WireFox v1.0.5

WireFox bridges the missing link of WireGuard on Windows: intelligent background roaming and kernel-level tunnel watchdog protection.

📝 What's New in v1.0.5

Note

This is mostly polishing up what v1.0.4 fixed.

• Fix: Replaced native wireguard.exe tunnel uninstallation with silent sc.exe delete to eliminate "Service does not exist" Error UI popups when disconnecting/trusting networks.
• Fix: Overhauled gateway storage logic to uniquely identify trusted networks by IP + MAC Address, resolving a major bug where multiple networks sharing the same default gateway (e.g. 192.168.1.1) would overwrite each other and trigger false-positive anti-spoofing lockouts.
• Fix: Independent multi-SSID trust on shared router hardware/MACs, Wi-Fi networks now strictly require explicit SSID trust (with MAC anti-spoofing protection), eliminating race conditions when untrusting or removing individual SSIDs while preserving the router gateway profile.

Note

Wireguard Toasts of "Unexpected tunnel closure" is expected as we are bypassing its UX controls to handle its state

Run PowerShell as Administrator to install or seamlessly upgrade in place:

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/install.ps1 | iex

🔒 Checksums & Binary Verification

File	SHA-256 Checksum
WireFox.exe	d7c60c1bfdb6c005e9f2c50a965a3fdc2fccf9817c79b3927cc6559b7208f366
uninstall.ps1	d1ab39827cdca1bb2e6958737174f71a904ff85f3c82fb714eaedf3ffa67687c
verify.ps1	b62465441f23f42c5cab181ea67366349a5780e8535fab9c72a4870b789ae0d7

Verify integrity before running (PowerShell):

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/verify.ps1 | iex

WireFox v1.0.4

WireFox bridges the missing link of WireGuard on Windows: intelligent background roaming, kernel-level tunnel watchdog protection, and self-healing deactivation.

Note

Why we're revisiting zombie tunnels: Our initial zombie mitigation cleanly pruned ghost adapters, but field testing revealed newer, more creative ways WireGuard on Windows likes to soft-crash. When deactivating upon entering a trusted network, WireGuard's service can deadlock during NDIS adapter unbinding, leaving the service trapped in an unresponsive StopPending spinlock. Because the hosting process never terminates, the Windows Filtering Platform (WFP) callouts remain locked in the kernel, silently blackholing all internet and DNS traffic until killed via PowerShell.

v1.0.4 takes off the kid gloves without going unhinged: we give WireGuard a polite grace window to stop, but if the driver deadlocks, WireFox refuses to let it hold your connection hostage. It surgically tracks down the exact deadlocked service PID, terminates the hung process to instantly release the kernel WFP lock, sweeps lingering adapter artifacts, and flushes the DNS cache.

(Ideally, the upstream WireGuard Windows client would enforce its own driver teardown timeouts rather than deadlocking the service controller. Because this behavior has persisted for years across long sessions and sleep cycles, we've taken it upon ourselves to step in and coax the driver into a working state. If upstream ever resolves this natively, this recovery code will happily become redundant, an outcome we would genuinely welcome.)

📝 What's New in v1.0.4

• Resilient Tunnel Deactivation & Zombie Prevention: 🤞Resolved the dreaded WireGuard deactivation freeze where driver deadlocks left services spinning in StopPending state. Added graceful stop timeout (3s) with immediate escalation to hosting process termination, SCM driver unbinding, and active DNS cache resolver flushing (DnsFlushResolverCache) to prevent Windows Filtering Platform (WFP) kernel blackholes.
• Interactive Tray Control: Added direct Kill WireGuard (Force Stop) action item to the system tray
• Differential Watchdog Diagnostics: Integrated Layer-2 default gateway ARP probing (ArpService) and ICMP verification to validate physical network reachability before attributing connection loss to WireGuard, eliminating false-positive restarts when physical connectivity is lost.
• Active End-to-End Connectivity Probing: Handshake watchdog actively tests HTTP 204 endpoints (generate_204) with fallback DNS resolution checks against msftconnecttest.com to detect silent UDP drops and dead routes.
• Intelligent Toast Notification Debouncing: Replaced rapid notification spam during network transitions with in-place Windows toast replacements (tagged wirefox group) and strict cooldown timers (10m for network discovery, 3m for watchdog alerts).
• Encoding & Script Hardening: Fixed a lot of the PowerShell emoji mojibake across install.ps1, uninstall.ps1, verify.ps1, and release.ps1 by moving to runtime surrogate generation, XML entity escaping, and enforcing UTF-8 without BOM across all build pipelines.
• Re-tooled Installer Logic: Updated install options and double click behavior as well as script theming.

Run PowerShell as Administrator to install or seamlessly upgrade in place:

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/install.ps1 | iex

🔒 Checksums & Binary Verification

File	SHA-256 Checksum
WireFox.exe	9d3e9e4208a31a25a31778f1cf9ada2ca433ac60149c6f30c3b2f28b6e4d4728
uninstall.ps1	d1ab39827cdca1bb2e6958737174f71a904ff85f3c82fb714eaedf3ffa67687c
verify.ps1	b62465441f23f42c5cab181ea67366349a5780e8535fab9c72a4870b789ae0d7

Verify integrity before running (PowerShell):

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/verify.ps1 | iex

WireFox v1.0.3

WireFox bridges the missing link of WireGuard on Windows: intelligent background roaming and kernel-level tunnel watchdog protection.

📝 What's New in v1.0.3

• Fail-Closed Security Enforcement: In-place updates strictly validate SHA-256 cryptographic hashes before execution, blocking unverified or tampered binaries.
• Hardened Update Staging: In-place updates now stage exclusively inside protected Program Files to prevent unprivileged payload injection.
• Safe Interface Discovery: Tunnel configuration discovery validates interface naming and parses [Interface] headers to prevent arbitrary file reading.
• Portable Security Guardrails: Portable builds guard against registering elevated scheduled tasks from untrusted directories and offer 1-click migration to Program Files.
• Installed Apps Auto-Sync: WireFox automatically synchronizes its registered display version in Windows Installed Apps upon startup.

Run PowerShell as Administrator to install or seamlessly upgrade in place:

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/install.ps1 | iex

🔒 Checksums & Binary Verification

File	SHA-256 Checksum
WireFox.exe	0574ac2ac948320d9307fdb296322369cc0bb0ec78149bca599e32037d79c063
uninstall.ps1	523c624db50c73429b3936fa805ffe0991957362c6f900da175763a7d7eb420d
verify.ps1	0939eee1ec7ff077f72f289c0b3587b428ce4bb7364c7f8ac96dcc9085173ef9

Verify integrity before running (PowerShell):

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/verify.ps1 | iex

WireFox v1.0.2

🦊 WireFox v1.0.2

WireFox bridges the missing link of WireGuard on Windows: intelligent background roaming and kernel-level tunnel watchdog protection.

📝 What's New in v1.0.2

• Fixed Zombie Tunnels: Fixed an issue where a tunnel could be left indefinitely active.
• Fixed Updater Locking: Added a retry loop to the in-place updater to wait for file locks to release, preventing Access Denied errors.

Run PowerShell as Administrator to install or seamlessly upgrade in place:

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/install.ps1 | iex

🔒 Checksums & Binary Verification

File	SHA-256 Checksum
WireFox.exe	9b8e7001235c5ddbc8b8347cecc563b8a66e558809110d9e9f58ed0e7fe6d0d4

Verify integrity before running (PowerShell):

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/verify.ps1 | iex

WireFox v1.0.1

🦊 WireFox v1.0.1 | .NET 10 LTS Upgrade

WireFox bridges the missing link of WireGuard on Windows: intelligent background roaming and kernel-level tunnel watchdog protection.

📝 What's New in v1.0.1

• Upgraded target framework to .NET 10 LTS: Proactively migrated the underlying framework from .NET 8 to .NET 10 to ensure long-term stability and support moving forward. (This is a drop-in update; your configuration and trusted networks will carry over automatically).

⚡ Quick Install / Upgrade (PowerShell)

Run PowerShell as Administrator to install or seamlessly upgrade in place:

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/install.ps1 | iex

🔒 Checksums & Binary Verification

File	SHA-256 Checksum
WireFox.exe	96cb818d0456ce8dec33a25d66523bb8b0a2dbd0efcf453f859f6c3f05e785df

Verify integrity before running (PowerShell):

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/verify.ps1 | iex

WireFox v1.0.0

🦊 WireFox v1.0.0 | Automated WireGuard Roaming & Watchdog for Windows

WireFox bridges the missing link of WireGuard on Windows: intelligent background roaming and kernel-level tunnel watchdog protection.

✨ Highlights

• 🔄 Auto-Roaming: Bypasses VPN on trusted home/office Wi-Fi for full gigabit LAN speeds; automatically connects on untrusted networks.
• 🛡️ Gateway ARP Anti-Spoofing: Identifies trusted networks via default gateway MAC addresses (iphlpapi.dll) to prevent SSID spoofing.
• 🐕 Handshake Watchdog: Actively polls kernel timestamps (wg.exe) to detect silent UDP drops, captive portals, and dead tunnels.
• 💻 Native Windows Experience: Built with modern Fluent/Mica design, Windows System Tray integration, and actionable Toast notifications.
• 🔒 Zero Bloat, Zero Telemetry: No user tracking, no accounts, and direct interaction with the audited WireGuardNT driver.

---

⚡ Quick Install (PowerShell)

Run PowerShell as Administrator:

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/install.ps1 | iex