ipmandoc.cpp

一个简单的sniffer,下载后请用winrar

// IPManDoc.cpp : implementation of the CIPManDoc class
//

#include "stdafx.h"
#include "IPMan.h"

#include "IPManDoc.h"

#include "FilterListView.h"
#include "IPListView.h"
#include "MacListView.h"
#include "MainFrm.h"
#include "ArpDialog.h"

//#include <windows.h>
//#include <stdio.h>
#include "IPfunc.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

/////////////////////////////////////////////////////////////////////////////
// CIPManDoc
//----------------------------var------------------------------
	int argc=0;
	//char *argv[];
	
	//---------------
	HANDLE hVxD;
	DWORD dwErrorCode;
	struct EtherAddr m_EtherAddr;
	struct IPAddr m_IPAddr;
	HANDLE hEvent;
	BOOL Continue;
	int i,j,k;
	BYTE Buffer[BUFFER_SIZE];
	WORD DataLen;
	struct EtherPacketHead *pEtherHead;
	struct IPPacketHead *pIPHead;
	struct TCPPacketHead *pTCPHead;
	struct ARPPacket *pARPHead;
	struct ICMPPacketHead *pICMPHead;
	struct UDPPacketHead *pUDPHead;
	int headlen,totallen;
	struct IPAddr *psourip,*pdestip;
	struct EtherAddr *psoureth,*pdesteth;
	WORD sourport,destport;
	DWORD seqno,ackno;
	BYTE *pdata;
	WORD filter;
	BOOL flag;
	FILE /**pfout=NULL,*pfcmd=NULL,*/*pfini=NULL;
	struct EtherAddr ethernull,etherbroad;
	struct IPAddr ipnull;
	struct CommandLine cmdline;
	struct InitialFile inifile;
	char Command[BUFFER_SIZE];
	char *pbufh,*pbuft;
	struct EtherAddr sendethaddr,recvethaddr,sourethaddr,destethaddr;
	struct IPAddr sipaddr,dipaddr;
	WORD arpoper,tcpid;
	struct TCPConnection TCP[MAX_CONNECTION];
	WORD maxconn=0;
	WORD TCPFlag;
    //----------------
	CString strFind;
	int findCount=0;
	bool exitthread;
	int iWait;
//-------------------------------------------------------------

IMPLEMENT_DYNCREATE(CIPManDoc, CDocument)

BEGIN_MESSAGE_MAP(CIPManDoc, CDocument)
	//{{AFX_MSG_MAP(CIPManDoc)
	ON_COMMAND(ID_BUTTON32772, OnButtonBeginSniffer)
	ON_COMMAND(ID_BUTTON32773, OnButtonExitSniffer)
	ON_COMMAND(ID_BUTTON32774, OnButtonClear)
	ON_BN_CLICKED(IDC_RADIO1, OnRadio1)
	ON_BN_CLICKED(IDC_RADIO2, OnRadio2)
	//}}AFX_MSG_MAP
END_MESSAGE_MAP()

/////////////////////////////////////////////////////////////////////////////
// CIPManDoc construction/destruction
//-------------------全局变量------------------------------
CIPManDoc* pIPManDoc;
extern CIPListView* pIPListView;
extern CFilterListView* pFilterListView;
extern CMACListView* pMACListView;
extern CMainFrame* pMainFrame;
extern CArpDialog* pDlg; 
//---------------------------------------------------------

CIPManDoc::CIPManDoc()
{
	// TODO: add one-time construction code here
    pIPManDoc=this;
	m_display=0;
}

CIPManDoc::~CIPManDoc()
{
}

BOOL CIPManDoc::OnNewDocument()
{
	if (!CDocument::OnNewDocument())
		return FALSE;

	// TODO: add reinitialization code here
	// (SDI documents will reuse this document)
	pIPManDoc->SetTitle("网络监视器");
	int ver=GetVersion() & 0xff;
	//str.Format("%d",ver);
	//AfxMessageBox(str);
	if(ver>4)AfxMessageBox("IPMan使用的是vxd,仅适用于Win9x或Windows ME系统!");

	//===========================================
    /* Set null ethernet address and broadcast ethernet address */
	memset((void*)&ethernull,0,6);
	memset((void*)&etherbroad,0xff,6);
	memset((void*)&ipnull,0,6);

	//-----------------打开IPMan.ini--------------------------
	/* Get initial file property */ 
	if((pfini=fopen(INITIAL_FILE,"r"))==NULL) {
		str.Format("Can not open %s\n",INITIAL_FILE);
		AfxMessageBox(str);
		//return 0;
	}
	if(GetInitial(pfini,&inifile)!=OK) {
		AfxMessageBox("Not valid initial file.\n");
		//return 0;
	}
	Max_Data_Len=inifile.maxdatalen;
	memcpy((void *)&m_IPAddr,(void *)&inifile.mipaddr,4);
	//----------------------------------------------------------

    //----------------VXD操作--------------------------------------------------
    
	/* Open device */
    hVxD = CreateFile("\\\\.\\VPACKET.VXD", 
                      GENERIC_READ | GENERIC_WRITE,
                      0,
                      NULL,
                      OPEN_EXISTING,
                      FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED |
                      FILE_FLAG_DELETE_ON_CLOSE,
                      NULL);

    if (hVxD == INVALID_HANDLE_VALUE) {
        dwErrorCode = GetLastError();
        if (dwErrorCode == ERROR_NOT_SUPPORTED) {
            AfxMessageBox("Unable to open VxD,\ndevice does not support DeviceIOCTL\n");
        }
        else
		{
		    str.Format("Unable to open VxD, Error code: %lx\n", dwErrorCode);
		    AfxMessageBox(str);
		}
		//return(0);
    }

	else
	{
		//AfxMessageBox("Device opened successfully");
		//---------------------statusbar初始化---------------
	    int st1=pMainFrame->m_wndStatusBar.CommandToIndex(ID_INDICATOR_HINT);
	    pMainFrame->m_wndStatusBar.SetPaneStyle(st1,SBPS_NORMAL);
	    pMainFrame->m_wndStatusBar.SetPaneText(st1,"Device opened successfully",true);
	//---------------------------------------------------
	}
	/* Device opened successfully */
		/* Bind driver to NDIS3 adapter	*/

	Bind(hVxD,(unsigned char*)inifile.ndis);

	if(GetHardEtherAddr(hVxD,&m_EtherAddr)!=OK) AfxMessageBox("Cant't get ethernet address");
	//===========================================
	exitthread=false;
	//AfxGetMainWnd()->SetWindowText("WinIPMan 1.0");
	return TRUE;
}



/////////////////////////////////////////////////////////////////////////////
// CIPManDoc serialization

void CIPManDoc::Serialize(CArchive& ar)
{
	if (ar.IsStoring())
	{
		// TODO: add storing code here
	}
	else
	{
		// TODO: add loading code here

	}
}

/////////////////////////////////////////////////////////////////////////////
// CIPManDoc diagnostics

#ifdef _DEBUG
void CIPManDoc::AssertValid() const
{
	CDocument::AssertValid();
}

void CIPManDoc::Dump(CDumpContext& dc) const
{
	CDocument::Dump(dc);
}
#endif //_DEBUG

/////////////////////////////////////////////////////////////////////////////
// CIPManDoc commands
//----------------------------监听线程-----------------------------
UINT ListenAllThread(LPVOID param)
{
	    CString strIP,strMAC,strPORT,strB,strData,strAll,str1;
		int index,tem;

		//AfxMessageBox("开始监听")

		//========================
		/* Set Filter */
		filter=NDIS_PACKET_TYPE_PROMISCUOUS;
		SetOid(hVxD, OID_GEN_CURRENT_PACKET_FILTER, 4, filter);
		//========================

		/* Do listen */
		Continue=TRUE;
		while(Continue) {

			if(exitthread)
			{
				AfxMessageBox("中断监听线程！");
				exitthread=false;
				return 1;
			}

			strAll="";

			DataLen=RecvPacket(hVxD,Buffer,100,3);

			if(exitthread)
			{
				AfxMessageBox("中断监听线程！");
				exitthread=false;
				return 1;
			}			
			
			if(DataLen==SYSERR)
			{
			
				AfxMessageBox("error:DataLen==SYSERR");
				return 1;//goto ENDOFTASK;
			}
			/* Begin to process data */
			
			pEtherHead=(struct EtherPacketHead *)Buffer;
			
			switch (swaps(pEtherHead->ServType)) {
			case ETHER_PROTO_IP:	/* IP packet */
				pIPHead=(struct IPPacketHead *)(Buffer+ETHER_HEAD_LEN);
				headlen=(pIPHead->VerHLen)&0xf;
				headlen*=4;
				totallen=swaps(pIPHead->TtlLen);
				psourip=&(pIPHead->SourIP);
				pdestip=&(pIPHead->DestIP);
				flag=TRUE;
				if(cmdline.option&OPT_LISTEN_IP) {
					flag=FALSE;
					if((cmdline.option&OPT_LISTEN_IP_1)&&
					   (memcmp((void *)&cmdline.queip[0],(void *)psourip,4)==0||
						memcmp((void *)&cmdline.queip[0],(void *)pdestip,4)==0))  
						flag=TRUE;
					else if((cmdline.option&OPT_LISTEN_IP_2)&&
							((memcmp((void *)&cmdline.queip[0],(void *)psourip,4)==0&&
							  memcmp((void *)&cmdline.queip[1],(void *)pdestip,4))||
							 (memcmp((void *)&cmdline.queip[0],(void *)pdestip,4)==0&&
							  memcmp((void *)&cmdline.queip[1],(void *)psourip,4))))
						flag=TRUE;
				}
				else if(cmdline.option&OPT_LISTEN_INIT) {
					flag=FALSE;
					for(i=0;i<inifile.ipno;i++) 
						if(memcmp((void *)&inifile.qip[i],(void *)psourip,4)==0||
						   memcmp((void *)&inifile.qip[i],(void *)pdestip,4)==0) break;
					if(i<inifile.ipno) flag=TRUE;
				}
				if(flag) {
					switch (pIPHead->Proto) {
					case IP_PROTO_TCP:	/* TCP packet */
						pTCPHead=(struct TCPPacketHead *)(Buffer+ETHER_HEAD_LEN+headlen);
						totallen-=headlen;
						sourport=swaps(pTCPHead->SourPort);
						destport=swaps(pTCPHead->DestPort);
						seqno=swapl(pTCPHead->SeqNo);
						ackno=swapl(pTCPHead->AckNo);
						headlen=(pTCPHead->HLen)>>4;
						headlen*=4;
						totallen-=headlen;
						pdata=((BYTE *)pTCPHead)+headlen;
						/* TODO */
						flag=TRUE;
						if(cmdline.option&OPT_LISTEN_PORT) {
							flag=FALSE;
							if((cmdline.option&OPT_LISTEN_PORT_1)&&
							   (cmdline.queport[0]==sourport||
							    cmdline.queport[0]==destport))
								flag=TRUE;
							else if((cmdline.option&OPT_LISTEN_PORT_2)&&
								     ((cmdline.queport[0]==sourport&&cmdline.queport[1]==destport)||
									  (cmdline.queport[0]==destport&&cmdline.queport[1]==sourport)))
								flag=TRUE;										
						}
						else if(cmdline.option&OPT_LISTEN_INIT) {
							flag=FALSE;
							for(i=0;i<inifile.portno;i++) 
								if(sourport==inifile.qport[i]||
								   destport==inifile.qport[i]) break;
							if(i<inifile.portno) flag=TRUE;
						}
						if(flag) {
							index=pIPListView->GetListCtrl().InsertItem(0,"TCP");

							strIP=StrIPAddr(psourip);
							pIPListView->GetListCtrl().SetItem(index,1,LVIF_TEXT,strIP, 0, 0, 0,0);
							
							strPORT.Format("%d",sourport);
							pIPListView->GetListCtrl().SetItem(index,2,LVIF_TEXT,strPORT, 0, 0, 0,0);

							strAll="TCP:"+strIP+":"+strPORT+" -> ";

							strIP=StrIPAddr(pdestip);
							pIPListView->GetListCtrl().SetItem(index,3,LVIF_TEXT,strIP, 0, 0, 0,0);
							
							strPORT.Format("%d",destport);
							pIPListView->GetListCtrl().SetItem(index,4,LVIF_TEXT,strPORT, 0, 0, 0,0);
							
							strB.Format("%d Byte(s)",totallen);
							pIPListView->GetListCtrl().SetItem(index,5,LVIF_TEXT,strB, 0, 0, 0,0);

							strData=StrData(pdata,totallen,pIPManDoc->m_display);
							pIPListView->GetListCtrl().SetItem(index,6,LVIF_TEXT,strData, 0, 0, 0,0);

							strAll=strAll+strIP+":"+strPORT+":\r\n"+strB+":\r\n"+strData;
							//pDlg->m_FilterBox.InsertString(0,strAll);
							//http filter
							//if(strData.Find("http")!=-1)pDlg->m_FilterBox.InsertString(0,strAll);
						}
						break;
					case IP_PROTO_UDP:	/* UDP packet */
						pUDPHead=(struct UDPPacketHead *)(Buffer+ETHER_HEAD_LEN+headlen);
						totallen-=headlen;