ipman.cpp

一个简单的sniffer,下载后请用winrar

					  &cmdline.queeth[0],
					  &m_IPAddr,
					  &ipnull,
					  ARP_OPER_RARP_REQ);
		Continue=TRUE;
		while(Continue) {
			if((DataLen=RecvPacket(hVxD,Buffer))==SYSERR) {
				fprintf(stderr,"Can not recv ARP packet.\n");
				goto ENDOFTASK;
			}
			pEtherHead=(struct EtherPacketHead *)Buffer;
			if(swaps(pEtherHead->ServType)!=ETHER_PROTO_ARP) continue;
			pARPHead=(struct ARPPacket *)(Buffer+ETHER_HEAD_LEN);
			if(swaps(pARPHead->Oper)!=ARP_OPER_RARP_ANS) continue;
			if(memcmp((void *)&pARPHead->SourEther,(void *)&cmdline.queeth[0],6)!=0) continue;
			/* Get IP address */
			fprintf(pfout,"IP Address:");
			PrintIPAddr(pfout,&pARPHead->SourIP);
			fprintf(pfout," of Ethernet Address:");
			PrintEtherAddr(pfout,&cmdline.queeth[0]);
			fprintf(pfout,"\n");
			Continue=FALSE;
		}
	}
	else if((cmdline.option&OPT_COMMAND_FILE)!=0) {
		/* Do command file */
		while(feof(pfcmd)==0) {
			ReadCommand(pfcmd,Command);
			switch (GetCommand(Command)) {
			case COMMAND_SEND_ARP:
				GetSendARPArg(Command,
					          &sendethaddr,
							  &recvethaddr,
							  &sourethaddr,
							  &destethaddr,
							  &sipaddr,
							  &dipaddr,
							  &arpoper);
				SendARPPacket(hVxD,
					          &sendethaddr,
							  &recvethaddr,
							  &sourethaddr,
							  &destethaddr,
							  &sipaddr,
							  &dipaddr,
							  arpoper);
				fprintf(pfout,"Send ARP.\n");
				break;
			case COMMAND_SEND_TCP:
				GetSendTCPArg(Command,&tcpid,Buffer,&DataLen);
				if(TCP[tcpid].inuse==FALSE) 
					fprintf(stdout,"Connection %d invalid or already closed.\n",tcpid);
				else {
					SendTCPPacket(hVxD,
								  &TCP[tcpid].sendeth,
								  &TCP[tcpid].recveth,
								  &TCP[tcpid].sourip,
								  &TCP[tcpid].destip,
								  TCP[tcpid].sourport,
								  TCP[tcpid].destport,
								  TCP_ACK|TCP_PSH,
								  TCP[tcpid].seqno,
								  TCP[tcpid].ackno,
								  Buffer,
								  DataLen);
					fprintf(pfout,"Send %d TCP:",tcpid);
					PrintData(pfout,Buffer,DataLen);
					fprintf(pfout,"\n");
				}
				break;
			case COMMAND_RECV_TCP:
				GetRecvTCPArg(Command,&tcpid);
				RecvTCPPacket(hVxD,
							  &TCP[tcpid].destip,
							  &TCP[tcpid].sourip,
							  TCP[tcpid].destport,
							  TCP[tcpid].sourport,
							  &TCPFlag,
							  &TCP[tcpid].ackno,
							  &TCP[tcpid].seqno,
							  Buffer,
							  &DataLen);
				if(DataLen==0) TCP[tcpid].ackno++;
				else TCP[tcpid].ackno+=DataLen;
				fprintf(pfout,"Receive %d TCP %d byte(s):",tcpid,DataLen);
				PrintData(pfout,Buffer,DataLen);
				fprintf(pfout,"\n");
				/*fprintf(pfout,"Flag:%x\n",TCPFlag);*/
				if(TCPFlag&TCP_FIN||TCPFlag&TCP_RST) {
					TCP[tcpid].inuse=FALSE;
					fprintf(pfout,"Peer close connection %d.\n",tcpid);
				}
				break;
			case COMMAND_CONNECT_TCP:
				ListenStart(hVxD);
				GetConnectArg(Command,
							  &sendethaddr,
							  &recvethaddr,
							  &sipaddr,
							  &dipaddr,
							  &sourport,
							  &destport,
							  &tcpid);
				memcpy((void *)&TCP[tcpid].sendeth,(void *)&sendethaddr,6);
				memcpy((void *)&TCP[tcpid].recveth,(void *)&recvethaddr,6);
				memcpy((void *)&TCP[tcpid].sourip,(void *)&sipaddr,4);
				memcpy((void *)&TCP[tcpid].destip,(void *)&dipaddr,4);
				TCP[tcpid].sourport=sourport;
				TCP[tcpid].destport=destport;
				TCP[tcpid].seqno=swapl(0x1234);
				TCP[tcpid].ackno=0;
				TCPFlag=TCP_SYN;
				SendTCPPacket(hVxD,
							  &TCP[tcpid].sendeth,
							  &TCP[tcpid].recveth,
							  &TCP[tcpid].sourip,
							  &TCP[tcpid].destip,
							  TCP[tcpid].sourport,
							  TCP[tcpid].destport,
							  TCPFlag,
							  TCP[tcpid].seqno,
							  TCP[tcpid].ackno,
							  Buffer,
							  0);
				/*fprintf(pfout,"First:Flag:%x Seq:%lu Ack:%lu\n",
					    TCPFlag,swapl(0x1234),ackno);*/
				RecvTCPPacket(hVxD,
							  &TCP[tcpid].destip,
							  &TCP[tcpid].sourip,
							  TCP[tcpid].destport,
							  TCP[tcpid].sourport,
							  &TCPFlag,
							  &TCP[tcpid].ackno,
							  &TCP[tcpid].seqno,
							  Buffer,
							  &DataLen);
				/*fprintf(pfout,"Second:Flag:%x Seq:%lu Ack:%lu\n",
					    TCPFlag,TCP[tcpid].ackno,TCP[tcpid].seqno);*/
				TCP[tcpid].ackno++;
				TCPFlag=TCP_ACK;
				SendTCPPacket(hVxD,
							  &TCP[tcpid].sendeth,
							  &TCP[tcpid].recveth,
							  &TCP[tcpid].sourip,
							  &TCP[tcpid].destip,
							  TCP[tcpid].sourport,
							  TCP[tcpid].destport,
							  TCPFlag,
							  TCP[tcpid].seqno,
							  TCP[tcpid].ackno,
							  Buffer,
							  0);
				/*fprintf(pfout,"Third:Flag:%x Seq:%lu Ack:%lu\n",
					    TCPFlag,TCP[tcpid].seqno,TCP[tcpid].ackno);*/
				fprintf(pfout,"TCP %d Connected\n",tcpid);
				TCP[tcpid].inuse=TRUE;
				break;
			case COMMAND_CLOSE_TCP:
				GetCloseArg(Command,&tcpid);
				TCPFlag=TCP_FIN|TCP_ACK;
				SendTCPPacket(hVxD,
							  &TCP[tcpid].sendeth,
							  &TCP[tcpid].recveth,
							  &TCP[tcpid].sourip,
							  &TCP[tcpid].destip,
							  TCP[tcpid].sourport,
							  TCP[tcpid].destport,
							  TCPFlag,
							  TCP[tcpid].seqno,
							  TCP[tcpid].ackno,
							  Buffer,
							  0);
				fprintf(pfout,"Close\n");
				TCP[tcpid].inuse=FALSE;
				break;
			case COMMENT:
				break;
			case COMMAND_UNKNOWN:
				if(feof(pfcmd)==0) fprintf(stderr,"Command unknown.\n");
				/*goto ENDOFTASK;*/
			}			
		}
	}

ENDOFTASK:
	CloseHandle(hVxD);
	if(pfout!=NULL) fclose(pfout);
	if(pfcmd!=NULL) fclose(pfcmd);
	return 0;
}

DWORD Bind(HANDLE hVxD, BYTE* inBuffer)
{
    HANDLE          hEvent  = 0;
    DWORD           cbRet   = 0;
    OVERLAPPED      ovlp    = {0,0,0,0,0};
    int result;
    int cbIn = 5;
    
    hEvent = CreateEvent(0, TRUE, 0, NULL);
	if(!hEvent) {
		fprintf(stderr,"Can not create event\n");
		return SYSERR;
	}

	ovlp.hEvent=hEvent;

    result = DeviceIoControl(hVxD,
							 IOCTL_PROTOCOL_BIND, 
							 inBuffer, 
							 cbIn, 
							 inBuffer, 
							 cbIn, 
							 &cbRet, 
							 &ovlp);

    if (!result)
        GetOverlappedResult(hVxD, &ovlp, &cbRet, TRUE);
	
	CloseHandle(hEvent);
    return OK;
}

WORD GetHardEtherAddr(HANDLE hVxD,struct EtherAddr *petheraddr)
{
    BYTE*   buffer = QueryOid(hVxD, OID_802_3_CURRENT_ADDRESS, 6);

    if (buffer!=NULL) {
		memcpy((void *)petheraddr->AddrByte,(void*)buffer,6);
		return OK;
	}
	return SYSERR;
}

DWORD QueryPacket(HANDLE hVxD,ULONG ioctl,BYTE* inBuffer,DWORD cbIn,
				  BYTE* outBuffer,DWORD cbOut)
{
    HANDLE      hEvent = 0;
    DWORD       cbRet;
    OVERLAPPED  ovlp = {0,0,0,0,0};
   
    if (!(hEvent = CreateEvent(0, TRUE, 0, NULL)))
        ERROR_OUT("CreateEvent failed!\n")

    ovlp.hEvent = hEvent;
    
    if (!DeviceIoControl(hVxD, ioctl, inBuffer, cbIn, outBuffer, cbOut, &cbRet, &ovlp)) {
        if (GetLastError() == ERROR_IO_PENDING)                         
            fprintf(stderr,"VxD correctly returned operation incomplete.\n" );
        else
            ERROR_OUT( "VxD does not support the requested API!!!\n" );
        if (!GetOverlappedResult(hVxD, &ovlp, &cbRet, FALSE)) {
            if (GetLastError() == ERROR_IO_INCOMPLETE)
                fprintf(stderr,"GetOverlappedResult returned expected value.\n");
            else
                ERROR_OUT("GetOverlappedResult returned unexpected error.\n");
        }
        GetOverlappedResult( hVxD, &ovlp, &cbRet, TRUE);
	}
    return cbRet;
}

BYTE* QueryOid(HANDLE hVxD, ULONG ulOid, ULONG ulLength)
{
    DWORD               cbIn = sizeof(PACKET_OID_DATA) + ulLength;
    DWORD               cbRet;
	PPACKET_OID_DATA	pOidData = (PPACKET_OID_DATA)InBuff;
    ULONG               ioctl;
	
    ioctl = (ulOid >= OID_802_3_PERMANENT_ADDRESS) 
		  	
		  			? IOCTL_PROTOCOL_QUERY_OID : IOCTL_PROTOCOL_STATISTICS;

    memset(InBuff, 0, cbIn+1);

	pOidData->Oid    = ulOid;
	pOidData->Length = ulLength;

	cbRet = QueryPacket( hVxD, ioctl, InBuff, cbIn, InBuff, cbIn );
   
	if ( cbRet > 0 ) 
        return (InBuff+sizeof(PACKET_OID_DATA)-1);

	return 0;
}

BYTE* SetOid(HANDLE hVxD, ULONG ulOid, ULONG ulLength, ULONG data)
{
    DWORD               cbIn = sizeof(PACKET_OID_DATA) + ulLength;
    DWORD               cbRet;
	PPACKET_OID_DATA	pOidData = (PPACKET_OID_DATA)InBuff;
    ULONG               ioctl;
	
    if (ulOid == OID_GEN_CURRENT_PACKET_FILTER)
        ioctl = (ULONG) IOCTL_PROTOCOL_SET_OID;

    memset(InBuff, 0, cbIn+1);

    pOidData->Oid     = ulOid;
    pOidData->Length  = ulLength;
    pOidData->Data[0] = (UCHAR) data;

    cbRet = QueryPacket(hVxD, ioctl, InBuff, cbIn, InBuff, cbIn);
   
	return 0;
}

WORD RecvStart(HANDLE hVxD,struct PacketTable *packtab)
{
	int result;

	packtab->Overlap.Internal=0;
	packtab->Overlap.InternalHigh=0;
	packtab->Overlap.Offset=0;
	packtab->Overlap.OffsetHigh=0;
	packtab->Overlap.hEvent=packtab->hEvent;

	result=DeviceIoControl(hVxD,
						   IOCTL_PROTOCOL_READ,
						   &packtab->Buffer,
						   packtab->Size,
						   &packtab->Buffer,
						   packtab->Size,
						   &packtab->Length,
						   &packtab->Overlap);

	if(result) return SYSERR;

	return OK;
}

WORD SendStart(HANDLE hVxD,struct PacketTable *packtab)
{
	int result;

	packtab->Overlap.Internal=0;
	packtab->Overlap.InternalHigh=0;
	packtab->Overlap.Offset=0;
	packtab->Overlap.OffsetHigh=0;
	packtab->Overlap.hEvent=packtab->hEvent;

	result=DeviceIoControl(hVxD,
						   IOCTL_PROTOCOL_WRITE,
						   &packtab->Buffer,
						   packtab->Size,
						   &packtab->Buffer,
						   packtab->Length,
						   &packtab->Length,
						   &packtab->Overlap);

	if(result) return SYSERR;

	return OK;
}

WORD ListenStart(HANDLE hVxD)
{
	return RecvPacket(hVxD,NULL);
}

WORD RecvPacket(HANDLE hVxD,BYTE *pbuf)
{
	static BOOL first=TRUE;
	static struct PacketTable RecvTab[RECV_MAX];
	static HANDLE EventTab[RECV_MAX];
	HANDLE hEvent;
	int i,j,k;
	WORD len;

	if(first) {
		for(i=0;i<RECV_MAX;i++) {
			hEvent=CreateEvent(0, TRUE, 0, NULL);
			if(!hEvent) {
				fprintf(stderr,"Can not create event\n");
				return SYSERR;
			}
			RecvTab[i].hEvent=hEvent;
			memset(RecvTab[i].Buffer,0,BUFFER_SIZE);
			RecvTab[i].Size=BUFFER_SIZE;
			RecvTab[i].Active=TRUE;
			RecvTab[i].Type=READ;
			EventTab[i]=hEvent;
			RecvStart(hVxD,&RecvTab[i]);
		}
		first=FALSE;
	}
	if(pbuf==NULL) return OK;
	i=WaitForMultipleObjectsEx(RECV_MAX,EventTab,FALSE,INFINITE,FALSE);
	if(i==WAIT_FAILED) return SYSERR;
	for(j=0;j<RECV_MAX;j++) 
		if(EventTab[i]==RecvTab[j].hEvent) break;
	k=j;
	if(RecvTab[k].Type==READ&&RecvTab[k].Active==TRUE) {	/* read complete */
		GetOverlappedResult(hVxD,&RecvTab[k].Overlap,&RecvTab[k].Length,FALSE);
		if(RecvTab[k].Length>BUFFER_SIZE) RecvTab[k].Length=BUFFER_SIZE;
		memcpy((void *)pbuf,(void *)RecvTab[k].Buffer,RecvTab[k].Length);
		len=RecvTab[k].Length;
		CloseHandle(RecvTab[k].hEvent);
		for(j=i;j<RECV_MAX-1;i++) 
			EventTab[i]=EventTab[++j];			
		hEvent=CreateEvent(0, TRUE, 0, NULL);
		if(!hEvent) {
			fprintf(stderr,"Can not create event\n");
			return SYSERR;
		}
		RecvTab[k].hEvent=hEvent;
		memset(RecvTab[k].Buffer,0,BUFFER_SIZE);
		RecvTab[k].Size=BUFFER_SIZE;
		RecvTab[k].Active=TRUE;
		RecvTab[k].Type=READ;
		EventTab[RECV_MAX-1]=hEvent;
		RecvStart(hVxD,&RecvTab[k]);
		return len;
	}
	else return SYSERR;	
}

WORD SendPacket(HANDLE hVxD,BYTE *pbuf,WORD len)
{
	static struct PacketTable SendTab;
	HANDLE hEvent;

	hEvent=CreateEvent(0, TRUE, 0, NULL);
	if(!hEvent) {
		fprintf(stderr,"Can not create event\n");
		return SYSERR;
	}
	SendTab.hEvent=hEvent;
	memcpy(SendTab.Buffer,(void *)pbuf,len);
	SendTab.Size=len;
	SendTab.Length=BUFFER_SIZE;
	SendTab.Active=TRUE;
	SendTab.Type=WRITE;
	SendStart(hVxD,&SendTab);

	GetOverlappedResult(hVxD,&SendTab.Overlap,&SendTab.Length,TRUE);
	return OK;	
}

WORD CheckSum(WORD *addr,WORD len)
{
	DWORD lSum;
	WORD wOddByte;
	WORD wAnswer; 

	lSum=0l;

	while(len>1) {
		lSum+= *addr++;
		len-=2;
	}

	if(len==1) {
		wOddByte=0;
		*((unsigned char*)&wOddByte)=*(unsigned char*)addr;
		lSum+=wOddByte;
	}

	lSum=(lSum>>16)+(lSum&0xffff);
	lSum+=(lSum>>16);
	wAnswer=(unsigned int)~lSum;

	return wAnswer;
}

WORD swaps(WORD net)
{
	WORD lo,hi;
	WORD host;

	lo=net&0xff;
	hi=net&0xff00;
	lo=lo<<8;
	hi=hi>>8;
	host=hi|lo;

	return host;
}

DWORD swapl(DWORD net)
{
	DWORD b1,b2,b3,b4;
	DWORD host;

	b1=net&0xff;
	b2=net&0xff00;
	b3=net&0xff0000;
	b4=net&0xff000000;

	b1=b1<<24;
	b2=b2<<8;
	b3=b3>>8;
	b4=b4>>24;

	host=b1|b2|b3|b4;

	return host;
}