Kernel Developer Utility Open Source • WFP Diagnostics

WFP Callout Explorer

A diagnostic utility that identifies likely Windows Filtering Platform (WFP) callout drivers among loaded kernel modules by inspecting their on-disk PE imports for FWPKCLNT!FwpsCalloutRegister*.

Download Releases → View on GitHub ← Back to Tools & Ecosystem

Platform: Windows 11 / 10 / Server

Architectures: x64 • ARM64 • x86

Dependency: pe-parse library

Diagnostics & Analysis

How WFP Callout Explorer Operates

When troubleshooting network filter conflicts, security software interactions, or driver hooks, identifying active WFP callout drivers is essential:

Driver Module Enumeration

Queries the Windows kernel subsystem to enumerate all currently loaded device drivers and kernel module base addresses.

PE Import Table Parsing

Opens each loaded module's on-disk Portable Executable (PE) file and inspects its import table using pe-parse.

Callout Function Detection

Reports modules importing functions whose names start with FwpsCalloutRegister from FWPKCLNT.SYS. These imports indicate likely callout drivers; they do not prove an active registration.

Methodology & Operational Scope

PE Import Table Analysis: WFP Callout Explorer infers likely callout drivers by parsing the Portable Executable (PE) import address tables of loaded kernel modules for references to FWPKCLNT.SYS routines. It does not query the live Windows Filtering Platform (WFP) runtime engine or enumerate Base Filtering Engine (BFE) dynamic callout registrations.

Elevated Command Prompt / PowerShell

# Run from an elevated Command Prompt or PowerShell:

WFPCalloutExplorer.exe

# Detected WFP callout drivers and system module paths are reported:

List of WFP filter drivers (import FWPKCLNT!FwpsCalloutRegister):

# Example module path; results depend on the system:

C:\Windows\System32\drivers\inspect.sys