packet32.c

Windows XP下的抓包程序实现

    dwVerInfoSize = GetFileVersionInfoSize(FileName, &dwVerHnd);
    if (dwVerInfoSize) 
	{
        lpstrVffInfo = GlobalAllocPtr(GMEM_MOVEABLE, dwVerInfoSize);
		if (lpstrVffInfo == NULL)
		{
			TRACE_PRINT("PacketGetFileVersion: failed to allocate memory");
			TRACE_EXIT("PacketGetFileVersion");
			return FALSE;
		}

		if(!GetFileVersionInfo(FileName, dwVerHnd, dwVerInfoSize, lpstrVffInfo)) 
		{
			TRACE_PRINT("PacketGetFileVersion: failed to call GetFileVersionInfo");
            GlobalFreePtr(lpstrVffInfo);
			TRACE_EXIT("PacketGetFileVersion");
			return FALSE;
		}

		// Read the list of languages and code pages.
		if(!VerQueryValue(lpstrVffInfo,	TEXT("\\VarFileInfo\\Translation"),	(LPVOID*)&lpTranslate, &cbTranslate))
		{
			TRACE_PRINT("PacketGetFileVersion: failed to call VerQueryValue");
            GlobalFreePtr(lpstrVffInfo);
			TRACE_EXIT("PacketGetFileVersion");
			return FALSE;
		}
		
		// Create the file version string for the first (i.e. the only one) language.
		StringCchPrintf(SubBlock,
			sizeof(SubBlock)/sizeof(SubBlock[0]),
			TEXT("\\StringFileInfo\\%04x%04x\\FileVersion"),
			(*lpTranslate).wLanguage,
			(*lpTranslate).wCodePage);
		
		// Retrieve the file version string for the language.
		if(!VerQueryValue(lpstrVffInfo, SubBlock, &lpBuffer, &dwBytes))
		{
			TRACE_PRINT("PacketGetFileVersion: failed to call VerQueryValue");
            GlobalFreePtr(lpstrVffInfo);
			TRACE_EXIT("PacketGetFileVersion");
			return FALSE;
		}

		// Convert to ASCII
		TmpStr = WChar2SChar(lpBuffer);

		if(strlen(TmpStr) >= VersionBuffLen)
		{
			TRACE_PRINT("PacketGetFileVersion: Input buffer too small");
            GlobalFreePtr(lpstrVffInfo);
            GlobalFreePtr(TmpStr);
			TRACE_EXIT("PacketGetFileVersion");
			return FALSE;
		}

		StringCchCopyA(VersionBuff, VersionBuffLen, TmpStr);

        GlobalFreePtr(lpstrVffInfo);
        GlobalFreePtr(TmpStr);
		
	  } 
	else 
	{
		TRACE_PRINT1("PacketGetFileVersion: failed to call GetFileVersionInfoSize, LastError = %8.8x", GetLastError());
		TRACE_EXIT("PacketGetFileVersion");
		return FALSE;
	
	} 
	
	TRACE_EXIT("PacketGetFileVersion");
	return TRUE;
}

/*! 
  \brief Opens an adapter using the NPF device driver.
  \param AdapterName A string containing the name of the device to open. 
  \return If the function succeeds, the return value is the pointer to a properly initialized ADAPTER object,
   otherwise the return value is NULL.

  \note internal function used by PacketOpenAdapter() and AddAdapter()
*/
LPADAPTER PacketOpenAdapterNPF(PCHAR AdapterNameA)
{
    LPADAPTER lpAdapter;
    BOOL Result;
	DWORD error;
	SC_HANDLE svcHandle = NULL;
	SC_HANDLE scmHandle = NULL;
	LONG KeyRes;
	HKEY PathKey;
	SERVICE_STATUS SStat;
	BOOL QuerySStat;
	CHAR SymbolicLinkA[MAX_PATH];
//  
//	Old registry based WinPcap names
//
//	CHAR	NpfDriverName[MAX_WINPCAP_KEY_CHARS];
//	UINT	RegQueryLen;

	CHAR	NpfDriverName[MAX_WINPCAP_KEY_CHARS] = NPF_DRIVER_NAME;
	CHAR	NpfServiceLocation[MAX_WINPCAP_KEY_CHARS];

	// Create the NPF device name from the original device name
	TRACE_ENTER("PacketOpenAdapterNPF");
	
	TRACE_PRINT1("Trying to open adapter %s", AdapterNameA);

	scmHandle = OpenSCManager(NULL, NULL, GENERIC_READ);
		
	if(scmHandle == NULL)
	{
		error = GetLastError();
		TRACE_PRINT1("OpenSCManager failed! LastError=%8.8x", error);
	}
	else
	{
//  
//	Old registry based WinPcap names
//
//		RegQueryLen = sizeof(NpfDriverName)/sizeof(NpfDriverName[0]);
//		if (QueryWinPcapRegistryStringA(NPF_DRIVER_NAME_REG_KEY, NpfDriverName, &RegQueryLen, NPF_DRIVER_NAME) == FALSE && RegQueryLen == 0)
//		{
//			//just use an empty string string for the service name
//			NpfDriverName[0] = '\0';
//		}
		
		//
		// Create the name of the registry key containing the service.
		//
		StringCchPrintfA(NpfServiceLocation, sizeof(NpfServiceLocation), "SYSTEM\\CurrentControlSet\\Services\\%s", NpfDriverName);

		// check if the NPF registry key is already present
		// this means that the driver is already installed and that we don't need to call PacketInstallDriver
		KeyRes=RegOpenKeyExA(HKEY_LOCAL_MACHINE,
			NpfServiceLocation,
			0,
			KEY_READ,
			&PathKey);
		
		if(KeyRes != ERROR_SUCCESS)
		{
 			TRACE_PRINT("NPF registry key not present, trying to install the driver.");
			Result = PacketInstallDriver();
		}
		else
		{
 			TRACE_PRINT("NPF registry key present, driver is installed.");
			Result = TRUE;
			RegCloseKey(PathKey);
		}
		
		if (Result) 
		{
 			TRACE_PRINT("Trying to see if the NPF service is running...");
			svcHandle = OpenServiceA(scmHandle, NpfDriverName, SERVICE_START | SERVICE_QUERY_STATUS );

			if (svcHandle != NULL)
			{
				QuerySStat = QueryServiceStatus(svcHandle, &SStat);
				
#ifdef _DBG				
				switch (SStat.dwCurrentState)
				{
				case SERVICE_CONTINUE_PENDING:
					TRACE_PRINT("The status of the driver is: SERVICE_CONTINUE_PENDING");
					break;
				case SERVICE_PAUSE_PENDING:
					TRACE_PRINT("The status of the driver is: SERVICE_PAUSE_PENDING");
					break;
				case SERVICE_PAUSED:
					TRACE_PRINT("The status of the driver is: SERVICE_PAUSED");
					break;
				case SERVICE_RUNNING:
					TRACE_PRINT("The status of the driver is: SERVICE_RUNNING");
					break;
				case SERVICE_START_PENDING:
					TRACE_PRINT("The status of the driver is: SERVICE_START_PENDING");
					break;
				case SERVICE_STOP_PENDING:
					TRACE_PRINT("The status of the driver is: SERVICE_STOP_PENDING");
					break;
				case SERVICE_STOPPED:
					TRACE_PRINT("The status of the driver is: SERVICE_STOPPED");
					break;

				default:
					TRACE_PRINT("The status of the driver is: unknown");
					break;
				}
#endif

				if(!QuerySStat || SStat.dwCurrentState != SERVICE_RUNNING)
				{
					TRACE_PRINT("Driver NPF not running. Calling startservice");
					if (StartService(svcHandle, 0, NULL)==0)
					{ 
						error = GetLastError();
						if(error!=ERROR_SERVICE_ALREADY_RUNNING && error!=ERROR_ALREADY_EXISTS)
						{
							SetLastError(error);
							if (scmHandle != NULL) 
								CloseServiceHandle(scmHandle);
							error = GetLastError();
							TRACE_PRINT1("PacketOpenAdapterNPF: StartService failed, LastError=%8.8x",error);
							TRACE_EXIT("PacketOpenAdapterNPF");
							SetLastError(error);
							return NULL;
						}
					}				
				}

				CloseServiceHandle( svcHandle );
       			svcHandle = NULL;

			}
			else
			{
				error = GetLastError();
				TRACE_PRINT1("OpenService failed! Error=%8.8x", error);
				SetLastError(error);
			}
		}
		else
		{
			if(KeyRes != ERROR_SUCCESS)
				Result = PacketInstallDriver();
			else
				Result = TRUE;
			
			if (Result) {
				
				svcHandle = OpenServiceA(scmHandle,
					NpfDriverName,
					SERVICE_START);
				if (svcHandle != NULL)
				{
					
					QuerySStat = QueryServiceStatus(svcHandle, &SStat);

#ifdef _DBG
					switch (SStat.dwCurrentState)
					{
					case SERVICE_CONTINUE_PENDING:
						TRACE_PRINT("The status of the driver is: SERVICE_CONTINUE_PENDING");
						break;
					case SERVICE_PAUSE_PENDING:
						TRACE_PRINT("The status of the driver is: SERVICE_PAUSE_PENDING");
						break;
					case SERVICE_PAUSED:
						TRACE_PRINT("The status of the driver is: SERVICE_PAUSED");
						break;
					case SERVICE_RUNNING:
						TRACE_PRINT("The status of the driver is: SERVICE_RUNNING");
						break;
					case SERVICE_START_PENDING:
						TRACE_PRINT("The status of the driver is: SERVICE_START_PENDING");
						break;
					case SERVICE_STOP_PENDING:
						TRACE_PRINT("The status of the driver is: SERVICE_STOP_PENDING");
						break;
					case SERVICE_STOPPED:
						TRACE_PRINT("The status of the driver is: SERVICE_STOPPED");
						break;

					default:
						TRACE_PRINT("The status of the driver is: unknown");
						break;
					}
#endif
					
					if(!QuerySStat || SStat.dwCurrentState != SERVICE_RUNNING){
						
						TRACE_PRINT("Calling startservice");
						
						if (StartService(svcHandle, 0, NULL)==0){ 
							error = GetLastError();
							if(error!=ERROR_SERVICE_ALREADY_RUNNING && error!=ERROR_ALREADY_EXISTS)
							{
								if (scmHandle != NULL) CloseServiceHandle(scmHandle);
								TRACE_PRINT1("PacketOpenAdapterNPF: StartService failed, LastError=%8.8x",error);
								TRACE_EXIT("PacketOpenAdapterNPF");
								SetLastError(error);
								return NULL;
							}
						}
					}
				    
					CloseServiceHandle( svcHandle );
					svcHandle = NULL;

				}
				else{
					error = GetLastError();
					TRACE_PRINT1("OpenService failed! LastError=%8.8x", error);
					SetLastError(error);
				}
			}
		}
	}

    if (scmHandle != NULL) CloseServiceHandle(scmHandle);

	lpAdapter=(LPADAPTER)GlobalAllocPtr(GMEM_MOVEABLE | GMEM_ZEROINIT, sizeof(ADAPTER));
	if (lpAdapter==NULL)
	{
		TRACE_PRINT("PacketOpenAdapterNPF: GlobalAlloc Failed to allocate the ADAPTER structure");
		error=GetLastError();
		//set the error to the one on which we failed
		TRACE_EXIT("PacketOpenAdapterNPF");
		SetLastError(error);
		return NULL;
	}

	lpAdapter->NumWrites=1;

#define DEVICE_PREFIX "\\Device\\"

	if (LOWORD(GetVersion()) == 4)
	{
		if (strlen(AdapterNameA) > strlen(DEVICE_PREFIX))
		{
			StringCchPrintfA(SymbolicLinkA, MAX_PATH, "\\\\.\\%s", AdapterNameA + strlen(DEVICE_PREFIX));
		}
		else
		{
			ZeroMemory(SymbolicLinkA, sizeof(SymbolicLinkA));
		}
	}
 	else
	{
		if (strlen(AdapterNameA) > strlen(DEVICE_PREFIX))
		{
			StringCchPrintfA(SymbolicLinkA, MAX_PATH, "\\\\.\\Global\\%s", AdapterNameA + strlen(DEVICE_PREFIX));
		}
		else
		{
			ZeroMemory(SymbolicLinkA, sizeof(SymbolicLinkA));
		}
	}

	//
	// NOTE GV 20061114 This is a sort of breaking change. In the past we were putting what
	// we could fit inside this variable. Now we simply put NOTHING. It's just useless
	//
	ZeroMemory(lpAdapter->SymbolicLink, sizeof(lpAdapter->SymbolicLink));

	//try if it is possible to open the adapter immediately
	lpAdapter->hFile=CreateFileA(SymbolicLinkA,GENERIC_WRITE | GENERIC_READ,
		0,NULL,OPEN_EXISTING,0,0);
	
	if (lpAdapter->hFile != INVALID_HANDLE_VALUE) 
	{

		if(PacketSetReadEvt(lpAdapter)==FALSE){
			error=GetLastError();
			TRACE_PRINT("PacketOpenAdapterNPF: Unable to open the read event");
			CloseHandle(lpAdapter->hFile);
			GlobalFreePtr(lpAdapter);
			//set the error to the one on which we failed
		    
			TRACE_PRINT1("PacketOpenAdapterNPF: PacketSetReadEvt failed, LastError=%8.8x",error);
			TRACE_EXIT("PacketOpenAdapterNPF");


			SetLastError(error);
			return NULL;
		}		
		
		PacketSetMaxLookaheadsize(lpAdapter);

		//
		// Indicate that this is a device managed by NPF.sys
		//
		lpAdapter->Flags = INFO_FLAG_NDIS_ADAPTER;


		StringCchCopyA(lpAdapter->Name, ADAPTER_NAME_LENGTH, AdapterNameA);

		TRACE_PRINT("Successfully opened adapter");
		TRACE_EXIT("PacketOpenAdapterNPF");
		return lpAdapter;
	}

	error=GetLastError();
	GlobalFreePtr(lpAdapter);
	//set the error to the one on which we failed
    TRACE_PRINT1("PacketOpenAdapterNPF: CreateFile failed, LastError= %8.8x",error);
	TRACE_EXIT("PacketOpenAdapterNPF");
	SetLastError(error);
	return NULL;
}

#ifdef HAVE_WANPACKET_API
static LPADAPTER PacketOpenAdapterWanPacket(PCHAR AdapterName)
{
	LPADAPTER lpAdapter = NULL;
	DWORD dwLastError = ERROR_SUCCESS;

	TRACE_ENTER("PacketOpenAdapterWanPacket");

	TRACE_PRINT("Opening a NDISWAN adapter...");

	do
	{
		//
		// This is a wan adapter. Open it using the netmon API
		//			
		lpAdapter = (LPADAPTER) GlobalAllocPtr(GMEM_MOVEABLE | GMEM_ZEROINIT,
			sizeof(ADAPTER));

		if (lpAdapter == NULL)
		{
			TRACE_PRINT("GlobalAlloc failed allocating memory for the ADAPTER structure. Failing (BAD_UNIT).");
			dwLastError = ERROR_NOT_ENOUGH_MEMORY;
			break;
		}

		lpAdapter->Flags = INFO_FLAG_NDISWAN_ADAPTER;

		TRACE_PRINT("Trying to open the Wan Adapter through WanPacket.dll...");

		// Open the adapter
		lpAdapter->pWanAdapter = WanPacketOpenAdapter();

		if (lpAdapter->pWanAdapter == NULL)
		{
			TRACE_PRINT("WanPacketOpenAdapter failed. Failing. (BAD_UNIT)");
			dwLastError = ERROR_BAD_UNIT;
			break;
		}

		StringCchCopyA(lpAdapter->Name, ADAPTER_NAME_LENGTH, AdapterName);

		lpAdapter->ReadEvent = WanPacketGetReadEvent(lpAdapter->pWanAdapter);

		TRACE_PRINT("Successfully opened the Wan Adapter.");

	}while(FALSE);

	if (dwLastError == ERROR_SUCCESS)
	{
		TRACE_EXIT("PacketOpenAdapterWanPacket");
		return lpAdapter;
	}
	else
	{
		if (lpAdapter != NULL) GlobalFree(lpAdapter);
		
		TRACE_EXIT("PacketOpenAdapterWanPacket");
		SetLastError(dwLastError);
		return NULL;
	}
}
#endif //HAVE_WANPACKET_API

/*! 
  \brief Opens an adapter using the aircap dll.
  \param AdapterName A string containing the name of the device to open. 
  \return If the function succeeds, the return value is the pointer to a properly initialized ADAPTER object,
   otherwise the return value is NULL.

  \note internal function used by PacketOpenAdapter()
*/
#ifdef HAVE_AIRPCAP_API
static LPADAPTER PacketOpenAdapterAirpcap(PCHAR AdapterName)
{