to update its non-client area
 	RedrawWindow (hwnd, NULL, NULL, RDW_FRAME | RDW_INVALIDATE);
 }
 
 VOID _app_search_setvisible (
 	_In_ HWND hwnd,
-	_In_ HWND hsearch
+	_In_ HWND hsearch,
+	_In_ LONG dpi_value
 )
 {
-	BOOLEAN is_visible;
-
-	is_visible = _r_config_getboolean (L"IsShowSearchBar", TRUE);
-
-	if (is_visible)
+	if (_r_config_getboolean (L"IsShowSearchBar", TRUE, NULL))
 	{
+		if (!_r_rebar_isbandexists (hwnd, IDC_REBAR, REBAR_SEARCH_ID))
+			_r_rebar_insertband (hwnd, IDC_REBAR, REBAR_SEARCH_ID, config.hsearchbar, RBBS_VARIABLEHEIGHT | RBBS_NOGRIPPER | RBBS_USECHEVRON, _r_dc_getdpi (180, dpi_value), 20);
+
 		ShowWindow (hsearch, SW_SHOWNA);
 
+		_r_wnd_sendmessage (hsearch, 0, WM_SIZE, 0, 0);
+
 		if (_r_wnd_isvisible (hwnd, FALSE))
 			SetFocus (hsearch);
 	}
 	else
 	{
+		if (_r_rebar_isbandexists (hwnd, IDC_REBAR, REBAR_SEARCH_ID))
+			_r_rebar_deleteband (hwnd, IDC_REBAR, REBAR_SEARCH_ID);
+
 		_r_ctrl_setstring (hsearch, 0, L"");
 
 		ShowWindow (hsearch, SW_HIDE);
@@ -183,6 +176,11 @@ VOID _app_search_drawwindow (
 	PatBlt (context->hdc, wnd_rect->left, wnd_rect->top, wnd_rect->right - wnd_rect->left, 1, PATCOPY);
 	PatBlt (context->hdc, wnd_rect->left, wnd_rect->bottom - 1, wnd_rect->right - wnd_rect->left, 1, PATCOPY);
 
+	PatBlt (context->hdc, wnd_rect->left, wnd_rect->top, 1, wnd_rect->bottom - wnd_rect->top, PATCOPY);
+	PatBlt (context->hdc, wnd_rect->right - 1, wnd_rect->top, 1, wnd_rect->bottom - wnd_rect->top, PATCOPY);
+	PatBlt (context->hdc, wnd_rect->left, wnd_rect->top, wnd_rect->right - wnd_rect->left, 1, PATCOPY);
+	PatBlt (context->hdc, wnd_rect->left, wnd_rect->bottom - 1, wnd_rect->right - wnd_rect->left, 1, PATCOPY);
+
 	SetDCBrushColor (context->hdc, RGB (60, 60, 60));
 
 	SelectObject (context->hdc, context->dc_brush);
@@ -200,6 +198,7 @@ VOID _app_search_drawbutton (
 )
 {
 	RECT btn_rect;
+	HICON hicon;
 
 	_app_search_getbuttonrect (context, wnd_rect, &btn_rect);
 
@@ -216,17 +215,9 @@ VOID _app_search_drawbutton (
 		_r_dc_fillrect (context->hdc, &btn_rect, _r_theme_isenabled () ? RGB (60, 60, 60) : GetSysColor (COLOR_WINDOW));
 	}
 
-	DrawIconEx (
-		context->hdc,
-		btn_rect.left + 1,
-		btn_rect.top,
-		_r_theme_isenabled () ? context->hicon_light : context->hicon_dark,
-		context->image_width,
-		context->image_height,
-		0,
-		NULL,
-		DI_NORMAL
-	);
+	hicon = _r_theme_isenabled () ? context->hicon_light : context->hicon_dark;
+
+	DrawIconEx (context->hdc, btn_rect.left + 1, btn_rect.top, hicon, context->image_width, context->image_height, 0, NULL, DI_NORMAL);
 }
 
 VOID _app_search_getbuttonrect (
@@ -235,12 +226,16 @@ VOID _app_search_getbuttonrect (
 	_Out_ PRECT btn_rect
 )
 {
-	*btn_rect = *wnd_rect;
+	CopyRect (btn_rect, wnd_rect);
 
 	btn_rect->left = ((btn_rect->right - context->cx_width) - context->cx_border - 1);
 	btn_rect->top += context->cx_border;
 	btn_rect->right -= context->cx_border;
 	btn_rect->bottom -= context->cx_border;
+
+	// shift the button rect to the left based on the button index
+	//btn_rect->left -= (context->cx_width + context->cx_border - 1);
+	//btn_rect->right -= (context->cx_width + context->cx_border - 1);
 }
 
 BOOLEAN _app_search_isstringfound (
@@ -250,7 +245,7 @@ BOOLEAN _app_search_isstringfound (
 	_Inout_ PBOOLEAN is_changed
 )
 {
-	if (!string)
+	if (_r_obj_isstringempty (string))
 	{
 		if (context->is_hidden)
 		{
@@ -326,9 +321,9 @@ BOOLEAN _app_search_applyfilteritem (
 	_In_opt_ PR_STRING search_string
 )
 {
-	PITEM_APP ptr_app = NULL;
-	PITEM_RULE ptr_rule = NULL;
 	PITEM_NETWORK ptr_network = NULL;
+	PITEM_RULE ptr_rule = NULL;
+	PITEM_APP ptr_app = NULL;
 	PITEM_LOG ptr_log = NULL;
 	PR_STRING string;
 	BOOLEAN is_changed = FALSE;
@@ -341,7 +336,7 @@ BOOLEAN _app_search_applyfilteritem (
 		is_changed = TRUE;
 	}
 
-	if (!search_string)
+	if (_r_obj_isstringempty (search_string))
 		goto CleanupExit;
 
 	switch (listview_id)
@@ -351,24 +346,18 @@ BOOLEAN _app_search_applyfilteritem (
 		case IDC_APPS_UWP:
 		case IDC_RULE_APPS_ID:
 		{
-			ptr_app = _app_getappitem (context->id_code);
+			ptr_app = _app_getappitem ((ULONG)context->id_code);
 
 			if (!ptr_app)
 				goto CleanupExit;
 
 			// path
-			if (ptr_app->real_path)
-			{
-				if (_app_search_isstringfound (&ptr_app->real_path->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_app->real_path && _app_search_isstringfound (&ptr_app->real_path->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			// comment
-			if (!_r_obj_isstringempty (ptr_app->comment))
-			{
-				if (_app_search_isstringfound (&ptr_app->comment->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (!_r_obj_isstringempty (ptr_app->comment) && _app_search_isstringfound (&ptr_app->comment->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			break;
 		}
@@ -383,56 +372,38 @@ BOOLEAN _app_search_applyfilteritem (
 			if (!ptr_rule)
 				goto CleanupExit;
 
-			if (ptr_rule->name)
-			{
-				if (_app_search_isstringfound (&ptr_rule->name->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_rule->name && _app_search_isstringfound (&ptr_rule->name->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
-			if (ptr_rule->rule_remote)
-			{
-				if (_app_search_isstringfound (&ptr_rule->rule_remote->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_rule->rule_remote && _app_search_isstringfound (&ptr_rule->rule_remote->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
-			if (ptr_rule->rule_local)
-			{
-				if (_app_search_isstringfound (&ptr_rule->rule_local->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_rule->rule_local && _app_search_isstringfound (&ptr_rule->rule_local->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
-			if (ptr_rule->protocol_str)
-			{
-				if (_app_search_isstringfound (&ptr_rule->protocol_str->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_rule->protocol_str && _app_search_isstringfound (&ptr_rule->protocol_str->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			// comment
-			if (!_r_obj_isstringempty (ptr_rule->comment))
-			{
-				if (_app_search_isstringfound (&ptr_rule->comment->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (!_r_obj_isstringempty (ptr_rule->comment) && _app_search_isstringfound (&ptr_rule->comment->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			break;
 		}
 
 		case IDC_NETWORK:
 		{
-			ptr_network = _app_network_getitem (context->id_code);
+			ptr_network = _app_network_getitem ((ULONG)context->id_code);
 
 			if (!ptr_network)
 				goto CleanupExit;
 
 			// path
-			if (ptr_network->path)
-			{
-				if (_app_search_isstringfound (&ptr_network->path->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_network->path && _app_search_isstringfound (&ptr_network->path->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			// local address
-			string = _InterlockedCompareExchangePointer (&ptr_network->local_addr_str, NULL, NULL);
+			string = (PR_STRING)_InterlockedCompareExchangePointer ((volatile PVOID_PTR)&ptr_network->local_addr_str, NULL, NULL);
 
 			if (string)
 			{
@@ -441,7 +412,7 @@ BOOLEAN _app_search_applyfilteritem (
 			}
 
 			// local host
-			string = _InterlockedCompareExchangePointer (&ptr_network->local_host_str, NULL, NULL);
+			string = (PR_STRING)_InterlockedCompareExchangePointer ((volatile PVOID_PTR)&ptr_network->local_host_str, NULL, NULL);
 
 			if (string)
 			{
@@ -450,7 +421,7 @@ BOOLEAN _app_search_applyfilteritem (
 			}
 
 			// remote address
-			string = _InterlockedCompareExchangePointer (&ptr_network->remote_addr_str, NULL, NULL);
+			string = (PR_STRING)_InterlockedCompareExchangePointer ((volatile PVOID_PTR)&ptr_network->remote_addr_str, NULL, NULL);
 
 			if (string)
 			{
@@ -459,7 +430,7 @@ BOOLEAN _app_search_applyfilteritem (
 			}
 
 			// remote host
-			string = _InterlockedCompareExchangePointer (&ptr_network->remote_host_str, NULL, NULL);
+			string = (PR_STRING)_InterlockedCompareExchangePointer ((volatile PVOID_PTR)&ptr_network->remote_host_str, NULL, NULL);
 
 			if (string)
 			{
@@ -468,52 +439,37 @@ BOOLEAN _app_search_applyfilteritem (
 			}
 
 			// protocol
-			if (ptr_network->protocol_str)
-			{
-				if (_app_search_isstringfound (&ptr_network->protocol_str->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_network->protocol_str && _app_search_isstringfound (&ptr_network->protocol_str->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			break;
 		}
 
 		case IDC_LOG:
 		{
-			ptr_log = _app_getlogitem (context->id_code);
+			ptr_log = _app_getlogitem ((ULONG)context->id_code);
 
 			if (!ptr_log)
 				goto CleanupExit;
 
 			// path
-			if (ptr_log->path)
-			{
-				if (_app_search_isstringfound (&ptr_log->path->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_log->path && _app_search_isstringfound (&ptr_log->path->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			// filter name
-			if (ptr_log->filter_name)
-			{
-				if (_app_search_isstringfound (&ptr_log->filter_name->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_log->filter_name && _app_search_isstringfound (&ptr_log->filter_name->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			// layer name
-			if (ptr_log->layer_name)
-			{
-				if (_app_search_isstringfound (&ptr_log->layer_name->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_log->layer_name && _app_search_isstringfound (&ptr_log->layer_name->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			// user name
-			if (ptr_log->username)
-			{
-				if (_app_search_isstringfound (&ptr_log->username->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_log->username && _app_search_isstringfound (&ptr_log->username->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			// local address
-			string = _InterlockedCompareExchangePointer (&ptr_log->local_addr_str, NULL, NULL);
+			string = (PR_STRING)_InterlockedCompareExchangePointer ((volatile PVOID_PTR)&ptr_log->local_addr_str, NULL, NULL);
 
 			if (string)
 			{
@@ -522,7 +478,7 @@ BOOLEAN _app_search_applyfilteritem (
 			}
 
 			// local host
-			string = _InterlockedCompareExchangePointer (&ptr_log->local_host_str, NULL, NULL);
+			string = (PR_STRING)_InterlockedCompareExchangePointer ((volatile PVOID_PTR)&ptr_log->local_host_str, NULL, NULL);
 
 			if (string)
 			{
@@ -531,7 +487,7 @@ BOOLEAN _app_search_applyfilteritem (
 			}
 
 			// remote address
-			string = _InterlockedCompareExchangePointer (&ptr_log->remote_addr_str, NULL, NULL);
+			string = (PR_STRING)_InterlockedCompareExchangePointer ((volatile PVOID_PTR)&ptr_log->remote_addr_str, NULL, NULL);
 
 			if (string)
 			{
@@ -540,7 +496,7 @@ BOOLEAN _app_search_applyfilteritem (
 			}
 
 			// remote host
-			string = _InterlockedCompareExchangePointer (&ptr_log->remote_host_str, NULL, NULL);
+			string = (PR_STRING)_InterlockedCompareExchangePointer ((volatile PVOID_PTR)&ptr_log->remote_host_str, NULL, NULL);
 
 			if (string)
 			{
@@ -549,11 +505,8 @@ BOOLEAN _app_search_applyfilteritem (
 			}
 
 			// protocol
-			if (ptr_log->protocol_str)
-			{
-				if (_app_search_isstringfound (&ptr_log->protocol_str->sr, &search_string->sr, context, &is_changed))
-					goto CleanupExit;
-			}
+			if (ptr_log->protocol_str && _app_search_isstringfound (&ptr_log->protocol_str->sr, &search_string->sr, context, &is_changed))
+				goto CleanupExit;
 
 			break;
 		}
@@ -561,21 +514,21 @@ BOOLEAN _app_search_applyfilteritem (
 
 CleanupExit:
 
-	if (ptr_app)
-		_r_obj_dereference (ptr_app);
-
-	if (ptr_rule)
-		_r_obj_dereference (ptr_rule);
+	if (is_changed)
+		_r_listview_setitem (hwnd, listview_id, item_id, 0, NULL, I_IMAGECALLBACK, I_GROUPIDCALLBACK, I_DEFAULT);
 
 	if (ptr_network)
 		_r_obj_dereference (ptr_network);
 
+	if (ptr_rule)
+		_r_obj_dereference (ptr_rule);
+
+	if (ptr_app)
+		_r_obj_dereference (ptr_app);
+
 	if (ptr_log)
 		_r_obj_dereference (ptr_log);
 
-	if (is_changed)
-		_r_listview_setitem_ex (hwnd, listview_id, item_id, 0, NULL, I_IMAGECALLBACK, I_GROUPIDCALLBACK, 0);
-
 	return is_changed;
 }
 
@@ -606,7 +559,7 @@ VOID _app_search_createbufferedcontext (
 
 	context->hbitmap = CreateCompatibleBitmap (hdc, context->rect.right, context->rect.bottom);
 
-	context->old_bitmap = SelectObject (context->hdc, context->hbitmap);
+	context->old_bitmap = (HBITMAP)SelectObject (context->hdc, context->hbitmap);
 }
 
 VOID _app_search_destroybufferedcontext (
@@ -631,10 +584,10 @@ LRESULT CALLBACK _app_search_subclass_proc (
 	PSEARCH_CONTEXT context;
 	WNDPROC wnd_proc;
 
-	context = _r_wnd_getcontext (hwnd, SHORT_MAX);
+	context = (PSEARCH_CONTEXT)_r_wnd_getcontext (hwnd, SHORT_MAX);
 
 	if (!context)
-		return FALSE;
+		return DefWindowProcW (hwnd, msg, wparam, lparam);
 
 	wnd_proc = context->wnd_proc;
 
@@ -667,10 +620,10 @@ LRESULT CALLBACK _app_search_subclass_proc (
 
 			calc_size = (LPNCCALCSIZE_PARAMS)lparam;
 
-			// Let Windows handle the non-client defaults.
+			// let Windows handle the non-client defaults
 			CallWindowProcW (wnd_proc, hwnd, msg, wparam, lparam);
 
-			// Deflate the client area to accommodate the custom button.
+			// deflate the client area to accommodate the custom button
 			calc_size->rgrc[0].right -= context->cx_width;
 
 			return 0;
@@ -678,12 +631,21 @@ LRESULT CALLBACK _app_search_subclass_proc (
 
 		case WM_NCPAINT:
 		{
-			RECT wnd_rect;
-			RECT buf_rect;
-			POINT pt = {0};
+			RECT buf_rect, wnd_rect;
 			HRGN hrgn;
 			HDC hdc;
-			ULONG flags = DCX_WINDOW | DCX_LOCKWINDOWUPDATE | DCX_USESTYLE;
+			ULONG flags = DCX_WINDOW | DCX_CACHE | DCX_USESTYLE;
+			LONG height, width;
+
+			// get the screen coordinates of the window
+			if (!GetWindowRect (hwnd, &wnd_rect))
+				break;
+
+			width = _r_calc_rectwidth (&wnd_rect);
+			height = _r_calc_rectheight (&wnd_rect);
+
+			if (height <= 0 || width <= 0)
+				break;
 
 			hrgn = (HRGN)wparam;
 
@@ -697,22 +659,10 @@ LRESULT CALLBACK _app_search_subclass_proc (
 
 			if (hdc)
 			{
-				// Get the screen coordinates of the window.
-				GetWindowRect (hwnd, &wnd_rect);
-
-				// Adjust the coordinates (start from 0,0).
+				// normalize window coordinates (start from 0,0)
 				OffsetRect (&wnd_rect, -wnd_rect.left, -wnd_rect.top);
 
-				// Exclude client area.
-				ExcludeClipRect (
-					hdc,
-					wnd_rect.left + context->cx_border + 1,
-					wnd_rect.top + context->cx_border + 1,
-					wnd_rect.right - context->cx_width - (context->cx_border + 1),
-					wnd_rect.bottom - (context->cx_border + 1)
-				);
-
-				SetRect (&buf_rect, 0, 0, _r_calc_rectwidth (&wnd_rect), _r_calc_rectheight (&wnd_rect));
+				SetRect (&buf_rect, 0, 0, width, height);
 
 				if (context->hdc && (context->rect.right < buf_rect.right || context->rect.bottom < buf_rect.bottom))
 					_app_search_destroybufferedcontext (context);
@@ -727,9 +677,19 @@ LRESULT CALLBACK _app_search_subclass_proc (
 					break;
 				}
 
+				// exclude client area from NC drawing
+				ExcludeClipRect (
+					hdc,
+					wnd_rect.left + context->cx_border + 1,
+					wnd_rect.top + context->cx_border + 1,
+					wnd_rect.right - context->cx_width - (context->cx_border + 1),
+					wnd_rect.bottom - (context->cx_border + 1)
+				);
+
+				// NC frame
 				if ((context->is_mouseactive && context->is_hot) || GetFocus () == hwnd)
 				{
-					_r_dc_framerect (context->hdc, &wnd_rect, GetSysColor (COLOR_HOTLIGHT));
+					_r_dc_framerect (context->hdc, &wnd_rect, _r_theme_isenabled () ? WND_HOT_CLR : GetSysColor (COLOR_HOTLIGHT));
 
 					InflateRect (&wnd_rect, -1, -1);
 
@@ -747,7 +707,8 @@ LRESULT CALLBACK _app_search_subclass_proc (
 				_app_search_drawwindow (context, &wnd_rect);
 				_app_search_drawbutton (context, hwnd, &wnd_rect);
 
-				BitBlt (hdc, buf_rect.left, buf_rect.top, buf_rect.right, buf_rect.bottom, context->hdc, 0, 0, SRCCOPY);
+				// commit to the target DC
+				BitBlt (hdc, 0, 0, buf_rect.right, buf_rect.bottom, context->hdc, 0, 0, SRCCOPY);
 
 				ReleaseDC (hwnd, hdc);
 			}
@@ -757,22 +718,21 @@ LRESULT CALLBACK _app_search_subclass_proc (
 
 		case WM_NCHITTEST:
 		{
-			RECT wnd_rect;
-			RECT btn_rect;
-			POINT point;
+			RECT btn_rect, wnd_rect;
+			POINT point = {0};
 
-			// Get the screen coordinates of the mouse.
-			if (!GetCursorPos (&point))
-				break;
+			// get the screen coordinates of the mouse
+			point.x = GET_X_LPARAM (lparam);
+			point.y = GET_Y_LPARAM (lparam);
 
-			// Get the screen coordinates of the window.
+			// get the screen coordinates of the window
 			if (!GetWindowRect (hwnd, &wnd_rect))
 				break;
 
-			// Get the position of the inserted button.
+			// get the position of the inserted button
 			_app_search_getbuttonrect (context, &wnd_rect, &btn_rect);
 
-			// Check that the mouse is within the inserted button.
+			// check that the mouse is within the inserted button
 			if (PtInRect (&btn_rect, point))
 				return HTBORDER;
 
@@ -781,19 +741,18 @@ LRESULT CALLBACK _app_search_subclass_proc (
 
 		case WM_NCLBUTTONDOWN:
 		{
-			RECT wnd_rect;
-			RECT btn_rect;
-			POINT point;
+			RECT btn_rect, wnd_rect;
+			POINT point = {0};
 
-			// Get the screen coordinates of the mouse.
-			if (!GetCursorPos (&point))
-				break;
+			// get the screen coordinates of the mouse
+			point.x = GET_X_LPARAM (lparam);
+			point.y = GET_Y_LPARAM (lparam);
 
-			// Get the screen coordinates of the window.
+			// get the screen coordinates of the window
 			if (!GetWindowRect (hwnd, &wnd_rect))
 				break;
 
-			// Get the position of the inserted button.
+			// get the position of the inserted button
 			_app_search_getbuttonrect (context, &wnd_rect, &btn_rect);
 
 			context->is_pushed = PtInRect (&btn_rect, point);
@@ -807,22 +766,24 @@ LRESULT CALLBACK _app_search_subclass_proc (
 
 		case WM_LBUTTONUP:
 		{
-			RECT wnd_rect;
-			RECT btn_rect;
-			POINT point;
+			RECT btn_rect, wnd_rect;
+			POINT point = {0};
+			ULONG position;
 
-			// Get the screen coordinates of the mouse.
-			if (!GetCursorPos (&point))
-				break;
+			// get the screen coordinates of the mouse
+			position = GetMessagePos ();
 
-			// Get the screen coordinates of the window.
+			point.x = GET_X_LPARAM (position);
+			point.y = GET_Y_LPARAM (position);
+
+			// get the screen coordinates of the window
 			if (!GetWindowRect (hwnd, &wnd_rect))
 				break;
 
-			// Get the position of the inserted button.
+			// get the position of the inserted button
 			_app_search_getbuttonrect (context, &wnd_rect, &btn_rect);
 
-			// Check that the mouse is within the inserted button.
+			// check that the mouse is within the inserted button
 			if (PtInRect (&btn_rect, point))
 			{
 				SetFocus (hwnd);
@@ -848,18 +809,20 @@ LRESULT CALLBACK _app_search_subclass_proc (
 		case WM_UNDO:
 		case WM_KEYUP:
 		case WM_SETTEXT:
-		case WM_KILLFOCUS:
 		{
+			LRESULT result = CallWindowProcW (wnd_proc, hwnd, msg, wparam, lparam);
+
 			RedrawWindow (hwnd, NULL, NULL, RDW_FRAME | RDW_INVALIDATE);
-			break;
+
+			return result;
 		}
 
 		case WM_SETTINGCHANGE:
 		case WM_SYSCOLORCHANGE:
 		case WM_THEMECHANGED:
-		case WM_DPICHANGED:
+		case WM_DPICHANGED_AFTERPARENT:
 		{
-			if (msg == WM_DPICHANGED)
+			if (msg == WM_DPICHANGED_AFTERPARENT)
 				context->dpi_value = _r_dc_getwindowdpi (context->hwnd);
 
 			_app_search_themechanged (hwnd, context);
@@ -871,30 +834,32 @@ LRESULT CALLBACK _app_search_subclass_proc (
 		case WM_NCMOUSEMOVE:
 		{
 			TRACKMOUSEEVENT tme = {0};
-			RECT wnd_rect;
-			RECT btn_rect;
-			POINT pt;
+			RECT btn_rect, wnd_rect;
+			POINT point = {0};
+			ULONG position;
 
-			// Get the screen coordinates of the mouse.
-			if (!GetCursorPos (&pt))
-				break;
+			// get the screen coordinates of the mouse
+			position = GetMessagePos ();
 
-			// Get the screen coordinates of the window.
+			point.x = GET_X_LPARAM (position);
+			point.y = GET_Y_LPARAM (position);
+
+			// get the screen coordinates of the window
 			if (!GetWindowRect (hwnd, &wnd_rect))
 				break;
 
-			context->is_hot = PtInRect (&wnd_rect, pt);
+			context->is_hot = PtInRect (&wnd_rect, point);
 
-			// Get the position of the inserted button.
+			// get the position of the inserted button
 			_app_search_getbuttonrect (context, &wnd_rect, &btn_rect);
 
-			// Check that the mouse is within the inserted button.
+			// check that the mouse is within the inserted button
 			if (!context->is_mouseactive)
 			{
-				tme.cbSize = sizeof (tme);
-				tme.dwFlags = TME_LEAVE;
+				tme.cbSize = sizeof (TRACKMOUSEEVENT);
+				tme.dwFlags = TME_LEAVE | TME_NONCLIENT;
 				tme.hwndTrack = hwnd;
-				tme.dwHoverTime = HOVER_DEFAULT;
+				tme.dwHoverTime = 0;
 
 				context->is_mouseactive = TRUE;
 
@@ -910,27 +875,16 @@ LRESULT CALLBACK _app_search_subclass_proc (
 		case WM_NCMOUSELEAVE:
 		{
 			TRACKMOUSEEVENT tme = {0};
-			RECT wnd_rect;
-			RECT btn_rect;
+			RECT btn_rect, wnd_rect;
 			POINT point;
 
-			if (context->is_mouseactive)
-			{
-				tme.cbSize = sizeof (TRACKMOUSEEVENT);
-				tme.dwFlags = TME_LEAVE | TME_CANCEL;
-				tme.hwndTrack = hwnd;
-				tme.dwHoverTime = HOVER_DEFAULT;
+			context->is_mouseactive = FALSE;
 
-				TrackMouseEvent (&tme);
-
-				context->is_mouseactive = FALSE;
-			}
-
-			// Get the screen coordinates of the mouse.
+			// get the screen coordinates of the mouse
 			if (!GetCursorPos (&point))
 				break;
 
-			// Get the screen coordinates of the window.
+			// get the screen coordinates of the window
 			if (!GetWindowRect (hwnd, &wnd_rect))
 				break;
 
@@ -942,6 +896,24 @@ LRESULT CALLBACK _app_search_subclass_proc (
 
 			break;
 		}
+
+		case WM_CHAR:
+		{
+			// delete previous word for ctrl+backspace (dmex)
+			if (wparam == VK_F16 && GetAsyncKeyState (VK_CONTROL) < 0)
+				return 1;
+
+			break;
+		}
+
+		case WM_GETDLGCODE:
+		{
+			// intercept esc key (otherwise it would get sent to parent window)
+			if (wparam == VK_ESCAPE && ((MSG*)lparam)->message == WM_KEYDOWN)
+				return DLGC_WANTMESSAGE;
+
+			break;
+		}
 	}
 
 	return CallWindowProcW (wnd_proc, hwnd, msg, wparam, lparam);

src/search.h

@@ -1,6 +1,6 @@
 // simplewall
-// Copyright (c) 2012-2021 dmex
-// Copyright (c) 2021-2024 Henry++
+// Copyright (c) 2012-2026 dmex
+// Copyright (c) 2021-2026 Henry++
 
 #pragma once
 
@@ -54,12 +54,13 @@ VOID _app_search_initializeimages (
 
 VOID _app_search_themechanged (
 	_In_ HWND hwnd,
-	_In_ PSEARCH_CONTEXT context
+	_Inout_ PSEARCH_CONTEXT context
 );
 
 VOID _app_search_setvisible (
 	_In_ HWND hwnd,
-	_In_ HWND hsearch
+	_In_ HWND hsearch,
+	_In_ LONG dpi_value
 );
 
 VOID _app_search_drawwindow (

src/security.c

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2020-2024 Henry++
+// Copyright (c) 2020-2026 Henry++
 
 #include "global.h"
 
@@ -9,19 +9,17 @@ PSID _app_quyerybuiltinsid (
 )
 {
 	PSID sid;
-	ULONG sid_length;
+	ULONG sid_length = SECURITY_MAX_SID_SIZE;
 
-	sid_length = SECURITY_MAX_SID_SIZE;
-	sid = _r_mem_allocate (sid_length);
+	sid = (PSID)_r_mem_allocate (sid_length);
 
 	if (!CreateWellKnownSid (sid_type, NULL, sid, &sid_length))
 	{
-		_r_log_v (LOG_LEVEL_ERROR, NULL, L"CreateWellKnownSid", NtLastError (), L"%" TEXT (PRIu32), sid_type);
+		_r_log_v (LOG_LEVEL_ERROR, NULL, L"CreateWellKnownSid", NtLastError (), L"%d", sid_type);
 
-		_r_mem_free (sid);
+		_r_mem_free (sid); // cleanup!
 
 		return NULL;
-
 	}
 
 	return sid;
@@ -29,20 +27,20 @@ PSID _app_quyerybuiltinsid (
 
 VOID _app_generate_credentials ()
 {
-	// For revoke current user (v3.0.5 Beta and lower)
-	config.builtin_current_sid = _r_sys_getcurrenttoken ()->token_sid;
+	// S-1-5-32-556 (BUILTIN\Network Configuration Operators)
+	config.builtin_netops_sid = _app_quyerybuiltinsid (WinBuiltinNetworkConfigurationOperatorsSid);
 
 	// S-1-5-32-544 (BUILTIN\Administrators)
 	config.builtin_admins_sid = _app_quyerybuiltinsid (WinBuiltinAdministratorsSid);
 
-	// S-1-5-32-556 (BUILTIN\Network Configuration Operators)
-	config.builtin_netops_sid = _app_quyerybuiltinsid (WinBuiltinNetworkConfigurationOperatorsSid);
+	// for revoke current user (v3.0.5 Beta and lower)
+	config.builtin_current_sid = _r_sys_getcurrenttoken ()->token_sid;
 
-	_r_sys_getservicesid (L"mpssvc", &config.service_mpssvc_sid);
-	_r_sys_getservicesid (L"NlaSvc", &config.service_nlasvc_sid);
-	_r_sys_getservicesid (L"PolicyAgent", &config.service_policyagent_sid);
-	_r_sys_getservicesid (L"RpcSs", &config.service_rpcss_sid);
-	_r_sys_getservicesid (L"WdiServiceHost", &config.service_wdiservicehost_sid);
+	_r_sys_getservicesid (&config.service_wdiservicehost_sid, L"WdiServiceHost");
+	_r_sys_getservicesid (&config.service_policyagent_sid, L"PolicyAgent");
+	_r_sys_getservicesid (&config.service_mpssvc_sid, L"mpssvc");
+	_r_sys_getservicesid (&config.service_nlasvc_sid, L"NlaSvc");
+	_r_sys_getservicesid (&config.service_rpcss_sid, L"RpcSs");
 }
 
 _Ret_maybenull_
@@ -53,19 +51,20 @@ PACL _app_createaccesscontrollist (
 {
 	PACCESS_ALLOWED_ACE ace = NULL;
 	EXPLICIT_ACCESS ea[3] = {0};
-	PACL new_dacl;
+	PACL new_dacl = NULL;
 	ULONG count = 0;
-	BOOLEAN is_currentuserhaverights = FALSE;
-	BOOLEAN is_openforeveryone = FALSE;
-	BOOLEAN is_secured = FALSE;
+	BOOLEAN is_currentuserhaverights = FALSE, is_openforeveryone = FALSE, is_secured = FALSE;
 	NTSTATUS status;
 
 	for (WORD ace_index = 0; ace_index < acl->AceCount; ace_index++)
 	{
-		status = RtlGetAce (acl, ace_index, &ace);
+		status = RtlGetAce (acl, ace_index, (PVOID_PTR)&ace);
 
 		if (!NT_SUCCESS (status))
+		{
+			_r_log_v (LOG_LEVEL_ERROR, NULL, L"RtlGetAce", status, L"%d", ace_index);
 			continue;
+		}
 
 		if (ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE)
 		{
@@ -96,7 +95,7 @@ PACL _app_createaccesscontrollist (
 		{
 			if (RtlEqualSid (&ace->SidStart, &SeEveryoneSid))
 			{
-				if ((ace->Mask == (FWPM_ACTRL_WRITE | DELETE | WRITE_DAC | WRITE_OWNER)))
+				if (ace->Mask == (FWPM_ACTRL_WRITE | DELETE | WRITE_DAC | WRITE_OWNER))
 					is_secured = TRUE;
 			}
 		}
@@ -106,27 +105,27 @@ PACL _app_createaccesscontrollist (
 	{
 		// revoke current user access rights
 		if (is_currentuserhaverights)
-			_app_setexplicitaccess (&ea[count++], REVOKE_ACCESS, 0, NO_INHERITANCE, config.builtin_current_sid);
+			_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, REVOKE_ACCESS, 0, config.builtin_current_sid);
 
 		// revoke everyone access rights
 		if (is_openforeveryone)
-			_app_setexplicitaccess (&ea[count++], REVOKE_ACCESS, 0, NO_INHERITANCE, &SeEveryoneSid);
+			_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, REVOKE_ACCESS, 0, &SeEveryoneSid);
 
 		// secure filter from deletion
 		_app_setexplicitaccess (
 			&ea[count++],
+			is_secure ? CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE : NO_INHERITANCE,
 			is_secure ? DENY_ACCESS : GRANT_ACCESS,
 			FWPM_ACTRL_WRITE | DELETE | WRITE_DAC | WRITE_OWNER,
-			is_secure ? CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE : NO_INHERITANCE,
 			&SeEveryoneSid
 		);
 
 		status = SetEntriesInAclW (count, ea, acl, &new_dacl);
 
-		if (status == ERROR_SUCCESS)
-			return new_dacl;
+		if (status != ERROR_SUCCESS)
+			_r_log (LOG_LEVEL_ERROR, NULL, L"SetEntriesInAclW", NULL, status);
 
-		_r_log (LOG_LEVEL_ERROR, NULL, L"SetEntriesInAclW", status, NULL);
+		return new_dacl;
 	}
 
 	return NULL;
@@ -134,17 +133,17 @@ PACL _app_createaccesscontrollist (
 
 VOID _app_setexplicitaccess (
 	_Out_ PEXPLICIT_ACCESS ea,
+	_In_ ULONG inheritance,
 	_In_ ACCESS_MODE mode,
 	_In_ ULONG rights,
-	_In_ ULONG inheritance,
 	_In_opt_ PSID sid
 )
 {
-	ea->grfAccessMode = mode;
+	RtlSecureZeroMemory (ea, sizeof (EXPLICIT_ACCESS));
+
 	ea->grfAccessPermissions = rights;
 	ea->grfInheritance = inheritance;
-
-	RtlZeroMemory (&(ea->Trustee), sizeof (ea->Trustee));
+	ea->grfAccessMode = mode;
 
 	BuildTrusteeWithSidW (&(ea->Trustee), sid);
 }
@@ -153,25 +152,20 @@ VOID _app_setenginesecurity (
 	_In_ HANDLE hengine
 )
 {
-	PSECURITY_DESCRIPTOR security_descriptor;
+	PSECURITY_DESCRIPTOR security_descriptor = NULL;
 	PACCESS_ALLOWED_ACE ace = NULL;
-	EXPLICIT_ACCESS ea[18] = {0};
-	PSID sid_owner;
-	PSID sid_group;
-	PACL new_dacl;
-	PACL dacl;
-	PACL sacl;
+	EXPLICIT_ACCESS ea[0x12] = {0};
+	PACL dacl = NULL, sacl = NULL, new_dacl = NULL;
+	PSID sid_group = NULL, sid_owner = NULL;
 	ULONG count = 0;
-	BOOLEAN is_currentuserhaverights = FALSE;
-	BOOLEAN is_openforeveryone = FALSE;
-	NTSTATUS status;
+	BOOLEAN is_currentuserhaverights = FALSE, is_openforeveryone = FALSE;
+	LONG status;
 
 	status = FwpmEngineGetSecurityInfo0 (hengine, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
 
 	if (status != ERROR_SUCCESS)
 	{
-		_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmEngineGetSecurityInfo0", status, NULL);
-
+		_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmEngineGetSecurityInfo0", NULL, status);
 		return;
 	}
 
@@ -179,10 +173,13 @@ VOID _app_setenginesecurity (
 	{
 		for (WORD ace_index = 0; ace_index < dacl->AceCount; ace_index++)
 		{
-			status = RtlGetAce (dacl, ace_index, &ace);
+			status = RtlGetAce (dacl, ace_index, (PVOID_PTR)&ace);
 
 			if (!NT_SUCCESS (status))
+			{
+				_r_log_v (LOG_LEVEL_ERROR, NULL, L"RtlGetAce", status, L"%d", ace_index);
 				continue;
+			}
 
 			if (ace->Header.AceType != ACCESS_ALLOWED_ACE_TYPE)
 				continue;
@@ -195,7 +192,7 @@ VOID _app_setenginesecurity (
 			// src: https://github.com/henrypp/simplewall/blob/v.3.0.5/src/wfp.cpp#L96
 			if (RtlEqualSid (&ace->SidStart, config.builtin_current_sid))
 			{
-				if ((ace->Mask == (FWPM_GENERIC_ALL | DELETE | WRITE_DAC | WRITE_OWNER)))
+				if (ace->Mask == (FWPM_GENERIC_ALL | DELETE | WRITE_DAC | WRITE_OWNER))
 					is_currentuserhaverights = TRUE;
 			}
 
@@ -214,156 +211,62 @@ VOID _app_setenginesecurity (
 		if (is_currentuserhaverights || is_openforeveryone)
 		{
 			FwpmEngineSetSecurityInfo0 (hengine, OWNER_SECURITY_INFORMATION, &SeLocalServiceSid, NULL, NULL, NULL);
-
 			FwpmNetEventsSetSecurityInfo0 (hengine, OWNER_SECURITY_INFORMATION, &SeLocalServiceSid, NULL, NULL, NULL);
 
 			// revoke current user access rights
-			if (is_currentuserhaverights)
-			{
-				if (config.builtin_current_sid)
-					_app_setexplicitaccess (&ea[count++], REVOKE_ACCESS, 0, NO_INHERITANCE, config.builtin_current_sid);
-			}
+			if (is_currentuserhaverights && config.builtin_current_sid)
+				_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, REVOKE_ACCESS, 0, config.builtin_current_sid);
 
 			// reset default engine rights
 			if (is_openforeveryone)
 			{
 				if (config.builtin_admins_sid)
 				{
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						FWPM_GENERIC_ALL | DELETE | WRITE_DAC | WRITE_OWNER, NO_INHERITANCE,
-						config.builtin_admins_sid
-					);
-
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						0x10000000,
-						OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
-						config.builtin_admins_sid
-					);
+					_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, GRANT_ACCESS, FWPM_GENERIC_ALL | DELETE | WRITE_DAC | WRITE_OWNER, config.builtin_admins_sid);
+					_app_setexplicitaccess (&ea[count++], OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE, GRANT_ACCESS, 0x10000000, config.builtin_admins_sid);
 				}
 
 				if (config.builtin_netops_sid)
 				{
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						FWPM_GENERIC_ALL | DELETE,
-						NO_INHERITANCE,
-						config.builtin_netops_sid
-					);
-
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						0xE0000000,
-						OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
-						config.builtin_netops_sid
-					);
+					_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, GRANT_ACCESS, FWPM_GENERIC_ALL | DELETE, config.builtin_netops_sid);
+					_app_setexplicitaccess (&ea[count++], OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE, GRANT_ACCESS, 0xE0000000, config.builtin_netops_sid);
 				}
 
 				if (config.service_mpssvc_sid)
 				{
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						FWPM_GENERIC_ALL | DELETE,
-						NO_INHERITANCE,
-						config.service_mpssvc_sid->buffer
-					);
-
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						0xE0000000,
-						OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
-						config.service_mpssvc_sid->buffer
-					);
+					_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, GRANT_ACCESS, FWPM_GENERIC_ALL | DELETE, (PSID)config.service_mpssvc_sid->buffer);
+					_app_setexplicitaccess (&ea[count++], OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE, GRANT_ACCESS, 0xE0000000, (PSID)config.service_mpssvc_sid->buffer);
 				}
 
 				if (config.service_nlasvc_sid)
 				{
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						FWPM_GENERIC_READ | FWPM_GENERIC_EXECUTE,
-						NO_INHERITANCE,
-						config.service_nlasvc_sid->buffer
-					);
-
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						0xA0000000,
-						OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
-						config.service_nlasvc_sid->buffer
-					);
+					_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, GRANT_ACCESS, FWPM_GENERIC_READ | FWPM_GENERIC_EXECUTE, (PSID)config.service_nlasvc_sid->buffer);
+					_app_setexplicitaccess (&ea[count++], OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE, GRANT_ACCESS, 0xA0000000, (PSID)config.service_nlasvc_sid->buffer);
 				}
 
 				if (config.service_policyagent_sid)
 				{
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						FWPM_GENERIC_ALL | DELETE,
-						NO_INHERITANCE,
-						config.service_policyagent_sid->buffer
-					);
-
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						0xE0000000,
-						OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
-						config.service_policyagent_sid->buffer
-					);
+					_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, GRANT_ACCESS, FWPM_GENERIC_ALL | DELETE, (PSID)config.service_policyagent_sid->buffer);
+					_app_setexplicitaccess (&ea[count++], OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE, GRANT_ACCESS, 0xE0000000, (PSID)config.service_policyagent_sid->buffer);
 				}
 
 				if (config.service_rpcss_sid)
 				{
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						FWPM_GENERIC_ALL | DELETE,
-						NO_INHERITANCE,
-						config.service_rpcss_sid->buffer
-					);
-
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						0xE0000000,
-						OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
-						config.service_rpcss_sid->buffer
-					);
+					_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, GRANT_ACCESS, FWPM_GENERIC_ALL | DELETE, (PSID)config.service_rpcss_sid->buffer);
+					_app_setexplicitaccess (&ea[count++], OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE, GRANT_ACCESS, 0xE0000000, (PSID)config.service_rpcss_sid->buffer);
 				}
 
 				if (config.service_wdiservicehost_sid)
 				{
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						FWPM_GENERIC_READ | FWPM_GENERIC_EXECUTE,
-						NO_INHERITANCE,
-						config.service_wdiservicehost_sid->buffer
-					);
-
-					_app_setexplicitaccess (
-						&ea[count++],
-						GRANT_ACCESS,
-						0xA0000000,
-						OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE,
-						config.service_wdiservicehost_sid->buffer
-					);
+					_app_setexplicitaccess (&ea[count++], NO_INHERITANCE, GRANT_ACCESS, FWPM_GENERIC_READ | FWPM_GENERIC_EXECUTE, (PSID)config.service_wdiservicehost_sid->buffer);
+					_app_setexplicitaccess (&ea[count++], OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE, GRANT_ACCESS, 0xA0000000, (PSID)config.service_wdiservicehost_sid->buffer);
 				}
 
 				_app_setexplicitaccess (
 					&ea[count++],
-					SET_ACCESS,
-					FWPM_ACTRL_CLASSIFY | FWPM_ACTRL_OPEN,
 					OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE,
+					SET_ACCESS,
+					FWPM_ACTRL_BEGIN_READ_TXN | FWPM_ACTRL_CLASSIFY | FWPM_ACTRL_OPEN | FWPM_ACTRL_SUBSCRIBE,
 					&SeEveryoneSid
 				);
 			}
@@ -372,19 +275,19 @@ VOID _app_setenginesecurity (
 
 			if (status != ERROR_SUCCESS)
 			{
-				_r_log (LOG_LEVEL_ERROR, NULL, L"SetEntriesInAclW", status, NULL);
+				_r_log (LOG_LEVEL_ERROR, NULL, L"SetEntriesInAclW", NULL, status);
 			}
 			else
 			{
 				status = FwpmEngineSetSecurityInfo0 (hengine, DACL_SECURITY_INFORMATION, NULL, NULL, new_dacl, NULL);
 
 				if (status != ERROR_SUCCESS)
-					_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmEngineSetSecurityInfo0", status, NULL);
+					_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmEngineSetSecurityInfo0", NULL, status);
 
 				status = FwpmNetEventsSetSecurityInfo0 (hengine, DACL_SECURITY_INFORMATION, NULL, NULL, new_dacl, NULL);
 
 				if (status != ERROR_SUCCESS)
-					_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmNetEventsSetSecurityInfo0", status, NULL);
+					_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmNetEventsSetSecurityInfo0", NULL, status);
 
 				LocalFree (new_dacl);
 			}
@@ -402,53 +305,34 @@ VOID _app_setprovidersecurity (
 )
 {
 	PSECURITY_DESCRIPTOR security_descriptor;
-	PSID sid_owner;
-	PSID sid_group;
-	PACL dacl;
-	PACL sacl;
-	PACL new_dacl;
+	PSID sid_group, sid_owner;
+	PACL dacl, sacl, new_dacl;
 	ULONG status;
 
-	status = FwpmProviderGetSecurityInfoByKey0 (
-		hengine,
-		provider_guid,
-		DACL_SECURITY_INFORMATION,
-		&sid_owner,
-		&sid_group,
-		&dacl,
-		&sacl,
-		&security_descriptor
-	);
+	status = FwpmProviderGetSecurityInfoByKey0 (hengine, provider_guid, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
 
-	if (status != ERROR_SUCCESS)
+	if (status == ERROR_SUCCESS)
 	{
-		_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmProviderGetSecurityInfoByKey0", status, NULL);
-
-		return;
-	}
-
-	if (dacl)
-	{
-		new_dacl = _app_createaccesscontrollist (dacl, is_secure);
-
-		if (new_dacl)
+		if (dacl)
 		{
-			status = FwpmProviderSetSecurityInfoByKey0 (
-				hengine,
-				provider_guid,
-				OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
-				(const PSID)config.builtin_admins_sid,
-				NULL,
-				new_dacl,
-				NULL
-			);
+			new_dacl = _app_createaccesscontrollist (dacl, is_secure);
 
-			if (status != ERROR_SUCCESS)
-				_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmProviderSetSecurityInfoByKey0", status, NULL);
+			if (new_dacl)
+			{
+				status = FwpmProviderSetSecurityInfoByKey0 (hengine, provider_guid, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, (PCSID)config.builtin_admins_sid, NULL, new_dacl, NULL);
 
-			LocalFree (new_dacl);
+				if (status != ERROR_SUCCESS)
+					_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmProviderSetSecurityInfoByKey0", NULL, status);
+
+				LocalFree (new_dacl);
+			}
 		}
 	}
+	else
+	{
+		//if (status != FWP_E_PROVIDER_NOT_FOUND)
+		_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmProviderGetSecurityInfoByKey0", NULL, status);
+	}
 
 	if (security_descriptor)
 		FwpmFreeMemory0 ((PVOID_PTR)&security_descriptor);
@@ -461,53 +345,34 @@ VOID _app_setsublayersecurity (
 )
 {
 	PSECURITY_DESCRIPTOR security_descriptor;
-	PSID sid_owner;
-	PSID sid_group;
-	PACL dacl;
-	PACL sacl;
-	PACL new_dacl;
+	PSID sid_group, sid_owner;
+	PACL dacl, sacl, new_dacl;
 	ULONG status;
 
-	status = FwpmSubLayerGetSecurityInfoByKey0 (
-		hengine,
-		sublayer_guid,
-		DACL_SECURITY_INFORMATION,
-		&sid_owner,
-		&sid_group,
-		&dacl,
-		&sacl,
-		&security_descriptor
-	);
+	status = FwpmSubLayerGetSecurityInfoByKey0 (hengine, sublayer_guid, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
 
-	if (status != ERROR_SUCCESS)
+	if (status == ERROR_SUCCESS)
 	{
-		_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmSubLayerGetSecurityInfoByKey0", status, NULL);
-
-		return;
-	}
-
-	if (dacl)
-	{
-		new_dacl = _app_createaccesscontrollist (dacl, is_secure);
-
-		if (new_dacl)
+		if (dacl)
 		{
-			status = FwpmSubLayerSetSecurityInfoByKey0 (
-				hengine,
-				sublayer_guid,
-				OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
-				(const PSID)config.builtin_admins_sid,
-				NULL,
-				new_dacl,
-				NULL
-			);
+			new_dacl = _app_createaccesscontrollist (dacl, is_secure);
 
-			if (status != ERROR_SUCCESS)
-				_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmSubLayerSetSecurityInfoByKey0", status, NULL);
+			if (new_dacl)
+			{
+				status = FwpmSubLayerSetSecurityInfoByKey0 (hengine, sublayer_guid, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, (PCSID)config.builtin_admins_sid, NULL, new_dacl, NULL);
 
-			LocalFree (new_dacl);
+				if (status != ERROR_SUCCESS)
+					_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmSubLayerSetSecurityInfoByKey0", NULL, status);
+
+				LocalFree (new_dacl);
+			}
 		}
 	}
+	else
+	{
+		//if (status != FWP_E_SUBLAYER_NOT_FOUND)
+		_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmSubLayerGetSecurityInfoByKey0", NULL, status);
+	}
 
 	if (security_descriptor)
 		FwpmFreeMemory0 ((PVOID_PTR)&security_descriptor);
@@ -520,54 +385,34 @@ VOID _app_setcalloutsecurity (
 )
 {
 	PSECURITY_DESCRIPTOR security_descriptor;
-	PSID sid_owner;
-	PSID sid_group;
-	PACL dacl;
-	PACL sacl;
-	PACL new_dacl;
+	PSID sid_group, sid_owner;
+	PACL dacl, sacl, new_dacl;
 	ULONG status;
 
-	status = FwpmCalloutGetSecurityInfoByKey0 (
-		hengine,
-		callout_guid,
-		DACL_SECURITY_INFORMATION,
-		&sid_owner,
-		&sid_group,
-		&dacl,
-		&sacl,
-		&security_descriptor
-	);
+	status = FwpmCalloutGetSecurityInfoByKey0 (hengine, callout_guid, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
 
-	if (status != ERROR_SUCCESS)
+	if (status == ERROR_SUCCESS)
 	{
-		if (status != FWP_E_CALLOUT_NOT_FOUND)
-			_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmCalloutGetSecurityInfoByKey0", status, NULL);
-
-		return;
-	}
-
-	if (dacl)
-	{
-		new_dacl = _app_createaccesscontrollist (dacl, is_secure);
-
-		if (new_dacl)
+		if (dacl)
 		{
-			status = FwpmCalloutSetSecurityInfoByKey0 (
-				hengine,
-				callout_guid,
-				OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
-				(const PSID)config.builtin_admins_sid,
-				NULL,
-				new_dacl,
-				NULL
-			);
+			new_dacl = _app_createaccesscontrollist (dacl, is_secure);
 
-			if (status != ERROR_SUCCESS)
-				_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmCalloutSetSecurityInfoByKey0", status, NULL);
+			if (new_dacl)
+			{
+				status = FwpmCalloutSetSecurityInfoByKey0 (hengine, callout_guid, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, (PCSID)config.builtin_admins_sid, NULL, new_dacl, NULL);
 
-			LocalFree (new_dacl);
+				if (status != ERROR_SUCCESS)
+					_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmCalloutSetSecurityInfoByKey0", NULL, status);
+
+				LocalFree (new_dacl);
+			}
 		}
 	}
+	else
+	{
+		//if (status != FWP_E_CALLOUT_NOT_FOUND)
+		_r_log (LOG_LEVEL_ERROR, NULL, L"FwpmCalloutGetSecurityInfoByKey0", NULL, status);
+	}
 
 	if (security_descriptor)
 		FwpmFreeMemory0 ((PVOID_PTR)&security_descriptor);
@@ -578,58 +423,38 @@ VOID _app_setfiltersecurity (
 	_In_ LPCGUID filter_guid,
 	_In_ BOOLEAN is_secure,
 	_In_ LPCWSTR file_name,
-	_In_ UINT line
+	_In_ ULONG line
 )
 {
 	PSECURITY_DESCRIPTOR security_descriptor;
-	PSID sid_owner;
-	PSID sid_group;
-	PACL dacl;
-	PACL sacl;
-	PACL new_dacl;
+	PSID sid_group, sid_owner;
+	PACL dacl, sacl, new_dacl;
 	ULONG status;
 
-	status = FwpmFilterGetSecurityInfoByKey0 (
-		hengine,
-		filter_guid,
-		DACL_SECURITY_INFORMATION,
-		&sid_owner,
-		&sid_group,
-		&dacl,
-		&sacl,
-		&security_descriptor
-	);
+	status = FwpmFilterGetSecurityInfoByKey0 (hengine, filter_guid, DACL_SECURITY_INFORMATION, &sid_owner, &sid_group, &dacl, &sacl, &security_descriptor);
 
-	if (status != ERROR_SUCCESS)
+	if (status == ERROR_SUCCESS)
 	{
-		// FWP_E_FILTER_NOT_FOUND
-		_r_log_v (LOG_LEVEL_ERROR, NULL, L"FwpmFilterGetSecurityInfoByKey0", status, L"%s:%" TEXT (PRIu32), DBG_ARG_VAR);
-
-		return;
-	}
-
-	if (dacl)
-	{
-		new_dacl = _app_createaccesscontrollist (dacl, is_secure);
-
-		if (new_dacl)
+		if (dacl)
 		{
-			status = FwpmFilterSetSecurityInfoByKey0 (
-				hengine,
-				filter_guid,
-				OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
-				(const PSID)config.builtin_admins_sid,
-				NULL,
-				new_dacl,
-				NULL
-			);
+			new_dacl = _app_createaccesscontrollist (dacl, is_secure);
 
-			if (status != ERROR_SUCCESS)
-				_r_log_v (LOG_LEVEL_ERROR, NULL, L"FwpmFilterSetSecurityInfoByKey0", status, L"#%" TEXT (PRIu32), line);
+			if (new_dacl)
+			{
+				status = FwpmFilterSetSecurityInfoByKey0 (hengine, filter_guid, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, (PCSID)config.builtin_admins_sid, NULL, new_dacl, NULL);
 
-			LocalFree (new_dacl);
+				if (status != ERROR_SUCCESS)
+					_r_log_v (LOG_LEVEL_ERROR, NULL, L"FwpmFilterSetSecurityInfoByKey0", status, L"#%d", line);
+
+				LocalFree (new_dacl);
+			}
 		}
 	}
+	else
+	{
+		if (status != FWP_E_FILTER_NOT_FOUND)
+			_r_log_v (LOG_LEVEL_ERROR, NULL, L"FwpmFilterGetSecurityInfoByKey0", status, L"%s:%d", DBG_ARG_VAR);
+	}
 
 	if (security_descriptor)
 		FwpmFreeMemory0 ((PVOID_PTR)&security_descriptor);

src/security.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2020-2024 Henry++
+// Copyright (c) 2020-2026 Henry++
 
 #pragma once
 
@@ -18,9 +18,9 @@ PACL _app_createaccesscontrollist (
 
 VOID _app_setexplicitaccess (
 	_Out_ PEXPLICIT_ACCESS ea,
+	_In_ ULONG inheritance,
 	_In_ ACCESS_MODE mode,
 	_In_ ULONG rights,
-	_In_ ULONG inheritance,
 	_In_opt_ PSID sid
 );
 
@@ -51,5 +51,5 @@ VOID _app_setfiltersecurity (
 	_In_ LPCGUID filter_guid,
 	_In_ BOOLEAN is_secure,
 	_In_ LPCWSTR file_name,
-	_In_ UINT line
+	_In_ ULONG line
 );

src/timer.c

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #include "global.h"
 
@@ -10,7 +10,7 @@ BOOLEAN _app_istimersactive ()
 
 	_r_queuedlock_acquireshared (&lock_apps);
 
-	while (_r_obj_enumhashtablepointer (apps_table, &ptr_app, NULL, &enum_key))
+	while (_r_obj_enumhashtablepointer (apps_table, (PVOID_PTR)&ptr_app, NULL, &enum_key))
 	{
 		if (_app_istimerset (ptr_app))
 		{
@@ -41,53 +41,64 @@ VOID _app_timer_set (
 	_In_ LONG64 seconds
 )
 {
-	PTP_TIMER htimer;
+	LARGE_INTEGER timestamp;
 	FILETIME file_time;
-	LARGE_INTEGER li;
+	PTP_TIMER htimer;
 	LONG64 current_time;
 	BOOLEAN is_created = FALSE;
 	NTSTATUS status;
 
 	if (seconds <= 0)
 	{
-		_app_timer_reset (NULL, ptr_app);
+		_app_timer_reset (NULL, ptr_app, TRUE);
 	}
 	else
 	{
 		current_time = _r_unixtime_now ();
 
-		_r_unixtime_to_filetime (current_time + seconds, &file_time);
+		_r_unixtime_to_filetime (&file_time, current_time + seconds);
 
-		_r_calc_filetime2largeinteger (&file_time, &li);
+		_r_calc_filetime2largeinteger (&timestamp, &file_time);
 
 		if (ptr_app->htimer)
 		{
-			TpSetTimerEx (ptr_app->htimer, &li, 0, 0);
+			TpSetTimer (ptr_app->htimer, &timestamp, 0, 0);
 
 			is_created = TRUE;
 		}
 		else
 		{
-			status = TpAllocTimer (&htimer, &_app_timer_callback, (PVOID)ptr_app->app_hash, NULL);
+			status = TpAllocTimer (&htimer, &_app_timer_callback, ULongToPtr (ptr_app->app_hash), NULL);
 
 			if (NT_SUCCESS (status))
 			{
-				TpSetTimerEx (htimer, &li, 0, 0);
+				TpSetTimer (htimer, &timestamp, 0, 0);
 
 				ptr_app->htimer = htimer;
 
 				is_created = TRUE;
 			}
+			else
+			{
+				if (hwnd)
+				{
+					_r_show_errormessage (hwnd, L"Could not allocate timer!", NULL, status, ET_NATIVE);
+				}
+				else
+				{
+					_r_log (LOG_LEVEL_ERROR, NULL, L"TpAllocTimer", NULL, status);
+				}
+			}
 		}
 
 		if (is_created)
 		{
 			ptr_app->is_enabled = TRUE;
-			ptr_app->timer = current_time + seconds;
+			ptr_app->timer = (current_time + seconds);
 		}
 		else
 		{
-			_app_timer_reset (NULL, ptr_app);
+			_app_timer_reset (NULL, ptr_app, TRUE);
 		}
 	}
 
@@ -97,9 +108,13 @@ VOID _app_timer_set (
 
 VOID _app_timer_reset (
 	_In_opt_ HWND hwnd,
-	_Inout_ PITEM_APP ptr_app
+	_Inout_ PITEM_APP ptr_app,
+	_In_ BOOLEAN is_destroyfilters
 )
 {
+	if (is_destroyfilters && _wfp_isfiltersinstalled ())
+		_wfp_destroyfilters_array (_wfp_getenginehandle (), ptr_app->guids, DBG_ARG);
+
 	ptr_app->is_enabled = FALSE;
 	ptr_app->is_haveerrors = FALSE;
 
@@ -126,22 +141,20 @@ VOID _app_timer_remove (
 		TpReleaseTimer (current_timer);
 }
 
-VOID CALLBACK _app_timer_callback (
+VOID NTAPI _app_timer_callback (
 	_Inout_ PTP_CALLBACK_INSTANCE instance,
 	_Inout_opt_ PVOID context,
 	_Inout_ PTP_TIMER timer
 )
 {
-	HANDLE hengine;
-	HWND hwnd;
+	WCHAR buffer[0x100];
+	PR_STRING display_name;
 	PITEM_APP ptr_app;
-	PR_LIST rules;
-	PR_STRING string;
-	WCHAR buffer[256];
-	ULONG icon_id;
+	HWND hwnd;
+	ULONG icon_id = NIIF_INFO;
 	HRESULT status;
 
-	ptr_app = _app_getappitem ((ULONG_PTR)context);
+	ptr_app = _app_getappitem (PtrToUlong (context));
 
 	if (!ptr_app)
 		return;
@@ -150,50 +163,30 @@ VOID CALLBACK _app_timer_callback (
 
 	hwnd = _r_app_gethwnd ();
 
-	_app_timer_reset (hwnd, ptr_app);
+	_app_timer_reset (hwnd, ptr_app, TRUE);
 
-	hengine = _wfp_getenginehandle ();
-
-	if (hengine)
-	{
-		rules = _r_obj_createlist (NULL);
-
-		_r_obj_addlistitem (rules, ptr_app);
-
-		_wfp_create3filters (hengine, rules, DBG_ARG, FALSE);
-
-		_r_obj_dereference (rules);
-	}
-
-	_app_listview_updateby_id (hwnd, ptr_app->type, PR_UPDATE_TYPE | PR_UPDATE_FORCE);
-
-	_r_obj_dereference (ptr_app);
+	if (hwnd)
+		_app_listview_updateby_id (hwnd, ptr_app->type, PR_UPDATE_TYPE | PR_UPDATE_FORCE);
 
 	_app_profile_save (hwnd);
 
-	if (_r_config_getboolean (L"IsNotificationsTimer", TRUE))
+	if (_r_config_getboolean (L"IsNotificationsTimer", TRUE, NULL))
 	{
-		icon_id = NIIF_INFO;
-
-		if (!_r_config_getboolean (L"IsNotificationsSound", TRUE))
+		if (!_r_config_getboolean (L"IsNotificationsSound", TRUE, NULL))
 			icon_id |= NIIF_NOSOUND;
 
-		string = _app_getappdisplayname (ptr_app, TRUE);
+		display_name = _app_getappdisplayname (ptr_app, TRUE);
 
-		_r_str_printf (
-			buffer,
-			RTL_NUMBER_OF (buffer),
-			L"%s - %s",
-			_r_app_getname (),
-			_r_obj_getstringorempty (string)
-		);
+		_r_str_printf (buffer, RTL_NUMBER_OF (buffer), L"%s - %s", _r_app_getname (), _r_obj_getstringordefault (display_name, L"<noname>"));
 
 		_r_tray_popup (hwnd, &GUID_TrayIcon, icon_id, buffer, _r_locale_getstring (IDS_STATUS_TIMER_DONE));
 
-		if (string)
-			_r_obj_dereference (string);
+		if (display_name)
+			_r_obj_dereference (display_name);
 	}
 
 	if (status == S_OK || status == S_FALSE)
 		CoUninitialize ();
+
+	_r_obj_dereference (ptr_app);
 }

src/timer.h

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
@@ -17,14 +17,15 @@ VOID _app_timer_set (
 
 VOID _app_timer_reset (
 	_In_opt_ HWND hwnd,
-	_Inout_ PITEM_APP ptr_app
+	_Inout_ PITEM_APP ptr_app,
+	_In_ BOOLEAN is_destroyfilters
 );
 
 VOID _app_timer_remove (
 	_Inout_ PITEM_APP ptr_app
 );
 
-VOID CALLBACK _app_timer_callback (
+VOID NTAPI _app_timer_callback (
 	_Inout_ PTP_CALLBACK_INSTANCE instance,
 	_Inout_opt_ PVOID context,
 	_Inout_ PTP_TIMER timer

src/udpstats.c

@@ -0,0 +1,794 @@
+// simplewall
+// Copyright (c) 2026 Henry++
+// Copyright (c) 2026 Tarkiin
+// UDP events contain metadata only; no packet payload is captured or stored
+#include "global.h"
+
+FORCEINLINE static ULONG udp_bucket (
+	_In_ ULONG pid,
+	_In_ USHORT port
+)
+{
+	return (pid ^ port) % UDP_BUCKETS;
+}
+
+static VOID udp_initialize_properties (
+	_Out_ PUDP_TRACE_PROPERTIES buffer
+)
+{
+	RtlZeroMemory (buffer, sizeof (UDP_TRACE_PROPERTIES));
+
+	buffer->properties.Wnode.BufferSize = sizeof (UDP_TRACE_PROPERTIES);
+	buffer->properties.Wnode.Guid = udp_session;
+	buffer->properties.Wnode.ClientContext = 1; // QPC; ProcessTrace converts to FILETIME
+	buffer->properties.Wnode.Flags = WNODE_FLAG_TRACED_GUID;
+	buffer->properties.BufferSize = 64;
+	//buffer->properties.MinimumBuffers = 0; // already 0
+	buffer->properties.MaximumBuffers = 128;
+	buffer->properties.FlushTimer = 1;
+	buffer->properties.LogFileMode = EVENT_TRACE_REAL_TIME_MODE;
+	buffer->properties.LoggerNameOffset = FIELD_OFFSET (UDP_TRACE_PROPERTIES, name);
+}
+
+// select a bound socket, not a remote flow. UDP listeners may use wildcard addresses and IPv6 sockets may receive IPv4. never credit two rows for one event.
+static INT udp_match (
+	_In_ const PUDP_ENDPOINT endpoint,
+	_In_ ADDRESS_FAMILY af,
+	_In_ const PBYTE address
+)
+{
+	ULONG_PTR length;
+	const BYTE mapped[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF};
+	const BYTE zero[16] = {0};
+
+	if (endpoint->af == af)
+	{
+		length = (af == AF_INET) ? 4 : 16; // set correct sizes
+
+		if (RtlEqualMemory (endpoint->address, address, length))
+			return 3;
+
+		if (RtlEqualMemory (endpoint->address, zero, length))
+			return 2;
+	}
+	else if (af == AF_INET && endpoint->af == AF_INET6)
+	{
+		if (RtlEqualMemory (endpoint->address, mapped, 12) && !RtlEqualMemory (endpoint->address + 12, address, 4)) // set correct sizes
+			return 2;
+
+		if (RtlEqualMemory (endpoint->address, zero, 16)) // set correct sizes
+			return 1;
+	}
+
+	return 0;
+}
+
+static VOID udp_account (
+	_In_ PSW_UDP_STATS stats,
+	_In_ ULONG pid,
+	_In_ ULONG size,
+	_In_ USHORT port,
+	_In_ ADDRESS_FAMILY af,
+	_In_ const PBYTE address,
+	_In_ ULONG scope_id,
+	_In_ BOOLEAN is_receive,
+	_In_ ULONG64 timestamp,
+	_In_ ULONG error_code
+)
+{
+	UDP_ENTRY *best = NULL, *entry;
+	INT candidate, score = 0;
+	BOOLEAN is_ambiguous = FALSE;
+
+	AcquireSRWLockExclusive (&stats->lock);
+
+	for (entry = stats->buckets[udp_bucket (pid, port)]; entry; entry = entry->next)
+	{
+		if (entry->endpoint.pid != pid || entry->endpoint.port != port)
+			continue;
+
+		if (af == AF_INET6 && scope_id != MAXDWORD && entry->endpoint.scope_id != scope_id)
+			continue;
+
+		candidate = udp_match (&entry->endpoint, af, address);
+
+		if (candidate > score)
+		{
+			best = entry;
+			score = candidate;
+			is_ambiguous = FALSE;
+		}
+		else if (candidate && candidate == score)
+		{
+			is_ambiguous = TRUE;
+		}
+	}
+
+	if (best && !is_ambiguous && timestamp >= best->since)
+	{
+		if (error_code != ERROR_SUCCESS)
+			best->error_code = error_code;
+
+		best->is_observed = TRUE;
+
+		if (is_receive)
+		{
+			best->received += size;
+		}
+		else
+		{
+			best->sent += size;
+		}
+	}
+	else if (is_ambiguous)
+	{
+		// never silently attribute an event to one of several equally good rows
+		for (entry = stats->buckets[udp_bucket (pid, port)]; entry; entry = entry->next)
+		{
+			if (entry->endpoint.pid == pid && entry->endpoint.port == port && udp_match (&entry->endpoint, af, address) == score)
+				entry->error_code = ERROR_INVALID_DATA;
+		}
+	}
+
+	ReleaseSRWLockExclusive (&stats->lock);
+}
+
+static ULONG udp_u32 (
+	_In_ const PBYTE data
+)
+{
+	ULONG value;
+
+	RtlCopyMemory (&value, data, sizeof (ULONG));
+
+	return value;
+}
+
+static VOID udp_afd_event (
+	_In_ PSW_UDP_STATS stats,
+	_In_ PEVENT_RECORD event
+)
+{
+	UDP_AFD_SOCKET **link, *socket;
+	ULONG64 handle = 0;
+	ULONG pointer_size = (event->EventHeader.Flags & EVENT_HEADER_FLAG_32_BIT_HEADER) ? sizeof (ULONG) : sizeof (ULONG64), prefix = 8 + 2 * pointer_size, length, size_offset;
+	USHORT af, port, id = event->EventHeader.EventDescriptor.Id;
+	const PBYTE data = (const PBYTE)(event->UserData);
+	BOOLEAN is_receive = id == 1004 || id == 1006 || id == 1009 || id == 1012 || id == 1015;
+	BOOLEAN is_transfer = is_receive || id == 1003 || id == 1005 || id == 1007 || id == 1011 || id == 1013;
+
+	// RIO uses a different completion path. mark just that socket unavailable.
+	if (id == 4006)
+	{
+		if (event->EventHeader.EventDescriptor.Version != 0 || !data || event->UserDataLength < pointer_size)
+			goto unsupported;
+
+		RtlCopyMemory (&handle, data, pointer_size);
+
+		for (socket = stats->sockets[(handle >> 4) % UDP_BUCKETS]; socket; socket = socket->next)
+		{
+			if (socket->handle == handle)
+			{
+				socket->is_unsupported = TRUE;
+
+				if (socket->is_bound)
+				{
+					udp_account (
+						stats,
+						socket->endpoint.pid,
+						0,
+						socket->endpoint.port,
+						socket->endpoint.af,
+						socket->endpoint.address,
+						socket->endpoint.scope_id,
+						FALSE,
+						event->EventHeader.TimeStamp.QuadPart,
+						ERROR_NOT_SUPPORTED
+					);
+				}
+
+				break;
+			}
+		}
+
+		return;
+	}
+
+	if (id != 1000 && id != 1001 && id != 1002 && id != 1030 && !is_transfer)
+		return;
+
+	if (event->EventHeader.EventDescriptor.Version != 0 || !data || event->UserDataLength < prefix)
+		goto unsupported;
+
+	RtlCopyMemory (&handle, data + 8 + pointer_size, pointer_size);
+
+	link = &stats->sockets[(handle >> 4) % UDP_BUCKETS];
+
+	while (*link && (*link)->handle != handle)
+	{
+		link = &(*link)->next;
+	}
+
+	socket = *link;
+
+	if ((id == 1001 || id == 1002) && udp_u32 (data) == 0)
+	{
+		if (socket)
+		{
+			*link = socket->next;
+
+			stats->socket_count -= 1;
+
+			_r_mem_free (socket);
+		}
+
+		return;
+	}
+
+	if (id == 1000 && udp_u32 (data) == 0)
+	{
+		if (event->UserDataLength < prefix + 12 + pointer_size + 4)
+			goto unsupported;
+
+		// kernel endpoint addresses are reused, including by TCP sockets
+		if (socket)
+		{
+			*link = socket->next;
+
+			stats->socket_count -= 1;
+
+			_r_mem_free (socket);
+
+			socket = NULL;
+		}
+
+		if (udp_u32 (data + prefix + 4) != SOCK_DGRAM || udp_u32 (data + prefix + 8) != IPPROTO_UDP)
+			return;
+
+		if (!socket)
+		{
+			if (stats->socket_count >= UDP_MAX_ENDPOINTS)
+			{
+				_InterlockedExchange (&stats->error_code, ERROR_NOT_ENOUGH_MEMORY);
+
+				return;
+			}
+
+			socket = (UDP_AFD_SOCKET *)_r_mem_allocatesafe (sizeof (UDP_AFD_SOCKET));
+
+			if (!socket)
+			{
+				_InterlockedExchange (&stats->error_code, ERROR_NOT_ENOUGH_MEMORY);
+
+				return;
+			}
+
+			socket->next = *link;
+
+			*link = socket;
+
+			stats->socket_count += 1;
+		}
+
+		socket->handle = handle;
+		socket->is_bound = FALSE;
+
+		RtlZeroMemory (&socket->endpoint, sizeof (UDP_ENDPOINT));
+
+		socket->endpoint.pid = udp_u32 (data + prefix + 12);
+
+		return;
+	}
+
+	if (!socket || udp_u32 (data) != 1)
+		return;
+
+	if (id == 1030)
+	{
+		if (event->UserDataLength < prefix + 8)
+			goto unsupported;
+
+		if (udp_u32 (data + prefix) != ERROR_SUCCESS)
+			return;
+
+		length = udp_u32 (data + prefix + 4);
+
+		if (length > event->UserDataLength - prefix - 8 || length < 4)
+			goto unsupported;
+
+		RtlCopyMemory (&af, data + prefix + 8, 2);
+		RtlCopyMemory (&port, data + prefix + 10, 2);
+
+		if ((af != AF_INET && af != AF_INET6) || length < (af == AF_INET ? 16U : 28U))
+			goto unsupported;
+
+		socket->endpoint.af = af;
+		socket->endpoint.port = (USHORT)((port >> 8) | (port << 8));
+
+		RtlCopyMemory (socket->endpoint.address, data + prefix + (af == AF_INET ? 12 : 16), af == AF_INET ? 4 : 16);
+
+		socket->endpoint.scope_id = (af == AF_INET6) ? udp_u32 (data + prefix + 32) : 0;
+		socket->is_bound = socket->endpoint.port != 0;
+
+		if (socket->is_bound && socket->is_unsupported)
+		{
+			udp_account (
+				stats,
+				socket->endpoint.pid,
+				0,
+				socket->endpoint.port,
+				af,
+				socket->endpoint.address,
+				socket->endpoint.scope_id,
+				FALSE,
+				event->EventHeader.TimeStamp.QuadPart,
+				ERROR_NOT_SUPPORTED
+			);
+		}
+
+		return;
+	}
+
+	if (is_transfer && socket->is_bound)
+	{
+		size_offset = prefix + 4 + pointer_size;
+
+		if (event->UserDataLength < size_offset + 8)
+			goto unsupported;
+
+		if (udp_u32 (data + size_offset + 4) != ERROR_SUCCESS)
+			return;
+
+		udp_account (
+			stats,
+			socket->endpoint.pid,
+			udp_u32 (data + size_offset),
+			socket->endpoint.port,
+			socket->endpoint.af,
+			socket->endpoint.address,
+			socket->endpoint.scope_id,
+			is_receive,
+			event->EventHeader.TimeStamp.QuadPart,
+			socket->is_unsupported ? ERROR_NOT_SUPPORTED : ERROR_SUCCESS
+		);
+	}
+
+	return;
+
+unsupported:
+
+	_InterlockedExchange (&stats->error_code, ERROR_NOT_SUPPORTED);
+}
+
+static VOID WINAPI udp_event (
+	_In_ PEVENT_RECORD event
+)
+{
+	PSW_UDP_STATS stats = event->UserContext;
+#if defined(UDP_STATS_DIAGNOSTIC)
+	UDP_STATS_DIAGNOSTIC (event);
+#endif // UDP_STATS_DIAGNOSTIC
+
+	if (_InterlockedCompareExchange (&stats->stopping, 0, 0))
+		return;
+
+	if (IsEqualGUID (&event->EventHeader.ProviderId, &afd_provider))
+		udp_afd_event (stats, event);
+}
+
+static ULONG WINAPI udp_buffer (
+	_In_ PEVENT_TRACE_LOGFILEW buffer
+)
+{
+	PSW_UDP_STATS stats = (PSW_UDP_STATS)buffer->Context;
+
+	if (buffer->EventsLost)
+		_InterlockedExchange (&stats->error_code, ERROR_DATA_NOT_ACCEPTED);
+
+	return !_InterlockedCompareExchange (&stats->stopping, 0, 0);
+}
+
+static VOID NTAPI udp_thread (
+	_In_ PVOID context
+)
+{
+	PSW_UDP_STATS stats = (PSW_UDP_STATS)context;
+	ULONG result;
+
+	result = ProcessTrace (&stats->hconsumer, 1, NULL, NULL);
+
+	if (!_InterlockedCompareExchange (&stats->stopping, 0, 0))
+		_InterlockedExchange (&stats->error_code, result ? result : ERROR_OPERATION_ABORTED);
+}
+
+_Ret_maybenull_
+PSW_UDP_STATS udp_stats_create ()
+{
+	PSW_UDP_STATS stats;
+
+	stats = (PSW_UDP_STATS)_r_mem_allocatesafe (sizeof (SW_UDP_STATS));
+
+	if (stats)
+	{
+		stats->hconsumer = INVALID_PROCESSTRACE_HANDLE;
+		stats->error_code = ERROR_NOT_READY;
+	}
+
+	return stats;
+}
+
+NTSTATUS udp_stats_start (
+	_Inout_opt_ PSW_UDP_STATS stats
+)
+{
+	EVENT_TRACE_LOGFILEW logfile = {0};
+	UDP_TRACE_PROPERTIES properties;
+	OBJECT_ATTRIBUTES oa = {0};
+	R_ENVIRONMENT environment;
+	UNICODE_STRING us;
+	WCHAR buffer[0x80];
+	TRACEHANDLE hsession = 0;
+	NTSTATUS status;
+
+	if (!stats)
+		return STATUS_MEMORY_NOT_ALLOCATED;
+
+	if (stats->hguard || _InterlockedCompareExchange (&stats->stopping, 0, 0))
+		return STATUS_ALREADY_INITIALIZED;
+
+	// a global semaphore distinguishes an orphan left by a crash from an active simplewall instance. never stop another tracing application's session.
+	_r_str_printf (buffer, RTL_NUMBER_OF (buffer), L"\\Sessions\\%u\\BaseNamedObjects\\%s", NtCurrentPeb ()->SessionId, UDP_SESSION_SEMAPHORE);
+
+	_r_obj_initializeunicodestring (&us, buffer);
+
+	InitializeObjectAttributes (&oa, &us, OBJ_CASE_INSENSITIVE | OBJ_OPENIF, NULL, NULL);
+
+	status = NtCreateSemaphore (&stats->hguard, SEMAPHORE_ALL_ACCESS, &oa, 1, 1);
+
+	if (NT_SUCCESS (status) || status == STATUS_OBJECT_NAME_COLLISION)
+	{
+		status = _r_sys_waitforsingleobject (stats->hguard, 0);
+
+		stats->is_owns_guard = (status == STATUS_WAIT_0);
+
+		status = stats->is_owns_guard ? STATUS_SUCCESS : STATUS_ALREADY_INITIALIZED;
+	}
+	else
+	{
+		stats->hguard = NULL;
+
+		goto fail;
+	}
+
+	udp_initialize_properties (&properties);
+
+	status = StartTraceW (&hsession, UDP_SESSION_NAME, &properties.properties);
+
+	if (status == ERROR_ALREADY_EXISTS)
+	{
+		udp_initialize_properties (&properties);
+
+		status = ControlTraceW (0, UDP_SESSION_NAME, &properties.properties, EVENT_TRACE_CONTROL_QUERY);
+
+		if (status == ERROR_SUCCESS && IsEqualGUID (&properties.properties.Wnode.Guid, &udp_session))
+		{
+			status = ControlTraceW (0, UDP_SESSION_NAME, &properties.properties, EVENT_TRACE_CONTROL_STOP);
+
+			if (status == ERROR_SUCCESS)
+			{
+				udp_initialize_properties (&properties);
+
+				status = StartTraceW (&hsession, UDP_SESSION_NAME, &properties.properties);
+			}
+		}
+		else if (status == ERROR_SUCCESS)
+		{
+			status = STATUS_ALREADY_INITIALIZED;
+		}
+	}
+
+	if (status != STATUS_SUCCESS)
+		goto fail;
+
+	stats->hsession = hsession;
+
+	// DATAGRAM plus RIO lifecycle metadata; no verbose packet-buffer events
+	status = EnableTraceEx2 (hsession, &afd_provider, EVENT_CONTROL_CODE_ENABLE_PROVIDER, TRACE_LEVEL_INFORMATION, 0x41, 0, 0, NULL);
+
+	if (status != STATUS_SUCCESS)
+	{
+		status = _r_sys_doserrortontstatus (status);
+
+		goto fail;
+	}
+
+	logfile.ProcessTraceMode = PROCESS_TRACE_MODE_REAL_TIME | PROCESS_TRACE_MODE_EVENT_RECORD;
+	logfile.LoggerName = UDP_SESSION_NAME;
+	logfile.EventRecordCallback = &udp_event;
+	logfile.BufferCallback = &udp_buffer;
+	logfile.Context = stats;
+
+	stats->hconsumer = OpenTraceW (&logfile);
+
+	if (stats->hconsumer == INVALID_PROCESSTRACE_HANDLE)
+	{
+		status = _r_sys_doserrortontstatus (NtLastError ());
+
+		goto fail;
+	}
+
+	_InterlockedExchange (&stats->error_code, STATUS_SUCCESS);
+
+	_r_sys_setenvironment (&environment, THREAD_PRIORITY_ABOVE_NORMAL, IoPriorityHigh, MEMORY_PRIORITY_NORMAL);
+
+	status = _r_sys_createthread (&stats->hthread, NtCurrentProcess (), &udp_thread, stats, &environment, L"UdpMonitoring");
+
+	if (!NT_SUCCESS (status))
+		goto fail;
+
+	NtResumeThread (stats->hthread, NULL);
+
+	return STATUS_SUCCESS;
+
+fail:
+
+	udp_stats_stop (stats);
+
+	_InterlockedExchange (&stats->error_code, status);
+
+	return status;
+}
+
+VOID udp_stats_stop (
+	_In_opt_ PSW_UDP_STATS stats
+)
+{
+	UDP_TRACE_PROPERTIES properties;
+
+	if (!stats)
+		return;
+
+	AcquireSRWLockExclusive (&stats->control_lock);
+
+	_InterlockedExchange (&stats->error_code, ERROR_OPERATION_ABORTED);
+	_InterlockedExchange (&stats->stopping, TRUE);
+
+	if (stats->hsession)
+	{
+		udp_initialize_properties (&properties);
+
+		ControlTraceW (stats->hsession, NULL, &properties.properties, EVENT_TRACE_CONTROL_STOP);
+
+		stats->hsession = 0;
+	}
+
+	if (stats->hconsumer != INVALID_PROCESSTRACE_HANDLE)
+		CloseTrace (stats->hconsumer);
+
+	if (stats->hthread)
+	{
+		_r_sys_waitforsingleobject (stats->hthread, INFINITE);
+
+		NtClose (stats->hthread);
+
+		stats->hthread = NULL;
+	}
+
+	stats->hconsumer = INVALID_PROCESSTRACE_HANDLE;
+
+	if (stats->hguard)
+	{
+		if (stats->is_owns_guard)
+			NtReleaseSemaphore (stats->hguard, 1, NULL);
+
+		NtClose (stats->hguard);
+		stats->hguard = NULL;
+
+		stats->is_owns_guard = FALSE;
+	}
+
+	ReleaseSRWLockExclusive (&stats->control_lock);
+}
+
+VOID udp_stats_destroy (
+	_In_opt_ PSW_UDP_STATS stats
+)
+{
+	UDP_AFD_SOCKET *next, *socket;
+	UDP_ENTRY *entry, *next_entry;
+
+	if (!stats)
+		return;
+
+	udp_stats_stop (stats);
+
+	for (ULONG i = 0; i < UDP_BUCKETS; i++)
+	{
+		socket = stats->sockets[i];
+
+		while (socket)
+		{
+			next = socket->next;
+
+			_r_mem_free (socket);
+
+			socket = next;
+		}
+
+		entry = stats->buckets[i];
+
+		while (entry)
+		{
+			next_entry = entry->next;
+
+			_r_mem_free (entry);
+
+			entry = next_entry;
+		}
+	}
+
+	_r_mem_free (stats);
+}
+
+ULONG udp_stats_poll (
+	_In_opt_ PSW_UDP_STATS stats
+)
+{
+	UDP_TRACE_PROPERTIES properties;
+	ULONG status;
+
+	if (!stats)
+		return ERROR_NOT_READY;
+
+	AcquireSRWLockExclusive (&stats->control_lock);
+
+	status = _InterlockedCompareExchange (&stats->error_code, 0, 0);
+
+	if (status == ERROR_SUCCESS && stats->hsession)
+	{
+		udp_initialize_properties (&properties);
+
+		status = ControlTraceW (stats->hsession, NULL, &properties.properties, EVENT_TRACE_CONTROL_QUERY);
+
+		if (status == ERROR_SUCCESS && (properties.properties.EventsLost || properties.properties.RealTimeBuffersLost || properties.properties.LogBuffersLost))
+			status = ERROR_DATA_NOT_ACCEPTED;
+
+		if (status != ERROR_SUCCESS)
+			_InterlockedExchange (&stats->error_code, status);
+	}
+
+	ReleaseSRWLockExclusive (&stats->control_lock);
+
+	return status;
+}
+
+VOID udp_stats_begin_refresh (
+	_Inout_opt_ PSW_UDP_STATS stats
+)
+{
+	if (!stats)
+		return;
+
+	AcquireSRWLockExclusive (&stats->lock);
+	stats->epoch += 1;
+	ReleaseSRWLockExclusive (&stats->lock);
+}
+
+VOID udp_stats_read (
+	_Inout_ PSW_UDP_STATS stats,
+	_In_ PUDP_ENDPOINT endpoint,
+	_Out_ PUDP_SNAPSHOT snapshot
+)
+{
+	LARGE_INTEGER li;
+	UDP_ENTRY *entry;
+	ULONG bucket;
+
+	RtlZeroMemory (snapshot, sizeof (UDP_SNAPSHOT));
+
+	snapshot->error_code = stats ? _InterlockedCompareExchange (&stats->error_code, 0, 0) : ERROR_NOT_READY;
+
+	if (snapshot->error_code != ERROR_SUCCESS)
+		return;
+
+	bucket = udp_bucket (endpoint->pid, endpoint->port);
+
+	AcquireSRWLockExclusive (&stats->lock);
+
+	for (entry = stats->buckets[bucket]; entry; entry = entry->next)
+	{
+		if (entry->endpoint.pid == endpoint->pid && entry->endpoint.port == endpoint->port && entry->endpoint.af == endpoint->af &&
+			entry->endpoint.scope_id == endpoint->scope_id && RtlEqualMemory (entry->endpoint.address, endpoint->address, endpoint->af == AF_INET ? 4 : 16))
+		{
+			break;
+		}
+	}
+
+	if (!entry)
+	{
+		if (stats->count < UDP_MAX_ENDPOINTS)
+			entry = (PUDP_ENTRY)_r_mem_allocatesafe (sizeof (UDP_ENTRY));
+
+		if (!entry)
+		{
+			snapshot->error_code = ERROR_NOT_ENOUGH_MEMORY;
+
+			ReleaseSRWLockExclusive (&stats->lock);
+
+			return;
+		}
+
+		entry->next = stats->buckets[bucket];
+		stats->buckets[bucket] = entry;
+		stats->count += 1;
+	}
+
+	if (!entry->since || entry->endpoint.created != endpoint->created)
+	{
+		entry->endpoint = *endpoint;
+		entry->since = _r_sys_gettimestamp (&li)->QuadPart;
+
+		if (endpoint->created > entry->since)
+			entry->since = endpoint->created;
+
+		entry->received = entry->sent = 0;
+		entry->error_code = ERROR_SUCCESS;
+		entry->is_observed = FALSE;
+	}
+
+	snapshot->error_code = entry->error_code ? entry->error_code : (entry->is_observed ? ERROR_SUCCESS : ERROR_NOT_READY);
+	snapshot->received = entry->received;
+	snapshot->sent = entry->sent;
+	entry->epoch = stats->epoch;
+
+	ReleaseSRWLockExclusive (&stats->lock);
+}
+
+VOID udp_stats_end_refresh (
+	_In_opt_ SW_UDP_STATS *stats,
+	_In_ BOOLEAN ipv4_complete,
+	_In_ BOOLEAN ipv6_complete
+)
+{
+	UDP_ENTRY *entry, *next, *previous;
+
+	if (!stats)
+		return;
+
+	AcquireSRWLockExclusive (&stats->lock);
+
+	for (ULONG i = 0; i < UDP_BUCKETS; i++)
+	{
+		entry = stats->buckets[i];
+		previous = NULL;
+
+		while (entry)
+		{
+			next = entry->next;
+
+			if (entry->epoch != stats->epoch && (entry->endpoint.af == AF_INET ? ipv4_complete : ipv6_complete))
+			{
+				if (previous)
+				{
+					previous->next = next;
+				}
+				else
+				{
+					stats->buckets[i] = next;
+				}
+
+				_r_mem_free (entry);
+
+				stats->count -= 1;
+			}
+			else
+			{
+				previous = entry;
+			}
+
+			entry = next;
+		}
+	}
+
+	ReleaseSRWLockExclusive (&stats->lock);
+}

src/udpstats.h

@@ -0,0 +1,45 @@
+// simplewall
+// Copyright (c) 2026 Henry++
+// Copyright (c) 2026 Tarkiin
+// UDP events contain metadata only; no packet payload is captured or stored
+#pragma once
+
+#include "global.h"
+
+static const GUID afd_provider = {0xE53C6823, 0x7BB8, 0x44BB, {0x90, 0xDC, 0x3F, 0x86, 0x09, 0x0D, 0x48, 0xA6}};
+static const GUID udp_session = {0x4BFA58D6, 0x5D5D, 0x46F2, {0x93, 0x93, 0xC9, 0xE0, 0x5E, 0x27, 0xB4, 0x71}};
+
+_Ret_maybenull_
+PSW_UDP_STATS udp_stats_create ();
+
+NTSTATUS udp_stats_start (
+	_Inout_opt_ PSW_UDP_STATS stats
+);
+
+VOID udp_stats_stop (
+	_In_opt_ PSW_UDP_STATS stats
+);
+
+VOID udp_stats_destroy (
+	_In_opt_ PSW_UDP_STATS stats
+);
+
+ULONG udp_stats_poll (
+	_In_opt_ PSW_UDP_STATS stats
+);
+
+VOID udp_stats_begin_refresh (
+	_Inout_opt_ PSW_UDP_STATS stats
+);
+
+VOID udp_stats_read (
+	_Inout_ PSW_UDP_STATS stats,
+	_In_ PUDP_ENDPOINT endpoint,
+	_Out_ PUDP_SNAPSHOT snapshot
+);
+
+VOID udp_stats_end_refresh (
+	_In_opt_ SW_UDP_STATS *stats,
+	_In_ BOOLEAN ipv4_complete,
+	_In_ BOOLEAN ipv6_complete
+);

src/uwp.cpp

@@ -1,5 +1,5 @@
 // simplewall
-// Copyright (c) 2022-2024 Henry++
+// Copyright (c) 2022-2026 Henry++
 
 #include "routine.h"
 
@@ -15,14 +15,13 @@
 _Success_ (return)
 BOOLEAN _app_uwp_loadpackageinfo (
 	_In_ PR_STRING package_name,
-	_Inout_ PR_STRING_PTR name_ptr,
-	_Inout_ PR_STRING_PTR path_ptr
+	_Inout_ PR_STRING_PTR out_name,
+	_Inout_ PR_STRING_PTR out_path
 )
 {
+	winrt::Windows::ApplicationModel::PackageStatus package_status = 0;
 	winrt::Windows::ApplicationModel::Package package = NULL;
-	winrt::Windows::ApplicationModel::PackageStatus status = 0;
-	winrt::hstring display_name;
-	winrt::hstring path;
+	winrt::hstring display_name, path;
 
 	package = winrt::Windows::Management::Deployment::PackageManager{}.FindPackage (package_name->buffer);
 
@@ -31,9 +30,9 @@ BOOLEAN _app_uwp_loadpackageinfo (
 
 	if (_r_sys_isosversiongreaterorequal (WINDOWS_10))
 	{
-		status = package.Status ();
+		package_status = package.Status ();
 
-		if (status.Disabled () || status.NotAvailable ())
+		if (package_status.Disabled () || package_status.NotAvailable ())
 			return FALSE;
 	}
 
@@ -45,18 +44,18 @@ BOOLEAN _app_uwp_loadpackageinfo (
 
 	if (display_name.empty ())
 	{
-		*name_ptr = _r_obj_createstring2 (package_name);
+		*out_name = _r_obj_createstring2 (&package_name->sr);
 	}
 	else
 	{
-		if (display_name == L"1527c705-839a-4832-9118-54d4Bd6a0c89")
+		if (_r_str_compare (display_name.c_str (), L"1527C705-839A-4832-9118-54D4BD6A0C89", TRUE) == 0)
 			display_name = L"File Picker"; // HACK!!!
 
-		*name_ptr = _r_obj_createstring_ex (display_name.c_str (), display_name.size () * sizeof (WCHAR));
+		*out_name = _r_obj_createstring_ex (display_name.c_str (), display_name.size () * sizeof (WCHAR));
 	}
 
 	if (!path.empty ())
-		*path_ptr = _r_obj_createstring_ex (path.c_str (), path.size () * sizeof (WCHAR));
+		*out_path = _r_obj_createstring_ex (path.c_str (), path.size () * sizeof (WCHAR));
 
 	return TRUE;
 }
@@ -64,25 +63,21 @@ BOOLEAN _app_uwp_loadpackageinfo (
 _Success_ (return)
 BOOLEAN _app_uwp_getpackageinfo (
 	_In_ PR_STRING package_name,
-	_Out_ PR_STRING_PTR name_ptr,
-	_Out_ PR_STRING_PTR path_ptr
+	_Out_ PR_STRING_PTR out_name,
+	_Out_ PR_STRING_PTR out_path
 )
 {
-	BOOLEAN status;
-
-	*name_ptr = NULL;
-	*path_ptr = NULL;
+	*out_name = NULL;
+	*out_path = NULL;
 
 	__try
 	{
-		status = _app_uwp_loadpackageinfo (package_name, name_ptr, path_ptr);
+		return _app_uwp_loadpackageinfo (package_name, out_name, out_path);
 	}
 	__except (EXCEPTION_EXECUTE_HANDLER)
 	{
-		*name_ptr = _r_obj_createstring2 (package_name);
+		*out_name = _r_obj_createstring2 (&package_name->sr);
 
 		return TRUE;
 	}
-
-	return status;
 }

src/uwp.h

@@ -1,27 +1,22 @@
 // simplewall
-// Copyright (c) 2022-2024 Henry++
+// Copyright (c) 2022-2026 Henry++
 
 #pragma once
 
-#ifdef __cplusplus
-extern "C"
-{
-#endif
+EXTERN_C_START
 
 _Success_ (return)
 BOOLEAN _app_uwp_loadpackageinfo (
 	_In_ PR_STRING package_name,
-	_Inout_ PR_STRING_PTR name_ptr,
-	_Inout_ PR_STRING_PTR path_ptr
+	_Inout_ PR_STRING_PTR out_name,
+	_Inout_ PR_STRING_PTR out_path
 );
 
 _Success_ (return)
 BOOLEAN _app_uwp_getpackageinfo (
 	_In_ PR_STRING package_name,
-	_Out_ PR_STRING_PTR name_ptr,
-	_Out_ PR_STRING_PTR path_ptr
+	_Out_ PR_STRING_PTR out_name,
+	_Out_ PR_STRING_PTR out_path
 );
 
-#ifdef __cplusplus
-}
-#endif
+EXTERN_C_END

src/wfp.h

@@ -1,32 +1,36 @@
 // simplewall
-// Copyright (c) 2016-2024 Henry++
+// Copyright (c) 2016-2026 Henry++
 
 #pragma once
 
 // guids
-DEFINE_GUID (GUID_WfpProvider, 0xb0d553e2, 0xc6a0, 0x4a9a, 0xae, 0xb8, 0xc7, 0x52, 0x48, 0x3e, 0xd6, 0x2f);
-DEFINE_GUID (GUID_WfpSublayer, 0x9fee6f59, 0xb951, 0x4f9a, 0xb5, 0x2f, 0x13, 0x3d, 0xcf, 0x7a, 0x42, 0x79);
+DEFINE_GUID (GUID_WfpProvider, 0xB0D553E2, 0xC6A0, 0x4A9A, 0xAE, 0xB8, 0xC7, 0x52, 0x48, 0x3E, 0xD6, 0x2F);
+DEFINE_GUID (GUID_WfpSublayer, 0x9FEE6F59, 0xB951, 0x4F9A, 0xB5, 0x2F, 0x13, 0x3D, 0xCF, 0x7A, 0x42, 0x79);
 
 // filter names
-#define FW_NAME_BLOCK_CONNECTION L"BlockConnection"
-#define FW_NAME_BLOCK_RECVACCEPT L"BlockRecvAccept"
-#define FW_NAME_ICMP_ERROR L"BlockIcmpError"
-#define FW_NAME_TCP_RST_ONCLOSE L"BlockTcpRstOnClose"
-#define FW_NAME_BOOTTIME L"BlockBoottime"
-#define FW_NAME_LOOPBACK L"AllowLoopback"
+#define FWN_BLOCK_CONNECTION L"BlockConnection"
+#define FWN_BLOCK_RECVACCEPT L"BlockRecvAccept"
+#define FWN_ICMP_ERROR L"BlockIcmpError"
+#define FWN_TCP_RST_ONCLOSE L"BlockTcpRstOnClose"
+#define FWN_BOOTTIME L"BlockBoottime"
+#define FWN_LOOPBACK L"AllowLoopback"
 
 // sublayer weight
-#define FW_SUBLAYER_WEIGHT 0xFFFF
+#define FWW_SUBLAYER 0xFFFF // highest weight for UINT16
 
 // filter weights
-#define FW_WEIGHT_HIGHEST_IMPORTANT 0x0F
-#define FW_WEIGHT_HIGHEST 0x0E
-#define FW_WEIGHT_RULE_BLOCKLIST 0x0D
-#define FW_WEIGHT_RULE_USER_BLOCK 0x0C
-#define FW_WEIGHT_RULE_USER 0x0B
-#define FW_WEIGHT_RULE_SYSTEM 0x0A
-#define FW_WEIGHT_APP 0x09
-#define FW_WEIGHT_LOWEST 0x08
+#define FWW_IMPORTANT 0x0F
+#define FWW_HIGHEST 0x0E
+#define FWW_RULE_BLOCKLIST 0x0D
+#define FWW_RULE_USER_BLOCK 0x0C
+#define FWW_RULE_USER 0x0B
+#define FWW_RULE_SYSTEM 0x0A
+#define FWW_APP 0x09
+#define FWW_LOWEST 0x08
+
+HANDLE _wfp_getenginehandle ();
+
+BOOLEAN _wfp_isfiltersapplying ();
 
 ENUM_INSTALL_TYPE _wfp_isproviderinstalled (
 	_In_ HANDLE engine_handle
@@ -36,16 +40,13 @@ ENUM_INSTALL_TYPE _wfp_issublayerinstalled (
 	_In_ HANDLE engine_handle
 );
 
-BOOLEAN _wfp_isfiltersapplying ();
-
 BOOLEAN _wfp_isfiltersinstalled ();
 
-HANDLE _wfp_getenginehandle ();
-
 ENUM_INSTALL_TYPE _wfp_getinstalltype ();
 
+_Ret_maybenull_
 PR_STRING _wfp_getlayername (
-	_In_ LPGUID layer_guid
+	_In_ LPCGUID layer_guid
 );
 
 BOOLEAN _wfp_initialize (
@@ -74,22 +75,18 @@ BOOLEAN _wfp_transact_commit (
 	_In_ ULONG line
 );
 
-ULONG _wfp_createcallout (
-	_In_ HANDLE engine_handle,
-	_In_ LPCGUID layer_key,
-	_In_ LPCGUID callout_key
-);
-
 BOOLEAN _wfp_deletefilter (
 	_In_ HANDLE engine_handle,
-	_In_ LPGUID filter_id
+	_In_ LPCGUID filter_id,
+	_In_ LPCWSTR file_name,
+	_In_ ULONG line
 );
 
 ULONG _wfp_createfilter (
 	_In_ HANDLE engine_handle,
 	_In_ ENUM_TYPE_DATA type,
 	_In_opt_ LPCWSTR filter_name,
-	_In_reads_ (count) FWPM_FILTER_CONDITION *lpcond,
+	_In_reads_opt_ (count) FWPM_FILTER_CONDITION0 *lpcond,
 	_In_ UINT32 count,
 	_In_ LPCGUID layer_id,
 	_In_opt_ LPCGUID callout_id,
@@ -107,7 +104,7 @@ VOID _wfp_destroyfilters (
 
 VOID _wfp_destroyfilters_array (
 	_In_ HANDLE engine_handle,
-	_In_ PR_ARRAY guids,
+	_Inout_ PR_ARRAY guids,
 	_In_ LPCWSTR file_name,
 	_In_ ULONG line
 );
@@ -116,17 +113,17 @@ BOOLEAN _wfp_createrulefilter (
 	_In_ HANDLE engine_handle,
 	_In_ ENUM_TYPE_DATA filter_type,
 	_In_opt_ LPCWSTR filter_name,
-	_In_opt_ ULONG_PTR app_hash,
+	_In_opt_ ULONG app_hash,
 	_In_opt_ PITEM_FILTER_CONFIG filter_config,
-	_In_opt_ PR_STRINGREF rule_remote,
-	_In_opt_ PR_STRINGREF rule_local,
+	_In_opt_ PCR_STRINGREF rule_remote,
+	_In_opt_ PCR_STRINGREF rule_local,
 	_In_ UINT8 weight,
 	_In_ FWP_ACTION_TYPE action,
 	_In_ UINT32 flags,
 	_Inout_opt_ PR_ARRAY guids
 );
 
-BOOLEAN _wfp_create4filters (
+BOOLEAN _wfp_createrulefilters (
 	_In_ HANDLE engine_handle,
 	_In_ PR_LIST rules,
 	_In_ LPCWSTR file_name,
@@ -134,7 +131,7 @@ BOOLEAN _wfp_create4filters (
 	_In_ BOOLEAN is_intransact
 );
 
-BOOLEAN _wfp_create3filters (
+BOOLEAN _wfp_createappfilters (
 	_In_ HANDLE engine_handle,
 	_In_ PR_LIST rules,
 	_In_ LPCWSTR file_name,
@@ -142,7 +139,7 @@ BOOLEAN _wfp_create3filters (
 	_In_ BOOLEAN is_intransact
 );
 
-BOOLEAN _wfp_create2filters (
+BOOLEAN _wfp_createglobalfilters (
 	_In_ HANDLE engine_handle,
 	_In_ LPCWSTR file_name,
 	_In_ ULONG line,
@@ -164,8 +161,7 @@ ULONG _wfp_dumpfilters (
 );
 
 VOID NTAPI _wfp_applythread (
-	_In_ PVOID arglist,
-	_In_ ULONG busy_count
+	_In_ PVOID arglist
 );
 
 VOID _wfp_firewallenable (
@@ -176,15 +172,15 @@ BOOLEAN _wfp_firewallisenabled ();
 
 _Success_ (NT_SUCCESS (return))
 NTSTATUS _FwpmGetAppIdFromFileName1 (
+	_Out_ PVOID_PTR byte_blob,
 	_In_ PR_STRING path,
-	_In_ ENUM_TYPE_DATA type,
-	_Out_ PVOID_PTR byte_blob
+	_In_ ENUM_TYPE_DATA type
 );
 
 VOID ByteBlobAlloc (
+	_Out_ PVOID_PTR byte_blob,
 	_In_ LPCVOID data,
-	_In_ ULONG_PTR bytes_count,
-	_Out_ PVOID_PTR byte_blob
+	_In_ ULONG_PTR bytes_count
 );
 
 VOID ByteBlobFree (