Controlling Windows Firewall Control (WFC) dialogues

[anotherautohotkeyusr]

Windows Firewall Control (WFC) is software written by Binisoft - recently acquired by MalwareBytes - that manages Windows Defender Firewall rules.

WFC does not provide built-in keyboard shortcuts for customizing rules in the Notification Dialogue, so I have spent many hours trying and failing to explicitly control WFC dialogue boxes via AHK. The current inelegant solution is to use {Tab xx} and {Space} a lot. The script must also be run as an Administrator.

The Notification Dialogue below appears automatically when an application tries to make an outbound connection, where no firewall rule exists to allow the connection:


AHK Window Spy only shows the following, regardless of cursor position within the dialogue:


Here is an example of the simplest code I have tried:

Code: Select all

#NoEnv
#InstallKeybdHook
#InstallMouseHook
#MaxThreadsPerHotkey 1
#MaxThreadsBuffer Off
#KeyHistory 1000
#MaxHotKeysPerInterval 200
SetTitleMatchMode 2
SetTitleMatchMode Slow
SendMode Input
DetectHiddenWindows, On
#IfWinExist,Outgoing connection blocked ahk_exe wfc.exe
	^#a::
		WinActivate,Outgoing connection blocked ahk_exe wfc.exe
		WinWaitActive,Outgoing connection blocked ahk_exe wfc.exe
		ControlClick,Customize this rule before creating it,Outgoing connection blocked
		ControlClick,x117 y200,Outgoing connection blocked
		Click,117 230 ; This will interact with the dialogue, but obviously not a good solution to interrupt the mouse position.
	Return
#IfWinExist

Microsoft's Inspect (v7.2.0.0) tool provides a lot more information, but I've been unsuccessful using that information:

Code: Select all

How found:                          	Mouse move (2850,808)
                                    	hwnd=0x0000000000031A0E 64bit class="HwndWrapper[wfc.exe;;c8f19e49-76ba-475c-9eb9-63f6d605095b]" style=0x16CC0000 ex=0x108
Name:                               	"Customize this rule before creating it"
ControlType:                        	UIA_ButtonControlTypeId (0xC350)
LocalizedControlType:               	"button"
BoundingRectangle:                  	{l:2634 t:797 r:2900 b:817}
IsEnabled:                          	true
IsOffscreen:                        	false
IsKeyboardFocusable:                	true
HasKeyboardFocus:                   	true
AcceleratorKey:                     	""
AccessKey:                          	""
ProcessId:                          	17128
RuntimeId:                          	[7.42E8.1D62D32]
AutomationId:                       	""
FrameworkId:                        	"WPF"
ClassName:                          	"Button"
IsControlElement:                   	true
IsContentElement:                   	true
ProviderDescription:                	"[pid:17128,providerId:0x0 Main(parent link):Unidentified Provider (managed:MS.Internal.Automation.ElementProxy, PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35)]"
IsPassword:                         	false
ItemStatus:                         	""
ItemType:                           	""
IsRequiredForForm:                  	false
HelpText:                           	""
ClickablePoint:                     	{x:2767 y:807}
Orientation:                        	0
LegacyIAccessible.ChildId:          	0
LegacyIAccessible.DefaultAction:    	"Press"
LegacyIAccessible.Description:      	""
LegacyIAccessible.Help:             	""
LegacyIAccessible.KeyboardShortcut: 	""
LegacyIAccessible.Name:             	"Customize this rule before creating it"
LegacyIAccessible.Role:             	push button (0x2B)
LegacyIAccessible.State:            	focused,focusable (0x100004)
LegacyIAccessible.Value:            	""
IsAnnotationPatternAvailable:       	false
IsDragPatternAvailable:             	false
IsDockPatternAvailable:             	false
IsDropTargetPatternAvailable:       	false
IsExpandCollapsePatternAvailable:   	false
IsGridItemPatternAvailable:         	false
IsGridPatternAvailable:             	false
IsInvokePatternAvailable:           	true
IsItemContainerPatternAvailable:    	false
IsLegacyIAccessiblePatternAvailable:	true
IsMultipleViewPatternAvailable:     	false
IsObjectModelPatternAvailable:      	false
IsRangeValuePatternAvailable:       	false
IsScrollItemPatternAvailable:       	false
IsScrollPatternAvailable:           	false
IsSelectionItemPatternAvailable:    	false
IsSelectionPatternAvailable:        	false
IsSpreadsheetItemPatternAvailable:  	false
IsSpreadsheetPatternAvailable:      	false
IsStylesPatternAvailable:           	false
IsSynchronizedInputPatternAvailable:	true
IsTableItemPatternAvailable:        	false
IsTablePatternAvailable:            	false
IsTextChildPatternAvailable:        	false
IsTextEditPatternAvailable:         	false
IsTextPatternAvailable:             	false
IsTextPattern2Available:            	false
IsTogglePatternAvailable:           	false
IsTransformPatternAvailable:        	false
IsTransform2PatternAvailable:       	false
IsValuePatternAvailable:            	false
IsVirtualizedItemPatternAvailable:  	false
IsWindowPatternAvailable:           	false
IsCustomNavigationPatternAvailable: 	false
FirstChild:                         	"Customize this rule before creating it" text
LastChild:                          	"Customize this rule before creating it" text
Next:                               	"" button
Previous:                           	"Public" check box
Other Props:                        	Object has no additional properties
Children:                           	"Customize this rule before creating it" text
Ancestors:                          	"Outgoing connection blocked - 14:30:07" window
                                    	"Desktop 1" pane
                                    	[ No Parent ]

Can anyone give me a kick in the right direction, or let me know if I am being thick?

Thank you very much in advance.

[TAC109]

If firewall rules could be changed easily by software, it wouldn’t be much of a firewall.

[gregster]

Also, the Window Spy screenshot clearly doesn't show information for the window pictured above it, but some other window.

[anotherautohotkeyusr]

If firewall rules could be changed easily by software, it wouldn’t be much of a firewall.

Hmmm...I'll remove my retort.

[anotherautohotkeyusr]

Also. the Window Spy screenshot clearly doesn't show information for the window pictured above it, but some other window.

Thank you for letting me know. Pain in the neck to get a screen capture of Window Spy. I've updated the image in the OP.

[RickC]

At the risk of another snotty reply, the Windows Firewall Control's keyboard shortcuts are listed on pages 8/9 of the user guide (https://www.binisoft.org/pdf/guides/Malwarebytes-WFC-User-Guide.pdf).

Note also the specific restriction on scripting/automation in section 2 of the EULA (https://www.binisoft.org/eula).

Hope this helps...

[anotherautohotkeyusr]

At the risk of another snotty reply, the Windows Firewall Control's keyboard shortcuts are listed on pages 8/9 of the user guide (https://www.binisoft.org/pdf/guides/Malwarebytes-WFC-User-Guide.pdf).

Note also the specific restriction on scripting/automation in section 2 of the EULA (https://www.binisoft.org/eula).

Hope this helps...

Thank you for trying to help RickC. The built-in shortcuts are unfortunately limited in what they can accomplish. I make certain non-generic selections when creating a rule, which precludes using the shortcuts. I hope I am adhering to the EULA, since I am not automating operation of the application, nor running WFC unattended.

I'm unsure what you mean by a snotty reply. I've replied to two people before you. gregster was very helpful, because I failed to pay attention to the image content when I took the screenshot. Tac109's posting was extremely sarcastic, and contributed nothing positive to this discussion.

[RickC]

I make certain non-generic selections when creating a rule, which precludes using the shortcuts.

In that case, why not use PowerShell's New-NetFirewallRule cmdlet? (See https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=win10-ps)

Create the rules in the built-in PowerShell ISE and use the Windows Firewall GUI to view and test. IMO PowerShell is much better suited to the task, more granular and, if necessary, can be wrapped in AHK (which can often be useful for creating more visually appealing GUIs than PowerShell is capable of).

Alternatively, if just blocking apps is all you need, have a look at Sordum.org's Firewall App Blocker which is scriptable... but is probably too basic for what you appear to need. (https://www.sordum.org/8125/firewall-app-blocker-fab-v1-7/)

Hope this helps...

[anotherautohotkeyusr]

What I really appreciate about WFC is that it works via an approve rather than deny list, and it provides a notification when an application tries to access the internet - presumably from the log files.

I would like to know what frameworks can be used in Windows such that AHK cannot find any controls?

I would love to have the knowledge to create a native Windows front-end App that interacted with PowerShell on the back-end, and provided the same authorization approach of WFC; but alas time is a precious commodity.