main.pas

一个SNOOP控件,各位看看可以对网络包进行分析.

unit Main;

interface

uses
  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
  StdCtrls, WinSock, ComCtrls, ExtCtrls, IniFiles, Snoop, Buttons;

type
  TMainForm = class(TForm)
	cbxAdapter: TComboBox;
	btnOpen: TButton;
	btnClose: TButton;
	SnoopTCP1: TSnoopTCP;
	ListView1: TListView;
	btnClear: TButton;
	edFilter: TEdit;
	Label1: TLabel;
	sbtFilter: TSpeedButton;
	procedure FormCreate(Sender: TObject);
	procedure FormShow(Sender: TObject);
	procedure FormClose(Sender: TObject; var Action: TCloseAction);
	procedure btnOpenClick(Sender: TObject);
	procedure btnCloseClick(Sender: TObject);
	procedure btnClearClick(Sender: TObject);
	procedure sbtFilterClick(Sender: TObject);
	procedure SnoopTCP1CaptureTCP(Sender: TObject;
	  PacketHeader: PPCAP_PKTHDR; EthernetHeader: PETHERNET_HDR;
	  IPHeader: PIP_HDR; TCPHeader: PTCP_HDR);
  private
	{ Private declarations }
	procedure LoadControl;
	procedure SaveControl;
	procedure SetControl;
  public
	{ Public declarations }
  end;

var
  MainForm: TMainForm;

implementation

uses Flag;

{$R *.DFM}

procedure TMainForm.LoadControl;
var
	IniFile: TIniFile;
begin
	IniFile := TIniFile.Create(ExtractFilePath(Application.ExeName) + 'TCPFlag.ini');
	Left := IniFile.ReadInteger('Coordination', 'Left', 0);
	Top := IniFile.ReadInteger('Coordination', 'Top', 0);
	Height := IniFile.ReadInteger('Coordination', 'Height', Height);
	cbxAdapter.ItemIndex := IniFile.ReadInteger('WinPcap', 'AdapterIndex', -1);
	if cbxAdapter.ItemIndex = -1 then
		cbxAdapter.ItemIndex := 0;
	edFilter.Text := IniFile.ReadString('WinPcap', 'Filter', 'tcp[13]=2');
	with FlagForm do
	begin
		chkURGMask.Checked := IniFile.ReadBool('FlagMask', 'URG', false);
		chkACKMask.Checked := IniFile.ReadBool('FlagMask', 'ACK', false);
		chkPSHMask.Checked := IniFile.ReadBool('FlagMask', 'PSH', false);
		chkRSTMask.Checked := IniFile.ReadBool('FlagMask', 'RST', false);
		chkSYNMask.Checked := IniFile.ReadBool('FlagMask', 'SYN', true);
		chkFINMask.Checked := IniFile.ReadBool('FlagMask', 'FIN', false);
		chkURGValue.Checked := IniFile.ReadBool('FlagValue', 'URG', false);
		chkACKValue.Checked := IniFile.ReadBool('FlagValue', 'ACK', false);
		chkPSHValue.Checked := IniFile.ReadBool('FlagValue', 'PSH', false);
		chkRSTValue.Checked := IniFile.ReadBool('FlagValue', 'RST', false);
		chkSYNValue.Checked := IniFile.ReadBool('FlagValue', 'SYN', true);
		chkFINValue.Checked := IniFile.ReadBool('FlagValue', 'FIN', false);
	end;
	IniFile.Free;
end;

procedure TMainForm.SaveControl;
var
	IniFile: TIniFile;
begin
	IniFile := TIniFile.Create(ExtractFilePath(Application.ExeName) + 'TCPFlag.ini');
	try
		IniFile.WriteInteger('Coordination', 'Left', Left);
		IniFile.WriteInteger('Coordination', 'Top', Top);
		IniFile.WriteInteger('Coordination', 'Height', Height);
		IniFile.WriteInteger('WinPcap', 'AdapterIndex', cbxAdapter.ItemIndex);
		IniFile.WriteString('WinPcap', 'Filter', edFilter.Text);
		with FlagForm do
		begin
			IniFile.WriteBool('FlagMask', 'URG', chkURGMask.Checked);
			IniFile.WriteBool('FlagMask', 'ACK', chkACKMask.Checked);
			IniFile.WriteBool('FlagMask', 'PSH', chkPSHMask.Checked);
			IniFile.WriteBool('FlagMask', 'RST', chkRSTMask.Checked);
			IniFile.WriteBool('FlagMask', 'SYN', chkSYNMask.Checked);
			IniFile.WriteBool('FlagMask', 'FIN', chkFINMask.Checked);
			IniFile.WriteBool('FlagValue', 'URG', chkURGValue.Checked);
			IniFile.WriteBool('FlagValue', 'ACK', chkACKValue.Checked);
			IniFile.WriteBool('FlagValue', 'PSH', chkPSHValue.Checked);
			IniFile.WriteBool('FlagValue', 'RST', chkRSTValue.Checked);
			IniFile.WriteBool('FlagValue', 'SYN', chkSYNValue.Checked);
			IniFile.WriteBool('FlagValue', 'FIN', chkFINValue.Checked);
		end;
	finally
		IniFile.Free;
	end;
end;

procedure TMainForm.SetControl;
var
	Active: Boolean;
begin
	Active := SnoopTCP1.Active;
	cbxAdapter.Enabled := not Active;
	btnOpen.Enabled := not Active;
	btnClose.Enabled := Active;
end;

procedure TMainForm.FormCreate(Sender: TObject);
begin
	cbxAdapter.Items := SnoopTCP1.AdapterDescriptions;
	ListView1.Anchors := ListView1.Anchors + [akRight, akBottom];
end;

procedure TMainForm.FormShow(Sender: TObject);
begin
	LoadControl;
	SetControl;
end;

procedure TMainForm.FormClose(Sender: TObject; var Action: TCloseAction);
begin
	SaveControl;
end;

procedure TMainForm.btnOpenClick(Sender: TObject);
begin
	SnoopTCP1.AdapterIndex := cbxAdapter.ItemIndex;
	SnoopTCP1.Filter := edFilter.Text;
	SnoopTCP1.Open;
	if not SnoopTCP1.Active then
	begin
		ShowMessage(SnoopTCP1.Error);
		exit;
	end;
	SetControl;
end;

procedure TMainForm.btnCloseClick(Sender: TObject);
begin
	SnoopTCP1.Close;
	SetControl;
end;

procedure TMainForm.btnClearClick(Sender: TObject);
begin
	ListView1.Visible := false;
	ListView1.Items.Clear;
	ListView1.Visible := true;
end;

procedure TMainForm.sbtFilterClick(Sender: TObject);
begin
	FlagForm.ShowModal;
	if FlagForm.ModalResult = mrOk then
		edFilter.Text := Format('tcp[13]&0x%x=0x%x', [FlagForm.GetMask, FlagForm.GetValue]);
end;

procedure TMainForm.SnoopTCP1CaptureTCP(Sender: TObject;
  PacketHeader: PPCAP_PKTHDR; EthernetHeader: PETHERNET_HDR;
  IPHeader: PIP_HDR; TCPHeader: PTCP_HDR);
var
	SourceIP: String;
	DestinationIP: String;
	SourcePort: Integer;
	DestinationPort: Integer;
	ListItem: TListItem;
begin
	SourceIP := snoopIP2Str(ntohl(IPHeader.Source));
	DestinationIP := snoopIP2Str(ntohl(IPHeader.Destination));
	SourcePort := ntohs(TCPHeader.Source);
	DestinationPort := ntohs(TCPHeader.Destination);
	ListItem := ListView1.Items.Add;
	ListItem.Caption := SourceIP;
	ListItem.SubItems.Add(DestinationIP);
	ListItem.SubItems.Add(IntToStr(SourcePort));
	ListItem.SubItems.Add(IntToStr(DestinationPort));
end;

end.