Torcap works by injecting a DLL file into every process running under the current user. This DLL uses Winsock API to intercept DNS lookups and TCP/IP connections. The decision whether to route the connection through Tor or directly to the internet is based upon the application mask and host mask. When a match is found, the connection is forced to connect to the Tor SOCKS server.
Comments