Sniffing packets from a single executable

Question

I have found SocketSniff to be very useful for troubleshooting network applications (like web browsers, email clients, etc). It can sniff wireless and loopback traffic without using a proxy or WinPCap. It will show you only the traffic from the executable you select, which is exactly what I need.

I would love to build and extend a similar tool. Does anyone know how this tool works? Is there a simple SDK call to listen in on all TCP traffic from an executable?

Answer 1

I expect that it uses code injection and IAT patching to hook the various winsock functions and then simply intercepts the calls and dumps the data that is being passed.

OR, it may use a layered service provider...