Software

i find out this:

# install

# 7zip to Extract WinPcap, after search good 32 bits & 64 bits

# checkUp if 32 or 64 for *.dll,sys | lookup 32-bit -> PE  L & 64-bit -> PE  d†

cls

$pth_srcX32 = "d:\winPcap\x32\"

$pth_srcX64 = "d:\winPcap\x64\"

$pth_dllX32 = "C:\Windows\SysWOW64\"

$pth_dllX64 = "C:\Windows\System32\"

$pth_sys = "C:\Windows\System32\drivers\"

copy $pth_srcX64\packet.dll $pth_dllX64\Packet.dll

copy $pth_srcX64\wpcap.dll $pth_dllX64\wpcap.dl

copy $pth_srcX32\pthreadVC.dll $pth_dllX32\pthreadVC.dll

copy $pth_srcX32\Packet.dll $pth_dllX32\Packet.dll

copy $pth_srcX64\npf.sys $pth_sys\npf.sys

if (!(Test-Path "C:\Program Files (x86)\WinPcap")){new-item "C:\Program Files (x86)\" -Name WinPCap -ItemType Directory}

copy $pth_srcX32\rpcapd.exe "C:\Program Files (x86)\WinPCap\rpcapd.exe"

# app & 1st service

sc.exe create rpcapd type= own start= demand binPath= "C:\Program Files (x86)\WinPCap\rpcad.exe" DisplayName= "Remote Package Capture Protocol..."

# driver (*.sys - 2e service)

sc.exe create npf binPath= "system32\drivers\npf.sys" type= kernel start= auto error= normal tag= no DisplayName= "NetGroup Packet Filter Driver"

sc.exe start npf

# checkup

PS C:\Users\paul\Desktop> Get-Service npf

Status   Name               DisplayName                           

------   ----               -----------                           

Running  npf                NetGroup Packet Filter Driver