This release addresses a bug where application paths reported by the Windows Firewall event log were not being correctly resolved. Paths for pending connections were being stored in their low-level NT Device Name format (e.g., \device\harddiskvolume3...). Standard Windows APIs and File Explorer cannot handle this format, causing features like "Open File Location" to fail. A new PathResolver.cs utility was implemented. This class uses the QueryDosDevice Win32 API to build a cached map of device volumes to their corresponding drive letters (e.g., C:) at runtime. The FirewallEventListenerService now normalizes every path immediately upon receiving an event.
Corrected the parsing of firewall block events (EventID 5157) to accurately distinguish between Inbound (%%14592) and Outbound (%%14593) connections.
Enabled sorting by name on all ListView tabs (Programs, Services, Pending Connections, etc.).
Updated dark theme scroll bar.
Optimized the FirewallEventListenerService by replacing a performance-intensive LINQ query with a fast HashSet lookup (O(1)) to check for pre-existing rules, reducing CPU load during frequent network events. Refactored temporary rule handling to eliminate slow, full data reloads. The system now uses targeted data updates and an event-driven model (TemporaryRuleExpired) for a more responsive UI when creating and removing temporary rules.
Portable app recommended. Just unzip in a folder wherever you keep your portable applications.