packetip.cs

一个抓包工具

			PIcmp.Data = new byte[Size];
			for( i = 0; i < Size; i ++ )
				PIcmp.Data[i] = *( ptr++ );

			return ( CurrentPtr + Size + PACKET_ICMP_LENGTH );
		}

		unsafe public int GetHTTPPart( int CurrentPtr , int PacketSize )
		{
			byte * ptr = ( byte * ) CurrentPtr;
			int Size = PacketSize - PACKET_ETHERNET_LENGTH - PACKET_INTERNET_LENGTH;
			string Tmp = "";
			int i = 0;
			char [] seperator = new char[2];

			seperator[0] = (char) 13;
			seperator[1] = (char) 10;

			for( i = 0; i < Size; i ++ )
			{
				if( ( *( ptr + i ) > 31 ) | 
					( *( ptr + i ) < 129 ) | 
					( *( ptr + i ) == 13 ) | 
					( *( ptr + i ) == 10 ) )
					Tmp += (char) *( ptr );
				else
					Tmp += " ";

				ptr++;
			}
				
			PHttp.Contents = Tmp.Split( seperator );

			/*if( PHttp.Contents != null )
			{
				for( i = 0; i < PHttp.Contents.GetLength(0); i ++ )
					PHttp.Contents[i] += "\\r\\n";
			}*/

			return ( CurrentPtr + Size );
		}

		unsafe public int GetTCPPart( int CurrentPtr )
		{
			ushort u = 0;
			uint ui = 0;
			byte b = 0;
			ushort * usptr = ( ushort * ) CurrentPtr;
			uint * uiptr = ( uint * ) CurrentPtr;
			byte * ptr = ( byte * ) CurrentPtr;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PTcp.SourcePort = u;
			PTcp.SourcePortStr = GetPortStr( (int) u );

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PTcp.DestinationPort = u;
			PTcp.DestinationPortStr = GetPortStr( (int) u );

			ui = AllFunctions.Get4Bytes( ptr , NORMAL ); ptr += 4;
			PTcp.SequenceNumber = ui; // ?

			ui = AllFunctions.Get4Bytes( ptr , NORMAL ); ptr += 4;
			PTcp.Acknowledgement = ui;

			b = *( ptr++ );
			PTcp.HeaderLength = (byte) ( ( (int) b >> 4 ) * 4 );

			b = *( ptr++ );
			PTcp.Falgs = b;
			PTcp.FalgsStr = GetTCPFLAGSStr( b );

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PTcp.WindowSize = u;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PTcp.Checksum = u;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PTcp.Options = u;

			return ( CurrentPtr + PACKET_TCP_LENGTH );

		}

		public unsafe int GetUDPPart( int CurrentPtr )
		{
			byte * ptr = ( byte * ) CurrentPtr;
			ushort u = 0;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PUdp.SourcePort = u;
			PUdp.SourcePortStr = GetPortStr( (int) u );

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PUdp.DestinationPort = u;
			PUdp.DestinationPortStr = GetPortStr( (int) u );

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PUdp.Length = u;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PUdp.Checksum = u;

			return ( CurrentPtr + PACKET_UDP_LENGTH );
		}


		unsafe public int GetEIGRPPart( int CurrentPtr )
		{
			byte * ptr = ( byte * ) CurrentPtr;
			ushort u = 0;
			uint ui = 0;
			byte b = 0;

			b = *( ptr++ );
			PEigrp.Version = b;
	
			b = *( ptr++ );
			PEigrp.OpCode = b;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PEigrp.Checksum = u;

			ui = AllFunctions.Get4Bytes( ptr , NORMAL ); ptr += 4;
			PEigrp.Flags = ui;

			ui = AllFunctions.Get4Bytes( ptr , NORMAL ); ptr += 4;
			PEigrp.Sequence = ui;

			ui = AllFunctions.Get4Bytes( ptr , NORMAL ); ptr += 4;
			PEigrp.Acknowledge = ui;

			ui = AllFunctions.Get4Bytes( ptr , NORMAL ); ptr += 4;
			PEigrp.AutonomousSystem = ui;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PEigrp.Parameters.Type = u;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PEigrp.Parameters.Size = u;

			b = *( ptr++ );
			PEigrp.Parameters.K1 = b;

			b = *( ptr++ );
			PEigrp.Parameters.K2 = b;

			b = *( ptr++ );
			PEigrp.Parameters.K3 = b;

			b = *( ptr++ );
			PEigrp.Parameters.K4 = b;

			b = *( ptr++ );
			PEigrp.Parameters.K5 = b;

			b = *( ptr++ );
			PEigrp.Parameters.Reserved = b;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PEigrp.Parameters.HoldTime = u;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PEigrp.Software.Type = u;

			u = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PEigrp.Software.Size = u;

			b = *( ptr++ );
			PEigrp.Software.IOS = b.ToString() + ".";
			b = *( ptr++ );
			PEigrp.Software.IOS += b.ToString(); 

			b = *( ptr++ );
			PEigrp.Software.EigrpRelease = b.ToString() + ".";
			b = *( ptr++ );
			PEigrp.Software.EigrpRelease += b.ToString(); 

			return ( CurrentPtr + PACKET_EIGRP_LENGTH );

		}

		unsafe public int GetINTERNETPart( int CurrentPtr )
		{
			byte b = 0;
			ushort  us = 0;
			byte * ptr = ( byte * ) CurrentPtr;
			ushort * usptr = ( ushort * ) CurrentPtr;

			b = *( ptr++ );
			PInternet.Version = (byte) ( (int) b >> 4 );
			PInternet.HeaderLength = (byte) ( ( (int) b & 0x0f ) * 4 );

			b = *( ptr++ );
			PInternet.DifferentiatedServicesField = b;
			PInternet.DifferentiatedServicesFieldStr = "";
			if( ( b & 0x0d ) > 0 )
				PInternet.DifferentiatedServicesFieldStr += "Differentiated Services Codepoint ( Default : 0x00 ),";
			if( ( b & 0x02 ) > 0 )
				PInternet.DifferentiatedServicesFieldStr += "ECN Capable Transport ( ECT ),";
			if( ( b & 0x01 ) > 0 )
				PInternet.DifferentiatedServicesFieldStr += "ECN-CE,";

			if( PInternet.DifferentiatedServicesFieldStr != "" )
				PInternet.DifferentiatedServicesFieldStr = PInternet.DifferentiatedServicesFieldStr.Substring( 0 , PInternet.DifferentiatedServicesFieldStr.Length - 1 );

			us = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PInternet.Length = us;

			us = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PInternet.Identification = us;

			us = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PInternet.Flags = (byte)( (int) us >> 12 );
			if( ( PInternet.Flags & 0x04 ) > 0 )
				PInternet.FlagsStr = "Dont fragment";
			if( ( PInternet.Flags & 0x02 ) > 0 )
				PInternet.FlagsStr = "More fragments";

			PInternet.FragmentOffset = (ushort) ( (int) us & 0x0f );
			
			b = *( ptr++ );
			PInternet.TimeToLive = b;

			b = *( ptr++ );
			PInternet.Protocol = b;
			PInternet.ProtocolStr = GetProtocolStr( (int) b );

			us = AllFunctions.Get2Bytes( ptr , NORMAL ); ptr += 2;
			PInternet.HeaderChecksum = us;

			PInternet.SourceStr = "";
			b = *( ptr++ );
			PInternet.SourceStr += b.ToString() + ".";
			b = *( ptr++ );
			PInternet.SourceStr += b.ToString() + ".";
			b = *( ptr++ );
			PInternet.SourceStr += b.ToString() + ".";
			b = *( ptr++ );
			PInternet.SourceStr += b.ToString();
			PInternet.Source = (uint) AllFunctions.IpAddressToInt( PInternet.SourceStr );

			PInternet.DestinationStr = "";
			b = *( ptr++ );
			PInternet.DestinationStr += b.ToString() + ".";
			b = *( ptr++ );
			PInternet.DestinationStr += b.ToString() + ".";
			b = *( ptr++ );
			PInternet.DestinationStr += b.ToString() + ".";
			b = *( ptr++ );
			PInternet.DestinationStr += b.ToString();
			PInternet.Destination = (uint) AllFunctions.IpAddressToInt( PInternet.DestinationStr );

			return ( CurrentPtr + PACKET_INTERNET_LENGTH );

		}


		unsafe public object EditIPPacket( int CurrentAddr , int PacketSize , ref string TypeStr )
		{
			int CurrentPtr = CurrentAddr;
			
			TypeStr = "IP";
			CurrentPtr = GetINTERNETPart( CurrentPtr );

			if( PInternet.Protocol == IPPROTO_TCP )
			{
				TypeStr = "TCP";
				CurrentPtr = GetTCPPart( CurrentPtr );

				if( ( PTcp.SourcePort == IPPORT_HTTP ) ||
					( PTcp.DestinationPort == IPPORT_HTTP ) ||
					( PTcp.SourcePort == IPPORT_HTTP2 ) ||
					( PTcp.DestinationPort == IPPORT_HTTP2 ) )
				{
					TypeStr = "HTTP";
					CurrentPtr = GetHTTPPart( CurrentPtr, PacketSize );
					PTcp.ConnectedObject = PHttp;
				}
				else if( ( PTcp.SourcePort == IPPORT_NETBIOS_SSN ) ||( PTcp.DestinationPort == IPPORT_NETBIOS_SSN ) )
				{
					TypeStr = "NBSS";
					CurrentPtr = GetPNBSSPart( CurrentPtr );
					if( PNBSessionService.Length != 0 )
					{
						if( PNBSessionService.MessageType == 0 )
						{
							TypeStr = "SMB";
							GetSMBPart( CurrentPtr );
							PNBSessionService.ConnectedObject = PSmb;
						}
						else
						{
							PNBSessionService.ConnectedObject = null;
						}
					}
					else
						PNBSessionService.ConnectedObject = null;

					PTcp.ConnectedObject = PNBSessionService;
				}

				PInternet.ConnectedObject = PTcp;
			}
			else if( PInternet.Protocol == IPPROTO_UDP )
			{
				TypeStr = "UDP";
				CurrentPtr = GetUDPPart( CurrentPtr);
				PInternet.ConnectedObject = PUdp;

				if( ( PUdp.SourcePort == IPPORT_SSDP ) || ( PUdp.DestinationPort == IPPORT_SSDP ) )
				{
					TypeStr = "HTTP";
					CurrentPtr = GetHTTPPart( CurrentPtr, PacketSize );
					PUdp.ConnectedObject = PHttp;
				}
			}
			else if( PInternet.Protocol == IPPROTO_ICMP )
			{
				TypeStr = "ICMP";
				CurrentPtr = GetICMPPart( CurrentPtr , PacketSize );
				PInternet.ConnectedObject = PIcmp;
			}
			else if( PInternet.Protocol == IPPROTO_EIGRP )
			{
				TypeStr = "EIGRP";
				CurrentPtr = GetEIGRPPart( CurrentPtr );
				PInternet.ConnectedObject = PEigrp;
			}

			return PInternet;
		}


	}
}