WireFox v1.0.4

WireFox bridges the missing link of WireGuard on Windows: intelligent background roaming, kernel-level tunnel watchdog protection, and self-healing deactivation.

Note

Why we're revisiting zombie tunnels: Our initial zombie mitigation cleanly pruned ghost adapters, but field testing revealed newer, more creative ways WireGuard on Windows likes to soft-crash. When deactivating upon entering a trusted network, WireGuard's service can deadlock during NDIS adapter unbinding, leaving the service trapped in an unresponsive StopPending spinlock. Because the hosting process never terminates, the Windows Filtering Platform (WFP) callouts remain locked in the kernel, silently blackholing all internet and DNS traffic until killed via PowerShell.

v1.0.4 takes off the kid gloves without going unhinged: we give WireGuard a polite grace window to stop, but if the driver deadlocks, WireFox refuses to let it hold your connection hostage. It surgically tracks down the exact deadlocked service PID, terminates the hung process to instantly release the kernel WFP lock, sweeps lingering adapter artifacts, and flushes the DNS cache.

(Ideally, the upstream WireGuard Windows client would enforce its own driver teardown timeouts rather than deadlocking the service controller. Because this behavior has persisted for years across long sessions and sleep cycles, we've taken it upon ourselves to step in and coax the driver into a working state. If upstream ever resolves this natively, this recovery code will happily become redundant, an outcome we would genuinely welcome.)

📝 What's New in v1.0.4

• Resilient Tunnel Deactivation & Zombie Prevention: 🤞Resolved the dreaded WireGuard deactivation freeze where driver deadlocks left services spinning in StopPending state. Added graceful stop timeout (3s) with immediate escalation to hosting process termination, SCM driver unbinding, and active DNS cache resolver flushing (DnsFlushResolverCache) to prevent Windows Filtering Platform (WFP) kernel blackholes.
• Interactive Tray Control: Added direct Kill WireGuard (Force Stop) action item to the system tray
• Differential Watchdog Diagnostics: Integrated Layer-2 default gateway ARP probing (ArpService) and ICMP verification to validate physical network reachability before attributing connection loss to WireGuard, eliminating false-positive restarts when physical connectivity is lost.
• Active End-to-End Connectivity Probing: Handshake watchdog actively tests HTTP 204 endpoints (generate_204) with fallback DNS resolution checks against msftconnecttest.com to detect silent UDP drops and dead routes.
• Intelligent Toast Notification Debouncing: Replaced rapid notification spam during network transitions with in-place Windows toast replacements (tagged wirefox group) and strict cooldown timers (10m for network discovery, 3m for watchdog alerts).
• Encoding & Script Hardening: Fixed a lot of the PowerShell emoji mojibake across install.ps1, uninstall.ps1, verify.ps1, and release.ps1 by moving to runtime surrogate generation, XML entity escaping, and enforcing UTF-8 without BOM across all build pipelines.
• Re-tooled Installer Logic: Updated install options and double click behavior as well as script theming.

Run PowerShell as Administrator to install or seamlessly upgrade in place:

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/install.ps1 | iex

🔒 Checksums & Binary Verification

File	SHA-256 Checksum
WireFox.exe	9d3e9e4208a31a25a31778f1cf9ada2ca433ac60149c6f30c3b2f28b6e4d4728
uninstall.ps1	d1ab39827cdca1bb2e6958737174f71a904ff85f3c82fb714eaedf3ffa67687c
verify.ps1	b62465441f23f42c5cab181ea67366349a5780e8535fab9c72a4870b789ae0d7

Verify integrity before running (PowerShell):

irm https://raw.githubusercontent.com/TalviFox/WireFox/main/verify.ps1 | iex