Sysinternals has an application called TDIMon that lets you monitor Socket
activity. I am looking to replicate most of this behavior for both a
learning / and practical usage application of mine. I’ve taken a look at
some source code offered by them many, many years ago for their NTFileMon
and I see that they have a .sys file and then are using an api
DeviceIoControl. I am wondering whether the structure is going to be similar
and whether I have to create my own .sys file and if so where would I look
on creating what I needed.
Any help or guidance is appreciated. Thanks.