modmain.bas

入侵检测是近几年发展起来的新型网络安全策略

                        .ProcInfo.lProcID = 0
                        .lRemotePort = GetTcpPortNumber(TcpTable.Table(X).dwRemotePort)
                        .sLocalAddr = GetIpFromLong(TcpTable.Table(X).dwLocalAddr)
                        .sRemoteAddr = GetIpFromLong(TcpTable.Table(X).dwRemoteAddr)
                        .sState = GetState(TcpTable.Table(X).dwState)
                        .Direction = IIf(.lLocalPort = .lRemotePort And .lLocalPort <> 0, Incoming, Outgoing)
                        .bTCP = True
                        .Row = TcpTable.Table(X)
                    End With
                Else
                    If Not (GetIpFromLong(TcpTable.Table(X).dwLocalAddr) = "0.0.0.0" Or GetIpFromLong(TcpTable.Table(X).dwLocalAddr) = "127.0.0.1") Then
                        lReturn = C_UBound(p_TcpConnections) + 1
                        ReDim Preserve p_TcpConnections(lReturn)
                        With p_TcpConnections(lReturn)
                            .Direction = IIf(.lLocalPort = .lRemotePort And .lLocalPort <> 0, Incoming, Outgoing)
                            .lLocalPort = GetTcpPortNumber(TcpTable.Table(X).dwLocalPort)
                            .ProcInfo.lProcID = 0
                            .lRemotePort = GetTcpPortNumber(TcpTable.Table(X).dwRemotePort)
                            .sLocalAddr = GetIpFromLong(TcpTable.Table(X).dwLocalAddr)
                            .sRemoteAddr = GetIpFromLong(TcpTable.Table(X).dwRemoteAddr)
                            .sState = GetState(TcpTable.Table(X).dwState)
                            .bTCP = True
                            .Direction = IIf(.lLocalPort = .lRemotePort And .lLocalPort <> 0, Incoming, Outgoing)
                            .Row = TcpTable.Table(X)
                        End With
                    End If
                End If
            Next
            g_TcpConnections = p_TcpConnections
            Erase p_TcpConnections
            GetTCPConnections = True
        Else
            GetTCPConnections = False
        End If
    End If
End Function
Public Function GetUDPConnections(Optional bShowAll As Boolean = False) As Boolean
    Dim lReturn                     As Long
    Dim lSize                       As Long
    Dim lAddr                       As Long
    Dim lRows                       As Long
    Dim X                           As Long
    Dim rRowXP                      As MIB_UDPEXROW
    Dim rRow                        As MIB_UDPROW
    Dim TcpTable                    As MIB_UDPTABLE
    Dim p_UdpConnections()          As tConnectionType
    If g_bXPTable = True Then
        lReturn = AllocateAndGetUdpExTableFromStack(lAddr, True, GetProcessHeap, 2, 2)
            'We pass in a Long to the function, even though C++ would use the actual type structure.
            'This is because C++ uses a memory pointer to the location of the type struct in memory, VB does not, it uses safe arrays, so it fecks this up
            'And ends up returning over 2000000 for the count of items.
            'By doing it this way ,it's gonna receive a pointer to the table *allocated by the function*.
            'Thanks to...
        If lReturn = ERROR_SUCCESS Then 'If succeed...
            CopyMemory lSize, ByVal lAddr, 4 'Get number of entries.
            If bShowAll = True Then ReDim p_UdpConnections(lSize) 'If we are showing them all, might as well redimension the array here.
            For X = 0 To lSize - 1 'Loop through array.
                If cGetInputState(QS_ALLEVENTS) <> 0 Then DoEvents
                If bShowAll = True Then
                    CopyMemory rRowXP, ByVal (lAddr + 4 + X * LenB(rRowXP)), LenB(rRowXP) 'Copy each table individually.
                        'The memory location is calculated by lAddr + 4 + (Size of a Row * Number of rows already done)
                    With p_UdpConnections(X)
                        .lLocalPort = GetTcpPortNumber(rRowXP.dwLocalPort)  'Local Port
                        .ProcInfo.lProcID = rRowXP.dwProcessId 'Process ID
                        .ProcInfo.sPath = Proc_Path(rRowXP.dwProcessId)
                        .ProcInfo.sUser = Proc_UserName(rRowXP.dwProcessId)
                        '.lRemotePort = GetTcpPortNumber(rRowXP.dwRemotePort) 'Remote Port
                        .sLocalAddr = GetIpFromLong(rRowXP.dwLocalAddr) 'Local Host Address
                        '.sRemoteAddr = GetIpFromLong(rRowXP.dwRemoteAddr) 'Remote Host Address
                        '.sState = GetState(rRowXP.dwState) 'State of Connection
                        .bTCP = False
                    End With
                Else
                    'Same as in the last one but we only add ones that do not have..
                    'a Local Address of 0.0.0.0 and 127.0.0.1
                    CopyMemory rRowXP, ByVal (lAddr + 4 + X * LenB(rRowXP)), LenB(rRowXP)
                    If Not (GetIpFromLong(rRowXP.dwLocalAddr) = "0.0.0.0" Or GetIpFromLong(rRowXP.dwLocalAddr) = "127.0.0.1") Then
                        lReturn = C_UBound(p_UdpConnections) + 1
                        ReDim Preserve p_UdpConnections(lReturn)
                        With p_UdpConnections(lReturn)
                            .lLocalPort = GetTcpPortNumber(rRowXP.dwLocalPort)
                            '.lRemotePort = GetTcpPortNumber(rRowXP.dwRemotePort)
                            .ProcInfo.lProcID = rRowXP.dwProcessId
                            .ProcInfo.sPath = Proc_Path(rRowXP.dwProcessId)
                            .ProcInfo.sUser = Proc_UserName(rRowXP.dwProcessId)
                            .sLocalAddr = GetIpFromLong(rRowXP.dwLocalAddr)
                            '.sRemoteAddr = GetIpFromLong(rRowXP.dwRemoteAddr)
                            '.sState = GetState(rRowXP.dwState)
                            .bTCP = False
                        End With
                    End If
                End If
            Next
            g_UdpConnections = p_UdpConnections
            Erase p_UdpConnections
            GetUDPConnections = True
        Else
            GetUDPConnections = False
        End If
    Else
        'This function does the exact same as the last, except it doesn't return ProcessIDs.
        lReturn = GetUdpTable(TcpTable, Len(TcpTable), 0) 'Get the TcpTable (Without Process IDs)
        If lReturn = ERROR_SUCCESS Then 'Sucess ?
            If bShowAll = True Then ReDim p_UdpConnections(TcpTable.dwNumEntries) 'Redimensionalise the array.
            For X = 0 To TcpTable.dwNumEntries 'Loop through the Table.
                If cGetInputState(QS_ALLEVENTS) <> 0 Then DoEvents
                If bShowAll = True Then 'All connections ?
                    With p_UdpConnections(X)
                        .lLocalPort = GetTcpPortNumber(TcpTable.Table(X).dwLocalPort)
                        .ProcInfo.lProcID = 0 'We don't get one of these =(
                        '.lRemotePort = GetTcpPortNumber(TcpTable.Table(X).dwRemotePort)
                        .sLocalAddr = GetIpFromLong(TcpTable.Table(X).dwLocalAddr)
                        '.sRemoteAddr = GetIpFromLong(TcpTable.Table(X).dwRemoteAddr)
                        '.sState = GetState(TcpTable.Table(X).dwState)
                    End With
                Else
                    If Not (GetIpFromLong(TcpTable.Table(X).dwLocalAddr) = "0.0.0.0" Or GetIpFromLong(TcpTable.Table(X).dwLocalAddr) = "127.0.0.1") Then
                        lReturn = C_UBound(p_UdpConnections) + 1
                        ReDim Preserve p_UdpConnections(lReturn)
                        With p_UdpConnections(lReturn)
                            .lLocalPort = GetTcpPortNumber(TcpTable.Table(X).dwLocalPort)
                            .ProcInfo.lProcID = 0
                            '.lRemotePort = GetTcpPortNumber(TcpTable.Table(X).dwRemotePort)
                            .sLocalAddr = GetIpFromLong(TcpTable.Table(X).dwLocalAddr)
                            '.sRemoteAddr = GetIpFromLong(TcpTable.Table(X).dwRemoteAddr)
                            '.sState = GetState(TcpTable.Table(X).dwState)
                        End With
                    End If
                End If
            Next
            g_UdpConnections = p_UdpConnections
            Erase p_UdpConnections
            GetUDPConnections = True
        Else
            GetUDPConnections = False
        End If
    End If
End Function
Public Function CloseConnection(Connection As MIB_TCPROW) As Boolean
    'Debug.Print "************************************"
    'Debug.Print ""
    'Debug.Print "Local Address : " & Connection.dwLocalAddr
    'Debug.Print "Local Port : " & Connection.dwLocalPort
    'Debug.Print "Remote Address : " & Connection.dwRemoteAddr
    'Debug.Print "Remote Port : " & Connection.dwRemotePort
    'Debug.Print "State : " & Connection.dwState
    'Debug.Print ""
    'Debug.Print "************************************"
    Connection.dwState = TCP_STATE_DELETE_TCB
    If SetTcpEntry(Connection) = ERROR_SUCCESS Then
        FrmMain.lblStatus.Caption = "状态 : 成功关闭连接."
    Else
        FrmMain.lblStatus.Caption = "状态 : 无法关闭连接!"
    End If
End Function
Private Function GetIpFromLong(lngIPAddress As Long) As String
    Dim arrIpParts(3)               As Byte
    CopyMemory arrIpParts(0), lngIPAddress, 4 'This is a pointer to the memory address, so get it !
    GetIpFromLong = CStr(arrIpParts(0)) & "." & CStr(arrIpParts(1)) & "." & CStr(arrIpParts(2)) & "." & CStr(arrIpParts(3))
End Function
Private Function GetTcpPortNumber(DWord As Long) As Long
    GetTcpPortNumber = DWord / 256 + (DWord Mod 256) * 256
End Function
Private Function GetState(lngState As Long) As String
    Select Case lngState
        Case TCP_STATE_CLOSED: GetState = "CLOSED"
        Case TCP_STATE_LISTEN: GetState = "LISTEN"
        Case TCP_STATE_SYN_SENT: GetState = "SYN_SENT"
        Case TCP_STATE_SYN_RCVD: GetState = "SYN_RCVD"
        Case TCP_STATE_ESTAB: GetState = "ESTAB"
        Case TCP_STATE_FIN_WAIT1: GetState = "FIN_WAIT1"
        Case TCP_STATE_FIN_WAIT2: GetState = "FIN_WAIT2"
        Case TCP_STATE_CLOSE_WAIT: GetState = "CLOSE_WAIT"
        Case TCP_STATE_CLOSING: GetState = "CLOSING"
        Case TCP_STATE_LAST_ACK: GetState = "LAST_ACK"
        Case TCP_STATE_TIME_WAIT: GetState = "TIME_WAIT"
        Case TCP_STATE_DELETE_TCB: GetState = "DELETE_TCB"
    End Select
End Function
Public Function C_UBound(aArr() As tConnectionType) As Long
    On Error GoTo ErrClear
    'Nice function to have, instead of trying to handle an error during your functions...
    'Why not just get -1 for an un-initialised array ?
    'As long as you're not using sub 0 lower bound arrays it should be fine.
    C_UBound = UBound(aArr)
    Exit Function
ErrClear:
    C_UBound = -1
    Err.Clear
End Function