How to display FWPS_RIGHT_ACTION_WRITE flag ?

[little-kawa]

Hey, Thank you for this useful tool. Is there any way to differentiate soft/hard permits and soft/hard blocks (I'm not sure that the flag we see in filters is related to FWPS_RIGHT_ACTION_WRITE flag) ? My goal is to identify sub-layers that configured soft blocks so they can be bypassed by an hard permit in another lower priority sub-layer. (https://learn.microsoft.com/en-us/windows/win32/fwp/filter-arbitration) Thank you.

[zodiacon]

I don't think so, as it's a runtime flag.