Windows Firewall Control (WFC) by BiniSoft.org

The two Windhawk modules "Modernize Folder Picker Dialog" and "Better file sizes in Explorer details" caused the issue. I found the feature to exclude processes from these modules and added the two WFC executables. Now WFC runs again.
Thank you!

 

Security is critical. Thank you for staying on top of it.

WFC firmly remains on my all time Top-5 favourite software list. With or without the Malwarebytes badge.

 

Excellent redo for safety- Applause

 

Yes, excellent work again! Thank you!

 

Something is going on with the Rules Panel unfortunately. I noticed these:

a) It gets stuck frequently on "Please wait" (black box in the middle). Just try filtering or refreshing a few times.
b) It won't export Rules. No file is created (no error message). I didn't try Import.

6.22.0.0

 

Just tested b): export works here.

 

6.22.0.0 installed well, and export rules works here also.

 

Great work, alexandrud! Thank you...

 

Please check again my updated post from here. I made some updates to it. If WFC event log contains any 112 event IDs, check the Details of the error. It should give a hint of the problem.

Later Edit: I was able to reproduce this on my machine. Export failed because wfcUI.exe had this file injected to it:

System.Exception: Suspicious module detected. ProcessID=6044 ProcessName=wfcUI ProcessFile=C:\Program Files\Malwarebytes\Windows Firewall Control\wfcUI.exe ModuleName='FileSyncShell.dll' ModuleFile='C:\Users\user\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncShell.dll'

Ok, I will revert this change for now until I find a better way to deal with this. I tested this for two weeks on my machines and there is always something that breaks when it comes to security hardening.

 

Same for me, I got both errors 112 and 222
112
Could not validate peer!
System.Exception: Suspicious module detected. ProcessID=3104 ProcessName=wfcUI ProcessFile=C:\Program Files\Malwarebytes\Windows Firewall Control\wfcUI.exe ModuleName='FileSyncShell64.dll' ModuleFile='C:\Users\Utente\AppData\Local\Microsoft\OneDrive\25.199.1012.0002\FileSyncShell64.dll' in WindowsFirewallControl.MB.GrpcVerifier.CheckLoadedModules(Int32 pid) in WindowsFirewallControl.MB.GrpcVerifier.Verify(String remoteEndpointUri)

222
Exporting rules failed!
File: C:\Users\Utente\Documents\0\Full policy 14.11.2025.wpw
Grpc.Core.RpcException: Status(StatusCode="Unknown", Detail="Exception was thrown by handler.") in System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() in System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) in GrpcDotNetNamedPipes.Internal.MessageReader`1.<MoveNext>d__5.MoveNext() --- Fine traccia dello stack da posizione precedente dove è stata generata l'eccezione --- in System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() in System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) in GrpcDotNetNamedPipes.Internal.MessageReader`1.<>c__DisplayClass9_0.<<ReadNextMessage>b__0>d.MoveNext() --- Fine traccia dello stack da posizione precedente dove è stata generata l'eccezione --- in System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() in System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) in WindowsFirewallControl.Proxy.ProxyClient.<ExportPolicy>d__45.MoveNext() --- Fine traccia dello stack da posizione precedente dove è stata generata l'eccezione --- in System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() in System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) in WindowsFirewallControl.Services.PolicyServices.<ExportRules>d__0.MoveNext()

 

Windows Firewall Control v.6.23

Change log:
- Revert: The new security checks implemented in version 6.21 and 6.22 were reverted until a better solution is implemented.

Download location: https://binisoft.org/download/wfc6setup.exe
SHA256: 17f2ebeed6e36c0475ff1ba39417c31acb8ad71ea5df8a2e3de61cb9f0e03b81
SHA512: 55eb5e402734302e21946dff90e3ef13b6ea5d663c93783b80408d75f1cc570ef4392fa67147ad55c0b156095ab1b378769c0462d40e3f2dad4a84307c380db8

I will have to rethink this. I will make any new implementation of it, optional and disabled by default. In software development, even simple things that should be straight forward can lead to unexpected side effects triggered by external software.

Thank you for your feedback and your support,
Alexandru Dicu

P.S. Exporting rules should work again and all other features.

 

I've just autoupdated from 6.22 to 6.23 and exporting rules works, thank you for the fix. I had to repeat the same process described in my previous post (Exit from WFC and in an elevated CMD window, execute: wfc6setup.exe -update) because opening main WFC panel in 6.22 showed a almost blank window, only titlebar was visible.

 

These updates reminded me of a fairly recent, minor issue. The update prompt appears on the bottom-right but part of it is off-screen:



I can easily drag it to reveal the bottom options, but its new position is not remembered on the next update and it'll keep appearing partially off-screen.

 

Auto Updated to 6.23.0.0 here as well and exporting rules works also. Thanks for the fix.

 

If I understood correctly, WFC now blocks DLLs from being injected? Perhaps you can use the same method as Firefox?

https://www.ghacks.net/2019/01/21/firefox-will-block-dll-injections/
https://hacks.mozilla.org/2023/03/letting-users-block-injected-third-party-dlls-in-firefox/

 

That was the plan, but it turned out this is more complex. WFC has one developer, Mozilla has 700 people working on Firefox. For now, WFC version 6.23 has this feature disabled until I figure out a better solution.

 

one good developer can be better than 700 tourists...

 

+1

 

Wait a minute, don't you get any help from Malwarebytes? And about this protection against DLLs, I wonder if it's needed when apps can simply bypass the Windows Firewall, by simply injecting code into processes that are allowed to connect out? I believe malware is still capable of injecting code into browsers.

 

I work for Malwarebytes on their corporate products. Regarding WFC, I am still the only developer touching its code, since 2010. The protection against injected DLL is required because WFC can be used to alter Windows Firewall. Evidently, an undetected malware could inject into a process which is allowed to connect to the Internet and the malware would also connect to the Internet. The complaint about WFC was that it can be exploited by DLL injection to disable Windows Firewall from a standard user account. This is not a real use case because the OS will warn the user about Windows Firewall being disabled. But it can be done.

 

Yes that's what I meant, there are other ways to bypass firewalls, without having to disable them. And I meant you could ask for ideas, even if you're the only one working on WFC.

 

I accidentally exited WCF in my W10 Pro.'s task bar. I thought I was exiting a different app. I panicked and had to figure out to relaunch the firewall manually. Is there a way to have WCF ask me to confirm exiting it?

 

Wow, only one developer? Did WCF have more in the past?

 

There is no confirmation dialog when you exit the tray application. The fastest way to relaunch it: WIN+R -> wfcui -> ENTER



WFC was always a one man show 15 years already.

 

I don't think there's reason to panic. You are exiting the UI, but the Windows Firewall and WFC service are still running in the background. No settings or firewall status changes are made.