ipfunc.h

一个简单的sniffer,下载后请用winrar

#include <windows.h>
#include <stdio.h>
#include <string.h>


#include ".\MAIN\ntddpack.h"
#include ".\MAIN\conpack.h"

#include "ip.h"

//------------------------------------------------------

#define ERROR_OUT(str) { AfxMessageBox(str); CloseHandle(hEvent); return(0); }

#define RECV_MAX 32
#define SEND_MAX 32
#define MAX_CONNECTION 64
#define MAX_COMMAND 64
#define MAX_DATA 64
#define MAX_QUERY 64
#define SYSERR -1
#define OK 0

#define OPT_DO_NOTHING 0x0	/* Do nothing, print local ethernet address */
#define OPT_LISTEN_ALL 0x1	/* Listen all packet */
#define OPT_LISTEN_SPEC 0x41e	/* Listen specially */
#define OPT_LISTEN	0x41f	/* Listen */
#define OPT_LISTEN_IP 0xa	/* Listen IP packet carry special address */
#define OPT_LISTEN_IP_1	0x2	/* Listen IP packet carry one special address */
#define OPT_LISTEN_PORT 0x14	/* Listen IP packet carry special port */
#define OPT_LISTEN_PORT_1 0x4	/* Listen IP packet carry one special port */
#define OPT_LISTEN_IP_2 0x8 /* Listern IP packet between two address */
#define OPT_LISTEN_PORT_2 0x10	/* Listen IP packet between two port */

#define OPT_QUE_IP 0x20	/* Query ethernet address from IP address */
#define OPT_QUE_ETHER 0x40	/* Query IP address from ethernet address */

#define OPT_COMMAND_FILE 0x80	/* Work with command file */

#define OPT_OUTPUT_FILE 0x100	/* Output to file */

#define OPT_HELP 0x200	/* Print help message */

#define COMMAND_SEND_ARP 0x1	/* Send ARP packet */
#define COMMAND_SEND_TCP 0x2	/* Send TCP packet */
#define COMMAND_RECV_TCP 0x4	/* Receive TCP packet */
#define COMMAND_CONNECT_TCP 0x8	/* Connect TCP */
#define COMMAND_CLOSE_TCP 0x10	/* Close TCP */

#define COMMENT 0x8000	/* Comment line */

#define COMMAND_UNKNOWN 0x0	/* Unknown command */

#define OPT_LISTEN_INIT 0x400	/* Listen IP packet match INI file speciallity */
#define INITIAL_FILE "ipman.ini"	/* Initial file name */
#define INITIAL_MAX_DATA 0x01	/* Initial file max data legth */
#define INITIAL_IP_ADDR 0x02	/* Initial file my IP address */
#define INITIAL_NDIS 0x04	/* Initial file NDIS */
#define INITIAL_QUERY_IP 0x08	/* Initial file query ip array */
#define INITIAL_QUERY_PORT 0x10	/* Initial file query port array */
#define INITIAL_TIMEOUT	0x20	/* Initial file timeout */
#define INITIAL_INFINITE "INFINITE"	/* Initial file timeout infinite */
#define INITIAL_END_SEGMENT 0x40	/* Initial file blank line as end of segment */

struct CommandLine {
	DWORD option;
	char outfile[50];
	char cmdfile[50];
	struct IPAddr queip[2];
	struct EtherAddr queeth[2];
	WORD queport[2];
};

struct InitialFile {
	int maxdatalen;
	struct IPAddr mipaddr;
	char ndis[16];
	struct IPAddr qip[MAX_QUERY];
	int ipno;
	WORD qport[MAX_QUERY];
	int portno;
	DWORD timeout;
};

struct TCPConnection {
	struct EtherAddr sendeth,recveth;
	struct IPAddr sourip,destip;
	WORD sourport,destport;
	WORD id;
	DWORD ackno,seqno;
	BOOL inuse;
};	

BYTE InBuff[ sizeof(PACKET_OID_DATA) + 128 ];

DWORD Bind(HANDLE hVxD, BYTE* inBuffer);
WORD  GetHardEtherAddr(HANDLE hVxD,struct EtherAddr *petheraddr);
BYTE* SetOid(HANDLE hVxD, ULONG ulOid, ULONG ulLength, ULONG data);
DWORD QueryPacket(HANDLE hVxD,ULONG ioctl,BYTE* inBuffer,DWORD cbIn,
				  BYTE* outBuffer,DWORD cbOut);
BYTE* QueryOid(HANDLE hVxD, ULONG ulOid, ULONG ulLength);
WORD RecvStart(HANDLE hVxD,struct PacketTable *packtab);
WORD SendStart(HANDLE hVxD,struct PacketTable *packtab);
WORD RecvPacket(HANDLE hVxD,BYTE *pbuf,DWORD WaitTime,int option);
WORD SendPacket(HANDLE hVxD,BYTE *pbuf,WORD len);
WORD CheckSum(WORD *pbuf,WORD len);
WORD ListenStart(HANDLE hVxD);

WORD SendARPPacket(HANDLE hVxD,
				   struct EtherAddr *psourether,
				   struct EtherAddr *pdestether,
				   struct EtherAddr *psendether,
				   struct EtherAddr *precvether,
				   struct IPAddr *psendip,
				   struct IPAddr *precvip,
				   WORD oper);
WORD SendTCPPacket(HANDLE hVxD,
				   struct EtherAddr *psourether,
				   struct EtherAddr *pdestether,
				   struct IPAddr *psourip,
				   struct IPAddr *pdestip,
				   WORD sourport,
				   WORD destport,
				   WORD flag,
				   DWORD seqno,
				   DWORD ackno,
				   char *pbuf,
				   WORD len);
WORD RecvTCPPacket(HANDLE hVxD,
				   struct IPAddr *psourip,
				   struct IPAddr *pdestip,
				   WORD sourport,
				   WORD destport,
				   WORD *flag,
				   DWORD *seqno,
				   DWORD *ackno,
				   char *pbuf,
				   WORD *size);
WORD swaps(WORD net);
DWORD swapl(DWORD net);
WORD GetOption(int argc,char *argv[],struct CommandLine *cmdline);
WORD GetInitial(FILE *pfini,struct InitialFile *inifile);
void ReadCommand(FILE *pf,char *pbuf);
WORD GetCommand(char *pbuf);
void GetSendARPArg(char *pbuf,
   				   struct EtherAddr *psendeth,
				   struct EtherAddr *precveth,
				   struct EtherAddr *soureth,
				   struct EtherAddr *desteth,
				   struct IPAddr *sourip,
				   struct IPAddr *destip,
				   WORD *oper);
void GetSendTCPArg(char *pbuf,WORD *id,char *pdata,WORD *size);
void GetRecvTCPArg(char *pbuf,WORD *id);
void GetConnectArg(char *pbuf,
				   struct EtherAddr *sendeth,
				   struct EtherAddr *recveth,
				   struct IPAddr *sourip,
				   struct IPAddr *destip,
				   WORD *sourport,
				   WORD *destport,
				   WORD *id);
void GetCloseArg(char *pbuf,WORD *id);
void GetDataArg(char *pbuf,char *pdata,WORD *size);
void GetIPAddr(char *pbuf,struct IPAddr *pipaddr); //input ip address
void GetEtherAddr(char *pbuf,struct EtherAddr *pethaddr); //input mac address
CString StrEtherAddr(struct EtherAddr *pethaddr);
CString StrIPAddr(struct IPAddr *pIPaddr);
CString StrData(BYTE *pdata,int size,int option);
void ToUpper(char *pbuf);

static Max_Data_Len;
//--------------------------------------------------------

DWORD Bind(HANDLE hVxD, BYTE* inBuffer)
{
    HANDLE          hEvent  = 0;
    DWORD           cbRet   = 0;
    OVERLAPPED      ovlp    = {0,0,0,0,0};
    int result;
    int cbIn = 5;
    
    hEvent = CreateEvent(0, TRUE, 0, NULL);
	if(!hEvent) {
		fprintf(stderr,"Can not create event\n");
		return SYSERR;
	}

	ovlp.hEvent=hEvent;

    result = DeviceIoControl(hVxD,
							 IOCTL_PROTOCOL_BIND, 
							 inBuffer, 
							 cbIn, 
							 inBuffer, 
							 cbIn, 
							 &cbRet, 
							 &ovlp);

    if (!result)
        GetOverlappedResult(hVxD, &ovlp, &cbRet, TRUE);
	
	CloseHandle(hEvent);
    return OK;
}

WORD GetHardEtherAddr(HANDLE hVxD,struct EtherAddr *petheraddr)
{
    BYTE*   buffer = QueryOid(hVxD, OID_802_3_CURRENT_ADDRESS, 6);

    if (buffer!=NULL) {
		memcpy((void *)petheraddr->AddrByte,(void*)buffer,6);
		return OK;
	}
	return SYSERR;
}

DWORD QueryPacket(HANDLE hVxD,ULONG ioctl,BYTE* inBuffer,DWORD cbIn,
				  BYTE* outBuffer,DWORD cbOut)
{
    HANDLE      hEvent = 0;
    DWORD       cbRet;
    OVERLAPPED  ovlp = {0,0,0,0,0};
   
    if (!(hEvent = CreateEvent(0, TRUE, 0, NULL)))
        ERROR_OUT("CreateEvent failed!\n")

    ovlp.hEvent = hEvent;
    
    if (!DeviceIoControl(hVxD, ioctl, inBuffer, cbIn, outBuffer, cbOut, &cbRet, &ovlp)) {
        if (GetLastError() == ERROR_IO_PENDING)                         
            /*AfxMessageBox("VxD correctly returned operation incomplete.\n" );*/::Beep(200,200);
        else
            ERROR_OUT( "VxD does not support the requested API!!!\n" );
        if (!GetOverlappedResult(hVxD, &ovlp, &cbRet, FALSE)) {
            if (GetLastError() == ERROR_IO_INCOMPLETE)
                AfxMessageBox("GetOverlappedResult returned expected value.\n");
            else
                ERROR_OUT("GetOverlappedResult returned unexpected error.\n");
        }
        GetOverlappedResult( hVxD, &ovlp, &cbRet, TRUE);
	}
    return cbRet;
}

BYTE* QueryOid(HANDLE hVxD, ULONG ulOid, ULONG ulLength)
{
    DWORD               cbIn = sizeof(PACKET_OID_DATA) + ulLength;
    DWORD               cbRet;
	PPACKET_OID_DATA	pOidData = (PPACKET_OID_DATA)InBuff;
    ULONG               ioctl;
	
    ioctl = (ulOid >= OID_802_3_PERMANENT_ADDRESS) 
		  	
		  			? IOCTL_PROTOCOL_QUERY_OID : IOCTL_PROTOCOL_STATISTICS;

    memset(InBuff, 0, cbIn+1);

	pOidData->Oid    = ulOid;
	pOidData->Length = ulLength;

	cbRet = QueryPacket( hVxD, ioctl, InBuff, cbIn, InBuff, cbIn );
   
	if ( cbRet > 0 ) 
        return (InBuff+sizeof(PACKET_OID_DATA)-1);

	return 0;
}

BYTE* SetOid(HANDLE hVxD, ULONG ulOid, ULONG ulLength, ULONG data)
{
    DWORD               cbIn = sizeof(PACKET_OID_DATA) + ulLength;
    DWORD               cbRet;
	PPACKET_OID_DATA	pOidData = (PPACKET_OID_DATA)InBuff;
    ULONG               ioctl;
	
    if (ulOid == OID_GEN_CURRENT_PACKET_FILTER)
        ioctl = (ULONG) IOCTL_PROTOCOL_SET_OID;

    memset(InBuff, 0, cbIn+1);

    pOidData->Oid     = ulOid;
    pOidData->Length  = ulLength;
    pOidData->Data[0] = (UCHAR) data;

    cbRet = QueryPacket(hVxD, ioctl, InBuff, cbIn, InBuff, cbIn);
   
	return 0;
}

WORD RecvStart(HANDLE hVxD,struct PacketTable *packtab)
{
	int result;

	packtab->Overlap.Internal=0;
	packtab->Overlap.InternalHigh=0;
	packtab->Overlap.Offset=0;
	packtab->Overlap.OffsetHigh=0;
	packtab->Overlap.hEvent=packtab->hEvent;

	result=DeviceIoControl(hVxD,
						   IOCTL_PROTOCOL_READ,
						   &packtab->Buffer,
						   packtab->Size,
						   &packtab->Buffer,
						   packtab->Size,
						   &packtab->Length,
						   &packtab->Overlap);

	if(result) return SYSERR;

	return OK;
}

WORD SendStart(HANDLE hVxD,struct PacketTable *packtab)
{
	int result;

	packtab->Overlap.Internal=0;
	packtab->Overlap.InternalHigh=0;
	packtab->Overlap.Offset=0;
	packtab->Overlap.OffsetHigh=0;
	packtab->Overlap.hEvent=packtab->hEvent;

	result=DeviceIoControl(hVxD,
						   IOCTL_PROTOCOL_WRITE,
						   &packtab->Buffer,
						   packtab->Size,
						   &packtab->Buffer,
						   packtab->Length,
						   &packtab->Length,
						   &packtab->Overlap);

	if(result) return SYSERR;

	return OK;
}

WORD ListenStart(HANDLE hVxD)
{
	return RecvPacket(hVxD,NULL,100,3);
}

WORD RecvPacket(HANDLE hVxD,BYTE *pbuf,DWORD WaitTime,int option)
{
	static BOOL first=TRUE;
	static struct PacketTable RecvTab[RECV_MAX];
	static HANDLE EventTab[RECV_MAX];
	HANDLE hEvent;
	int i,j,k;
	WORD len;

	//return SYSERR;
	if(first) {
		for(i=0;i<RECV_MAX;i++) {
			hEvent=CreateEvent(0, TRUE, 0, NULL);
			if(!hEvent) {
				AfxMessageBox("Can not create event\n");
				return SYSERR;
			}
			RecvTab[i].hEvent=hEvent;
			memset(RecvTab[i].Buffer,0,BUFFER_SIZE);
			RecvTab[i].Size=BUFFER_SIZE;
			RecvTab[i].Active=TRUE;
			RecvTab[i].Type=READ;
			EventTab[i]=hEvent;
			RecvStart(hVxD,&RecvTab[i]);
		}
		first=FALSE;
	}
	
	if(pbuf==NULL) return OK;
	if(option==3)  //等待时间无限
	{
		i=WaitForMultipleObjectsEx(RECV_MAX,EventTab,FALSE,INFINITE,FALSE);
	}
	else  //等待时间WaitTime毫秒
	i=WaitForMultipleObjectsEx(RECV_MAX,EventTab,FALSE,WaitTime,FALSE);
	if(i==WAIT_FAILED) return SYSERR;
	
	if(i==WAIT_TIMEOUT) 
	{
		//pDlg->m_ctlList.AddString("Time Out!!!");

		return SYSERR;
		
	}

	for(j=0;j<RECV_MAX;j++) 
		if(EventTab[i]==RecvTab[j].hEvent) break;
	k=j;

	if(RecvTab[k].Type==READ&&RecvTab[k].Active==TRUE) {	/* read complete */
		GetOverlappedResult(hVxD,&RecvTab[k].Overlap,&RecvTab[k].Length,FALSE);
		if(RecvTab[k].Length>BUFFER_SIZE) RecvTab[k].Length=BUFFER_SIZE;
		memcpy((void *)pbuf,(void *)RecvTab[k].Buffer,RecvTab[k].Length);
		len=(unsigned short)RecvTab[k].Length;
		CloseHandle(RecvTab[k].hEvent);
		for(j=i;j<RECV_MAX-1;i++) 
			EventTab[i]=EventTab[++j];			
		hEvent=CreateEvent(0, TRUE, 0, NULL);
		if(!hEvent) {
			AfxMessageBox("Can not create event\n");
			return SYSERR;
		}
		RecvTab[k].hEvent=hEvent;
		memset(RecvTab[k].Buffer,0,BUFFER_SIZE);
		RecvTab[k].Size=BUFFER_SIZE;
		RecvTab[k].Active=TRUE;
		RecvTab[k].Type=READ;
		EventTab[RECV_MAX-1]=hEvent;
		RecvStart(hVxD,&RecvTab[k]);
		return len;
	}
	else return SYSERR;	
}

WORD SendPacket(HANDLE hVxD,BYTE *pbuf,WORD len)
{
	static struct PacketTable SendTab;
	HANDLE hEvent;

	hEvent=CreateEvent(0, TRUE, 0, NULL);
	if(!hEvent) {
		AfxMessageBox("Can not create event\n");
		return SYSERR;
	}
	SendTab.hEvent=hEvent;
	memcpy(SendTab.Buffer,(void *)pbuf,len);
	SendTab.Size=len;
	SendTab.Length=BUFFER_SIZE;
	SendTab.Active=TRUE;
	SendTab.Type=WRITE;
	SendStart(hVxD,&SendTab);

	GetOverlappedResult(hVxD,&SendTab.Overlap,&SendTab.Length,TRUE);
	return OK;	
}

WORD CheckSum(WORD *addr,WORD len)
{
	DWORD lSum;
	WORD wOddByte;
	WORD wAnswer; 

	lSum=0l;

	while(len>1) {
		lSum+= *addr++;
		len-=2;
	}

	if(len==1) {
		wOddByte=0;
		*((unsigned char*)&wOddByte)=*(unsigned char*)addr;
		lSum+=wOddByte;
	}

	lSum=(lSum>>16)+(lSum&0xffff);
	lSum+=(lSum>>16);
	wAnswer=(unsigned int)~lSum;

	return wAnswer;
}

WORD swaps(WORD net)
{
	WORD lo,hi;
	WORD host;

	lo=net&0xff;
	hi=net&0xff00;
	lo=lo<<8;
	hi=hi>>8;
	host=hi|lo;