ipman.cpp

一个简单的sniffer,下载后请用winrar

WORD GetOption(int argc,char *argv[],struct CommandLine *cmdline)
{
	int i;
	char *pbufh,*pbuft;
	char c;

	cmdline->option=OPT_DO_NOTHING;
	for(i=1;i<argc;i++) {
		if((pbufh=strstr(argv[i],"-l"))!=NULL) {	/* Listen */
			if(strstr(argv[i],"-lini")!=NULL) cmdline->option|=OPT_LISTEN_INIT;
			else cmdline->option|=OPT_LISTEN_ALL;
			/*printf("listen\n");*/
		}
		else if(strstr(argv[i],"-?")!=NULL) {
			cmdline->option|=OPT_HELP;
		}
		else if((pbufh=strstr(argv[i],"-ip:"))!=NULL&&
			(cmdline->option&OPT_LISTEN_ALL)!=0) {	/* IP address */
			pbufh+=4;
			if((pbuft=strstr(pbufh,":"))!=NULL) {	/* Two IP */
				pbuft++;
				GetIPAddr(pbufh,&cmdline->queip[0]);
				GetIPAddr(pbuft,&cmdline->queip[1]);
				cmdline->option|=OPT_LISTEN_IP_2;
			}
			else {	/* One IP */
				GetIPAddr(pbufh,&cmdline->queip[0]);
				cmdline->option|=OPT_LISTEN_IP_1;
			}
		}
		else if((pbufh=strstr(argv[i],"-port:"))!=NULL&&
			(cmdline->option&OPT_LISTEN_ALL)!=0) {	/* Port */
			pbufh+=6;
			if((pbuft=strstr(pbufh,":"))!=NULL) {	/* Two port */
				pbuft++;
				sscanf(pbufh,"%d",&cmdline->queport[0]);
				sscanf(pbuft,"%d",&cmdline->queport[1]);
				cmdline->option|=OPT_LISTEN_PORT_2;
			}
			else {	/* One port */
				sscanf(pbufh,"%d",&cmdline->queport[0]);
				cmdline->option|=OPT_LISTEN_PORT_1;
			}
		}
		else if((pbufh=strstr(argv[i],"-qeth:"))!=NULL) {	/* Query ethernet address */
			cmdline->option|=OPT_QUE_ETHER;
			pbufh+=6;
			GetIPAddr(pbufh,&cmdline->queip[0]);
		}
		else if((pbufh=strstr(argv[i],"-qip:"))!=NULL) {	/* Query IP */
			cmdline->option|=OPT_QUE_IP;
			pbufh+=5;
			GetEtherAddr(pbufh,&cmdline->queeth[0]);
		}
		else if((pbufh=strstr(argv[i],"-fout:"))!=NULL) {	/* Output file */
			cmdline->option|=OPT_OUTPUT_FILE;
			pbufh+=6;
			sscanf(pbufh,"%s",cmdline->outfile);
		}
		else if((pbufh=strstr(argv[i],"-fcmd:"))!=NULL) {	/* Command file */
			cmdline->option|=OPT_COMMAND_FILE;
			pbufh+=6;
			sscanf(pbufh,"%s",cmdline->cmdfile);
		}
	}
	if(cmdline->option&OPT_LISTEN_SPEC) cmdline->option&=~OPT_LISTEN_ALL;
	return OK;
}

WORD GetInitial(FILE *pfini,struct InitialFile *inifile)
{
	char Command[BUFFER_SIZE];
	int i;
	int out;

	out=2;
	inifile->ipno=0;
	inifile->portno=0;
	inifile->timeout=INFINITE;
	inifile->maxdatalen=MAX_DATA;
	while(feof(pfini)==0) {
		ReadCommand(pfini,Command);
		switch (GetCommand(Command)) {
		case INITIAL_MAX_DATA:
			ReadCommand(pfini,Command);
			sscanf(Command,"%d",&inifile->maxdatalen);
			break;
		case INITIAL_IP_ADDR:
			ReadCommand(pfini,Command);
			out--;
			GetIPAddr(Command,&inifile->mipaddr);
			break;
		case INITIAL_NDIS:
			out--;
			ReadCommand(pfini,inifile->ndis);
			break;
		case INITIAL_QUERY_IP:
			ReadCommand(pfini,Command);
			i=0;
			while(GetCommand(Command)!=INITIAL_END_SEGMENT) {
				GetIPAddr(Command,&inifile->qip[i]);
				i++;
				if(i==MAX_QUERY) return SYSERR;
				ReadCommand(pfini,Command);
			}
			inifile->ipno=i;
			break;
		case INITIAL_QUERY_PORT:
			ReadCommand(pfini,Command);
			i=0;
			while(GetCommand(Command)!=INITIAL_END_SEGMENT) {
				sscanf(Command,"%d",&inifile->qport[i]);
				i++;
				if(i==MAX_QUERY) return SYSERR;
				ReadCommand(pfini,Command);
			}
			inifile->portno=i;
			break;
		case INITIAL_TIMEOUT:
			ReadCommand(pfini,Command);
			if(strstr(Command,INITIAL_INFINITE)==NULL) 
				sscanf(Command,"%d",&inifile->timeout);
			else inifile->timeout=INFINITE;
			break;
		case COMMENT:
			break;
		case INITIAL_END_SEGMENT:
			break;
		default:
			if(feof(pfini)==0) return SYSERR;
		}
	}
	if(out>0) return SYSERR;
	else return OK;
	return OK;
}

void PrintEtherAddr(FILE *pf,struct EtherAddr *pethaddr)
{
	fprintf(pf,"%02x.%02x.%02x.%02x.%02x.%02x",pethaddr->AddrByte[0],
		    pethaddr->AddrByte[1],
		    pethaddr->AddrByte[2],
		    pethaddr->AddrByte[3],
		    pethaddr->AddrByte[4],
		    pethaddr->AddrByte[5]);
}

void PrintIPAddr(FILE *pf,struct IPAddr *pIPaddr)
{
	fprintf(pf,"%d.%d.%d.%d",pIPaddr->AddrByte[0],
		    pIPaddr->AddrByte[1],
		    pIPaddr->AddrByte[2],
		    pIPaddr->AddrByte[3]);
}

WORD SendARPPacket(HANDLE hVxD,
				   struct EtherAddr *psourether,
				   struct EtherAddr *pdestether,
				   struct EtherAddr *psendether,
				   struct EtherAddr *precvether,
				   struct IPAddr *psendip,
				   struct IPAddr *precvip,
				   WORD oper)
{
	char Buffer[BUFFER_SIZE];
	struct EtherPacketHead *pEtherHead;
	struct ARPPacket *pARPHead;

	memset(Buffer,0,BUFFER_SIZE);
	pEtherHead=(struct EtherPacketHead *)Buffer;
	pARPHead=(struct ARPPacket *)(Buffer+ETHER_HEAD_LEN);
	memcpy((void *)&pEtherHead->SourEther,(void *)psourether,6);
	memcpy((void *)&pEtherHead->DestEther,(void *)pdestether,6);
	pEtherHead->ServType=swaps(ETHER_PROTO_ARP);
	memset((void *)pARPHead,0,ARP_PACKET_LEN);
	pARPHead->Type=swaps(ARP_HARD_TYPE);
	pARPHead->Proto=swaps(ARP_PROTO_TYPE);
	pARPHead->HardAddrLen=ARP_HARD_ADDR_LEN;
	pARPHead->AddrLen=ARP_ADDR_LEN;
	pARPHead->Oper=swaps(oper);
	memcpy((void *)&pARPHead->SourEther,(void *)psendether,6);
	memcpy((void *)&pARPHead->DestEther,(void *)precvether,6);
	memcpy((void *)&pARPHead->SourIP,(void *)psendip,4);
	memcpy((void *)&pARPHead->DestIP,(void *)precvip,4);
	if(SendPacket(hVxD,Buffer,ETHER_HEAD_LEN+ARP_PACKET_LEN)==SYSERR) {
		fprintf(stderr,"Can not send ARP packet.\n");
		return SYSERR;
	}
	return OK;
}

WORD SendTCPPacket(HANDLE hVxD,
				   struct EtherAddr *psourether,
				   struct EtherAddr *pdestether,
				   struct IPAddr *psourip,
				   struct IPAddr *pdestip,
				   WORD sourport,
				   WORD destport,
				   WORD flag,
				   DWORD seqno,
				   DWORD ackno,
				   char *pbuf,
				   WORD len)
{
	char Buffer[BUFFER_SIZE];
	char HelpBuffer[BUFFER_SIZE];
	char *pdata;
	struct EtherPacketHead *pEtherHead;
	struct IPPacketHead *pIPHead;
	struct TCPPacketHead *pTCPHead,*pHelpTCPHead;
	struct PseudoHead *pPseudoHead;
	static WORD id=0;
	WORD wlen;

	id++;
	memset(Buffer,0,BUFFER_SIZE);
	pEtherHead=(struct EtherPacketHead *)Buffer;
	pIPHead=(struct IPPacketHead *)(Buffer+ETHER_HEAD_LEN);
	pTCPHead=(struct TCPPacketHead *)(Buffer+ETHER_HEAD_LEN+IP_HEAD_BYTE_LEN);
	pPseudoHead=(struct PseudoHead *)HelpBuffer;
	pHelpTCPHead=(struct TCPPacketHead *)(HelpBuffer+PSEUDO_HEAD_LEN);
	pdata=(char *)(Buffer+ETHER_HEAD_LEN+IP_HEAD_BYTE_LEN+TCP_HEAD_BYTE_LEN);
	/* Set ether head */
	memcpy((void *)&pEtherHead->SourEther,(void *)psourether,6);
	memcpy((void *)&pEtherHead->DestEther,(void *)pdestether,6);
	pEtherHead->ServType=swaps(ETHER_PROTO_IP);
	/* Set IP head */
	memcpy((void *)&pIPHead->SourIP,(void *)psourip,4);
	memcpy((void *)&pIPHead->DestIP,(void *)pdestip,4);
	pIPHead->VerHLen=(IP_VER<<4)|IP_HEAD_LEN;
	pIPHead->Type=IP_SERV_TYPE;
	wlen=len+TCP_HEAD_BYTE_LEN+IP_HEAD_BYTE_LEN;
	pIPHead->TtlLen=swaps(wlen);
	pIPHead->Id=swaps(id);
	pIPHead->FlgOff=0;
	pIPHead->TTL=69;
	pIPHead->Proto=IP_PROTO_TCP;
	pIPHead->ChkSum=0;
	pIPHead->ChkSum=CheckSum((WORD *)pIPHead,IP_HEAD_BYTE_LEN);
	/* Set TCP head */
	pTCPHead->SourPort=swaps(sourport);
	pTCPHead->DestPort=swaps(destport);
	pTCPHead->SeqNo=swapl(seqno);
	pTCPHead->AckNo=swapl(ackno);
	pTCPHead->HLen=TCP_HEAD_LEN<<4;
	pTCPHead->Flag=flag;
	pTCPHead->WndSize=swaps(8192);
	pTCPHead->ChkSum=0;
	pTCPHead->UrgPtr=0;
	/* Set TCP data */
	memcpy((void *)pdata,(void *)pbuf,len);
	/* Calculate TCP checksum */
	memcpy((void *)&pPseudoHead->SourIP,(void *)psourip,4);
	memcpy((void *)&pPseudoHead->DestIP,(void *)pdestip,4);
	pPseudoHead->Pad=0;
	pPseudoHead->Proto=IP_PROTO_TCP;
	wlen=len+TCP_HEAD_BYTE_LEN;
	pPseudoHead->Len=swaps(wlen);
	memcpy((void *)pHelpTCPHead,(void *)pTCPHead,wlen);
	wlen=len+TCP_HEAD_BYTE_LEN+PSEUDO_HEAD_LEN;
	pTCPHead->ChkSum=CheckSum((WORD *)HelpBuffer,wlen);
	wlen=len+TCP_HEAD_BYTE_LEN+IP_HEAD_BYTE_LEN+ETHER_HEAD_LEN;
	if(SendPacket(hVxD,Buffer,wlen)==SYSERR) {
		fprintf(stderr,"Can not send TCP packet.\n");
		return SYSERR;
	}
	return OK;
}

WORD RecvTCPPacket(HANDLE hVxD,
				   struct IPAddr *psourip,
				   struct IPAddr *pdestip,
				   WORD sourport,
				   WORD destport,
				   WORD *flag,
				   DWORD *seqno,
				   DWORD *ackno,
				   char *pbuf,
				   WORD *size)
{
	BOOL Continue;
	WORD DataLen;
	char Buffer[BUFFER_SIZE];
	struct EtherPacketHead *pEtherHead;
	struct IPPacketHead *pIPHead;
	struct TCPPacketHead *pTCPHead;
	int headlen;
	int totallen;
	char *pdata;

	
	struct IPAddr *mpsourip,*mpdestip;
	WORD msourport,mdestport,i;
	DWORD mackno,mseqno;

	Continue=TRUE;
	while(Continue) {
		if((DataLen=RecvPacket(hVxD,Buffer))==SYSERR) {
			fprintf(stderr,"Can not recv TCP packet.\n");
			return SYSERR;
		}
		pEtherHead=(struct EtherPacketHead *)Buffer;
		if(swaps(pEtherHead->ServType)!=ETHER_PROTO_IP) continue;
		pIPHead=(struct IPPacketHead *)(Buffer+ETHER_HEAD_LEN);
		if(memcmp((void *)&pIPHead->SourIP,(void *)psourip,4)!=0) continue;
		if(memcmp((void *)&pIPHead->DestIP,(void *)pdestip,4)!=0) continue;
		headlen=(pIPHead->VerHLen)&0xf;
		headlen*=4;
		totallen=swaps(pIPHead->TtlLen);
		pTCPHead=(struct TCPPacketHead *)(Buffer+ETHER_HEAD_LEN+headlen);
		if(swaps(pTCPHead->SourPort)!=sourport) continue;
		if(swaps(pTCPHead->DestPort)!=destport) continue;
		/* Get TCP data */
		totallen-=headlen;
		headlen=pTCPHead->HLen>>4;
		headlen*=4;
		totallen-=headlen;
		*flag=pTCPHead->Flag;
		*seqno=swapl(pTCPHead->SeqNo);
		*ackno=swapl(pTCPHead->AckNo);
		*size=totallen;
		pdata=((char *)pTCPHead)+headlen;
		memcpy((void *)pbuf,(void *)pdata,totallen);
		Continue=FALSE;
	}
	return OK;
}

void ReadCommand(FILE *pf,char *pbuf)
{
	while(feof(pf)==0) {
		*pbuf=fgetc(pf);
		if(*pbuf=='\n') break;
		pbuf++;
	}
	*pbuf=0;
}

WORD GetCommand(char *pbuf)
{
	char buf[MAX_COMMAND];

	if(*pbuf==0) return INITIAL_END_SEGMENT;
	sscanf(pbuf,"%s",buf);
	ToUpper(buf);
	if(strstr(buf,"SENDARP")!=NULL) return COMMAND_SEND_ARP;
	else if(strstr(buf,"SENDTCP")!=NULL) return COMMAND_SEND_TCP;
	else if(strstr(buf,"RECVTCP")!=NULL) return COMMAND_RECV_TCP;
	else if(strstr(buf,"CONNECT")!=NULL) return COMMAND_CONNECT_TCP;
	else if(strstr(buf,"CLOSE")!=NULL) return COMMAND_CLOSE_TCP;
	else if(buf[0]=='#') return COMMENT;
	else if(strstr(buf,"[IPADDR]")!=NULL) return INITIAL_IP_ADDR;
	else if(strstr(buf,"[NDIS]")!=NULL) return INITIAL_NDIS;
	else if(strstr(buf,"[MAXDATALEN]")!=NULL) return INITIAL_MAX_DATA;
	else if(strstr(buf,"[QUERYIP]")!=NULL) return INITIAL_QUERY_IP;
	else if(strstr(buf,"[QUERYPORT]")!=NULL) return INITIAL_QUERY_PORT;
	else if(strstr(buf,"[TIMEOUT]")!=NULL) return INITIAL_TIMEOUT;
	else return COMMAND_UNKNOWN;
}

void ToUpper(char *pbuf)
{
	char c;

	while(*pbuf) {
		c=*pbuf;
		if(c>='a'&&c<='z') *pbuf=c+'A'-'a';
		pbuf++;
	}
}

void GetSendARPArg(char *pbuf,
				   struct EtherAddr *psendeth,
				   struct EtherAddr *precveth,
				   struct EtherAddr *soureth,
				   struct EtherAddr *desteth,
				   struct IPAddr *sourip,
				   struct IPAddr *destip,
				   WORD *oper)
{
	char pcmd[20],pseth[20],preth[20],psoureth[20],pdesteth[20],psip[20],pdip[20],poper[20];

	/* A line as "SENDARP sendeth recveth soureth sourip desteth destip oper" */
	sscanf(pbuf,"%s %s %s %s %s %s %s %s",
		   pcmd,pseth,preth,psoureth,psip,pdesteth,pdip,poper);
	GetEtherAddr(pseth,psendeth);
	GetEtherAddr(preth,precveth);
	GetEtherAddr(psoureth,soureth);
	GetEtherAddr(pdesteth,desteth);
	GetIPAddr(psip,sourip);
	GetIPAddr(pdip,destip);
	sscanf(poper,"%d",oper);
}

void GetSendTCPArg(char *pbuf,WORD *id,char *pdata,WORD *size)
{
	/* A line as "SENDTCP id data" */
	char pcmd[20],pid[20],Buffer[BUFFER_SIZE];

	sscanf(pbuf,"%s %s %s",pcmd,pid,Buffer);
	sscanf(pid,"%d",id);
	GetDataArg(Buffer,pdata,size);
}

void GetRecvTCPArg(char *pbuf,WORD *id)
{
	/* A line as "RECVTCP id" */
	char pcmd[20],pid[20];

	sscanf(pbuf,"%s %s",pcmd,pid);
	sscanf(pid,"%d",id);
}

void GetConnectArg(char *pbuf,
				   struct EtherAddr *sendeth,
				   struct EtherAddr *recveth,
				   struct IPAddr *sourip,
				   struct IPAddr *destip,
				   WORD *sourport,
				   WORD *destport,
				   WORD *id)
{
	/* A line as "CONNECT sendeth recveth sourip destip sourport destport id" */
	char pcmd[20],psip[20],pdip[20],psport[20],pdport[20],pid[20],pseth[20],preth[20];
	
	sscanf(pbuf,"%s %s %s %s %s %s %s %s",
		   pcmd,pseth,preth,psip,pdip,psport,pdport,pid);
	GetEtherAddr(pseth,sendeth);
	GetEtherAddr(preth,recveth);
	GetIPAddr(psip,sourip);
	GetIPAddr(pdip,destip);
	sscanf(psport,"%d",sourport);
	sscanf(pdport,"%d",destport);
	sscanf(pid,"%d",id);
}

void GetCloseArg(char *pbuf,WORD *id)
{
	/* A line as "CLOSE id */
	char pcmd[20],pid[20];

	sscanf(pbuf,"%s %s",pcmd,pid);
	sscanf(pid,"%d",id);
}

void GetIPAddr(char *pbuf,struct IPAddr *pipaddr)
{
	char c;

	sscanf(pbuf,"%d%c%d%c%d%c%d",&pipaddr->AddrByte[0],&c,
	   &pipaddr->AddrByte[1],&c,
	   &pipaddr->AddrByte[2],&c,
	   &pipaddr->AddrByte[3]);
}

void GetEtherAddr(char *pbuf,struct EtherAddr *pethaddr)
{
	char c;

	sscanf(pbuf,"%x%c%x%c%x%c%x%c%x%c%x",&pethaddr->AddrByte[0],&c,
	   &pethaddr->AddrByte[1],&c,
	   &pethaddr->AddrByte[2],&c,
	   &pethaddr->AddrByte[3],&c,
	   &pethaddr->AddrByte[4],&c,
	   &pethaddr->AddrByte[5]);
}

void GetDataArg(char *pbuf,char *pdata,WORD *size)
{
	char buf[4];

	(*size)=0;
	while(*pbuf) {
		if(*pbuf=='\\') {
			pbuf++;
			memcpy(buf,pbuf,3);
			buf[3]=0;
			sscanf(buf,"%d",pdata);
			pbuf+=2;
		}
		else *pdata=*pbuf;
		pdata++;
		pbuf++;
		(*size)++;
	}
}

void PrintData(FILE *pf,BYTE *pdata,int size)
{
	int i;

	if(size>Max_Data_Len) size=Max_Data_Len;
	for(i=0;i<size;i++) {
		if(pdata[i]<' ') fprintf(pf,"\\%03d",pdata[i]);
		else fprintf(pf,"%c",pdata[i]);
	}
}