How to upgrade Nmap to a new WinPcap release (2010) --------------------------------------------------- 1) Download the latest version of WinPcap from www.winpcap.org and make a note of the version (for example 4.1). 2) Update the LICENSE file, if necessary. I couldn't find a plain WinPcap license file anywhere. There's an HTML version at http://www.winpcap.org/misc/copyright.htm. You can copy and paste the license text from the installer into the LICENSE file which should be saved as PC file format (not UNIX) and ANSI encoding (not UTF-8). 3) Extract the required files from the setup file using 7-Zip (http://www.7-zip.org/). The installed files at time of writing are: x86: C:\Program Files\WinPcap\rpcapd.exe C:\Windows\system32\Packet.dll C:\Windows\system32\pthreadVC.dll C:\Windows\system32\wpcap.dll C:\Windows\system32\drivers\npf.sys x64: C:\Program Files\WinPcap\rpcapd.exe C:\Windows\SysWOW64\Packet.dll C:\Windows\system32\Packet.dll C:\Windows\SysWOW64\pthreadVC.dll C:\Windows\SysWOW64\wpcap.dll C:\Windows\system32\wpcap.dll C:\Windows\system32\drivers\npf.sys Check the Details tab to identify the NT5/NT6/AMD64 files. You will need to extract the files (you can auto rename them to ensure all the files are there) in order to view the descriptions. We do not support NT4, so those files are not required. The smaller NT5 version of Packet.dll needs to be extracted into the mswin32/winpcap/nt5/x86 subdirectory. The larger NT5 version of Packet.dll needs to be extracted into the mswin32/winpcap/nt5/x64 subdirectory. The smaller Vista version of Packet.dll needs to be extracted into the mswin32/winpcap/vista/x86 subdirectory. The larger Vista version of Packet.dll needs to be extracted into the mswin32/winpcap/vista/x64 subdirectory. The smaller version of wpcap.dll needs to be extracted into the mswin32/winpcap subdirectory. The larger version of wpcap.dll needs to be extracted into the mswin32/winpcap/x64 subdirectory. The x86 version of npf.sys needs to be extracted into the mswin32/winpcap subdirectory. Right click on each npf.sys, click "Properties", then select the "Version" tab. The "Description:" field will have a string containing "x86". The AMD64 version of npf.sys needs to be extracted into the mswin32/winpcap/x64 subdirectory. Right click on each npf.sys, click "Properties", then select the "Version" tab. The "Description:" field will have a string containing "AMD64". 4) Open winpcap-nmap.nsi. Change the version for the following lines: Name "WinPcap (Nmap) X.X.X" OutFile "winpcap-nmap-X.XX.exe WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\winpcap-nmap" "DisplayName" "winpcap-nmap X.XX" 5) Get the internal 'FileVersion' from wpcap.dll. Right-click on wpcap.dll and select "Properties", then select the "Version" tab. Copy the number there into this part of winpcap-nmap.nsi: var /GLOBAL my_ver StrCpy $my_ver "X.X.X.X" <-- file version goes here 6) Generate the installer by compiling winpcap-nmap.nsi using the running the command makensis winpcap-nmap.nsi Alternately, you can right click the script and select "Compile NSIS Script". makensis is part of the "Nullsoft Scriptable Install System" at http://nsis.sourceforge.net/. 7) Give the installer a test, make sure the correct version appears in the installer's name and in Add/Remove Programs. You may also want to try installing it when it is already installed or an older version is installed. Ideally this should be tested on as many platforms as possible. The following should be a sufficient minimum, as Windows XP x64 is based on 2003 x64, 2008 is based on Vista and 2008R2 is the same codebase as 7: Windows XP Windows 2003 x64 Windows Vista Windows 7 x64 8) Open mswin32/nsis/Nmap.nsi and update the references to the winpcap installer's name. You should only have to change the version number. The section you need to look at starts like this: Section "WinPcap X.X" SecWinPcap 9) Download the WinPcap developer package (http://www.winpcap.org/devel.htm) and replace all the files in mswin32/lib/ with the new versions inside the package. 10) Build the Nmap installer. The best way to do this is to run "make" in the mswin32 directory. This will build Nmap and run makensis for you. Test the installer. You may want to try it with Nmap already installed and with different versions installed. Also check that everything appears in Add/Remove Programs correctly. 11) Test Nmap functionallity that uses WinPcap (raw packet scans, raw packet pings, traceroute). 12) Sit back and have a cup of coffee, you deserve it :)