I want to develop a firewall, so afther the logistics wore made the next level is the development…
My question is which type of firewall is better user or kernel mode?
And what do you recommend to buid : a IM driver or implement a Hook (for NDIS), and why?
My aim is to support Win98+ and to be able to do in the kernel driver more than packet filtering, could you tell me what you recommend (hook or IM)?
Can you give me some examples of implementation for some popular firewalls (including the NeT one that is on this site)?
And last, i want to know from where to start learning about drivers development (I am relativily new to such programming and I need a quick tour)?
Then, you need Hook driver.
to develop drivers for winnt you’ll need DDK
for win9x drivers I’d recommend Numega VToolsD from DriverStudio packet. But this is my “imho”… I know people who do this using DDK for Win98.