[-] Failed to get Trace Version from IPT Service (err=87) about winipt HOT 1 CLOSED

IPT.sys got a nice feature upgrade with Windows 10 v2004. It seems that filtering based on address ranges is now supported but I didn't reverse this new stuff yet.

Unfortunately besides adding new stuff Microsoft also broke the API. One would expect GetIptBufferVersion will catch this but it won't because BufferMajorVersion is still 1 and BufferMinorVersion is still 0 in the newest version of the driver. Why? I can only speculate but it seems that somebody thought that adding new functionality is a non-breaking change, so they can leave protocol versions unchanged. That's true but only partially. Old features seem to be unchanged but the problem lies in this generic check:

if (InputSize >= sizeof(IPT_INPUT_BUFFER) && OutputSize >= sizeof(IPT_OUTPUT_BUFFER))
{
    ProcessMsgV1(...);
}
else
{
    // fail
}

Adding new stuff to both structures caused their sizes to change and this breaks current version of the library. If you want to quickly get around this problem check out this quickfix: 835117d. I tested that starting, stopping and dumping trace data works. I'm not making a PR out of this as I plan to actually reverse new features and make a proper contribution.

from winipt.