分享
 
 
 

我也贴一篇:WIN2K命令行GUNiffer的源码(包括mstcpip.h)

王朝vc·作者佚名  2006-01-08
窄屏简体版  字體: |||超大  

GUNiffer.cpp文件:

//////////////////////////////////////////////////////////////////////////

// //

// GUNiffer For Win2K by Shotgun //

// //

// Version: 0.30 Beta //

// Released: [2001.4] //

// Author: [Shotgun] //

// Homepage: //

// [http://IT.Xici.Net] //

// [http://www.Patching.Net] //

// //

//////////////////////////////////////////////////////////////////////////

#include <math.h>

#include <stdio.h>

#include <string.h>

#include <Winsock2.h>

#include <mstcpip.h>

#define STATUS_FAILED 0xFFFF file://定义异常出错代码

#define MAX_PACK_LEN 65535 file://接收的最大IP报文

#define MAX_ADDR_LEN 16 file://点分十进制地址的最大长度

#define MAX_PROTO_TEXT_LEN 16 file://子协议名称(如"TCP")最大长度

#define MAX_PROTO_NUM 12 file://子协议数量

#define MAX_HOSTNAME_LAN 255 file://最大主机名长度

#define CMD_PARAM_HELP true

typedef struct _iphdr

{

unsigned char h_lenver; file://4位首部长度+4位IP版本号

unsigned char tos; file://8位服务类型TOS

unsigned short total_len; file://16位总长度(字节)

unsigned short ident; file://16位标识

unsigned short frag_and_flags; file://3位标志位

unsigned char ttl; file://8位生存时间 TTL

unsigned char proto; file://8位协议 (TCP, UDP 或其他)

unsigned short checksum; file://16位IP首部校验和

unsigned int sourceIP; file://32位源IP地址

unsigned int destIP; file://32位目的IP地址

}IP_HEADER;

typedef struct _tcphdr file://定义TCP首部

{

USHORT th_sport; file://16位源端口

USHORT th_dport; file://16位目的端口

unsigned int th_seq; file://32位序列号

unsigned int th_ack; file://32位确认号

unsigned char th_lenres; file://4位首部长度/6位保留字

unsigned char th_flag; file://6位标志位

USHORT th_win; file://16位窗口大小

USHORT th_sum; file://16位校验和

USHORT th_urp; file://16位紧急数据偏移量

}TCP_HEADER;

typedef struct _udphdr file://定义UDP首部

{

unsigned short uh_sport; file://16位源端口

unsigned short uh_dport; file://16位目的端口

unsigned short uh_len; file://16位长度

unsigned short uh_sum; file://16位校验和

} UDP_HEADER;

typedef struct _icmphdr file://定义ICMP首部

{

BYTE i_type; file://8位类型

BYTE i_code; file://8位代码

USHORT i_cksum; file://16位校验和

USHORT i_id; file://识别号(一般用进程号作为识别号)

USHORT i_seq; file://报文序列号

ULONG timestamp; file://时间戳

}ICMP_HEADER;

typedef struct _protomap file://定义子协议映射表

{

int ProtoNum;

char ProtoText[MAX_PROTO_TEXT_LEN];

}PROTOMAP;

PROTOMAP ProtoMap[MAX_PROTO_NUM]={ file://为子协议映射表赋值

{ IPPROTO_IP , "IP " },

{ IPPROTO_ICMP , "ICMP" },

{ IPPROTO_IGMP , "IGMP" },

{ IPPROTO_GGP , "GGP " },

{ IPPROTO_TCP , "TCP " },

{ IPPROTO_PUP , "PUP " },

{ IPPROTO_UDP , "UDP " },

{ IPPROTO_IDP , "IDP " },

{ IPPROTO_ND , "NP " },

{ IPPROTO_RAW , "RAW " },

{ IPPROTO_MAX , "MAX " },

{ NULL , "" } };

SOCKET SockRaw;

char TcpFlag[6]={'F','S','R','P','A','U'}; file://定义TCP标志位

bool ParamTcp =false; // -t关注TCP 报文

bool ParamUdp =false; // -u关注UDP 报文

bool ParamIcmp =false; // -i关注ICMP报文

bool ParamDecode=false; // -d对协议进行解码

char *strFromIpFilter=NULL; // 源IP地址过滤

char *strDestIpFilter=NULL; // 目的地址过滤

char *strSensitive=NULL; // 敏感字符串

int iPortFilter=0; // 端口过滤

int iProtocol, iTTL;

char szProtocol[MAX_PROTO_TEXT_LEN];

char szSourceIP[MAX_ADDR_LEN], szDestIP[MAX_ADDR_LEN];

int DecodeIpPack(char *, int); file://IP解包函数

int DecodeTcpPack(char *, int); file://TCP解包函数

int DecodeUdpPack(char *, int); file://UDP解包函数

int DecodeIcmpPack(char *, int); file://ICMP解包函数

void CheckSockError(int, char*); file://出错处理函数

char * CheckProtocol(int); file://协议检查

void usage(void); file://使用说明

bool GetCmdLine(int, char **); file://命令行参数处理

void main(int argc, char ** argv)

{

int iErrorCode;

char RecvBuf[MAX_PACK_LEN] = {0};

usage();

if(GetCmdLine(argc, argv)==CMD_PARAM_HELP) exit(0);

file://初始化SOCKET

WSADATA wsaData;

iErrorCode = WSAStartup(MAKEWORD(2,1),&wsaData);

CheckSockError(iErrorCode, "WSAStartup");

SockRaw = socket(AF_INET , SOCK_RAW , IPPROTO_IP);

CheckSockError(SockRaw, "socket");

file://获取本机IP地址

char FAR name[MAX_HOSTNAME_LAN];

iErrorCode = gethostname(name, MAX_HOSTNAME_LAN);

CheckSockError(iErrorCode, "gethostname");

struct hostent FAR * pHostent;

pHostent = (struct hostent * )malloc(sizeof(struct hostent));

pHostent = gethostbyname(name);

SOCKADDR_IN sa;

sa.sin_family = AF_INET;

sa.sin_port = htons(6000);

memcpy(&sa.sin_addr.S_un.S_addr, pHostent->h_addr_list[0], pHostent->h_length);

free(pHostent);

iErrorCode = bind(SockRaw, (PSOCKADDR)&sa, sizeof(sa));

CheckSockError(iErrorCode, "bind");

file://设置SOCK_RAW为SIO_RCVALL,以便接收所有的IP包

DWORD dwBufferLen[10] ;

DWORD dwBufferInLen = 1 ;

DWORD dwBytesReturned = 0 ;

iErrorCode=WSAIoctl(SockRaw, SIO_RCVALL,&dwBufferInLen, sizeof(dwBufferInLen),

&dwBufferLen, sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL );

CheckSockError(iErrorCode, "Ioctl");

file://侦听IP报文

while(1)

{

memset(RecvBuf, 0, sizeof(RecvBuf));

iErrorCode = recv(SockRaw, RecvBuf, sizeof(RecvBuf), 0);

CheckSockError(iErrorCode, "recv");

iErrorCode = DecodeIpPack(RecvBuf, iErrorCode);

CheckSockError(iErrorCode, "Decode");

}

}

file://IP解包程序

int DecodeIpPack(char *buf, int iBufSize)

{

IP_HEADER *pIpheader;

SOCKADDR_IN saSource, saDest;

pIpheader = (IP_HEADER *)buf;

file://协议甄别

iProtocol = pIpheader->proto;

strncpy(szProtocol, CheckProtocol(iProtocol), MAX_PROTO_TEXT_LEN);

if((iProtocol==IPPROTO_TCP) && (!ParamTcp)) return true;

if((iProtocol==IPPROTO_UDP) && (!ParamUdp)) return true;

if((iProtocol==IPPROTO_ICMP) && (!ParamIcmp)) return true;

file://源地址

saSource.sin_addr.s_addr = pIpheader->sourceIP;

strncpy(szSourceIP, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN);

if (strFromIpFilter)

if (strcmp(strFromIpFilter,szSourceIP)) return true;

file://目的地址

saDest.sin_addr.s_addr = pIpheader->destIP;

strncpy(szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN);

if (strDestIpFilter)

if (strcmp(strDestIpFilter,szDestIP)) return true;

iTTL = pIpheader->ttl;

file://计算IP首部的长度

int iIphLen = sizeof(unsigned long) * (pIpheader->h_lenver & 0xf);

file://根据协议类型分别调用相应的函数

switch(iProtocol)

{

case IPPROTO_TCP :DecodeTcpPack(buf+iIphLen, iBufSize);break;

case IPPROTO_UDP :DecodeUdpPack(buf+iIphLen, iBufSize);break;

case IPPROTO_ICMP :DecodeIcmpPack(buf+iIphLen, iBufSize);break;

default :break;

}

file://printf("\n");

return true;

}

file://协议识别程序

char * CheckProtocol(int iProtocol)

{

for(int i=0; i<MAX_PROTO_NUM; i++)

if(ProtoMap[i].ProtoNum==iProtocol)

return ProtoMap[i].ProtoText;

return "";

}

file://TCP解包程序

int DecodeTcpPack(char * TcpBuf, int iBufSize)

{

TCP_HEADER * pTcpHeader;

int i;

int iSourcePort,iDestPort;

pTcpHeader = (TCP_HEADER * )TcpBuf;

file://计算TCP首部长度

int TcpHeaderLen = pTcpHeader->th_lenres>>4;

TcpHeaderLen *= sizeof(unsigned long);

char * TcpData=TcpBuf+TcpHeaderLen;

file://如果过滤敏感字符串则判断是否包含

if (strSensitive)

if ((strstr(TcpData, strSensitive))==NULL) return true;

file://对端口进行过滤

iSourcePort = ntohs(pTcpHeader->th_sport);

iDestPort = ntohs(pTcpHeader->th_dport);

if ((iPortFilter) && (iSourcePort!=iPortFilter) && (iDestPort!=iPortFilter))

return true;

file://输

printf("%s ", szProtocol);

printf("%15s:%5d ->%15s:%5d ", szSourceIP, iSourcePort, szDestIP, iDestPort);

printf("TTL=%3d ", iTTL);

file://判断TCP标志位

unsigned char FlagMask = 1;

for( i=0; i<6; i++ )

{

if((pTcpHeader->th_flag) & FlagMask) printf("%c",TcpFlag[i]);

else printf("-");

FlagMask=FlagMask<<1;

}

printf(" bytes=%4d", iBufSize);

printf("\n");

file://对于长度大于40字节的包进行数据分析(IP_HEADER+TCP_HEADER=40)

if ((ParamDecode) && (iBufSize>40))

{

file://分析TCP数据段

if ((!strSensitive) || (strstr(TcpData,strSensitive)))

{

printf(" [DATA]\n");

printf("%s",TcpData);

printf("\n [DATA END]\n\n\n");

}

}

return true;

}

file://UDP解包程序

int DecodeUdpPack(char * UdpBuf, int iBufSize)

{

UDP_HEADER *pUdpHeader;

pUdpHeader = (UDP_HEADER * )UdpBuf;

int iSourcePort = ntohs(pUdpHeader->uh_sport);

int iDestPort = ntohs(pUdpHeader->uh_dport);

file://对端口进行过滤

if(iPortFilter)

if ((iSourcePort!=iPortFilter) && (iDestPort!=iPortFilter))

return true;

printf("%s ", szProtocol);

printf("%15s:%5d ->%15s:%5d ", szSourceIP, iSourcePort, szDestIP, iDestPort);

printf("TTL=%3d ", iTTL);

printf("Len=%4d ", ntohs(pUdpHeader->uh_len));

printf("bytes=%4d", iBufSize);

printf("\n");

file://对于长度大于28字节的包进行数据分析(IP_HEADER+UDP_HEADER>28)

if ((ParamDecode) && (iBufSize>28))

{

printf(" [DATA]\n");

file://UDP首部长度为8

char * UdpData=UdpBuf+8;

file://分析UDP数据段

for(unsigned int i=0;i<(iBufSize-sizeof(UDP_HEADER));i++)

{

if (!(i%8)) printf("\n");

if ( (UdpData[i]>33) && (UdpData[i]<122) )

printf("%3c [%3x]", UdpData[i], UdpData[i]);

else printf(" [%3x]", abs(UdpData[i]));

}

printf("\n [DATA END]\n\n\n");

}

return true;

}

file://ICMP解包程序

int DecodeIcmpPack(char * IcmpBuf, int iBufSize)

{

ICMP_HEADER * pIcmpHeader;

pIcmpHeader = (ICMP_HEADER * )IcmpBuf;

int iIcmpType = pIcmpHeader->i_type;

int iIcmpCode = pIcmpHeader->i_code;

file://对类型进行过滤

if ((iPortFilter) && (iIcmpType!=iPortFilter)) return true;

printf("%s ", szProtocol);

file://printf("%15s Type%d ->%15s Code%d ", szSourceIP, iIcmpType, szDestIP, iIcmpCode);

printf("%15s ->%15s ", szSourceIP, szDestIP);

printf("TTL=%3d ", iTTL);

printf("Type%2d,%d ",iIcmpType,iIcmpCode);

printf("bytes=%4d", iBufSize);

printf("\n");

file://对于包含数据段的包进行数据分析

if ((ParamDecode) && (iBufSize>28))

{

char * IcmpData=IcmpBuf+4;

file://分析ICMP数据段

printf(" [DATA]");

for(unsigned int i=0;i<(iBufSize-sizeof(ICMP_HEADER));i++)

{

if (!(i%8)) printf("\n");

if ( (IcmpData[i]>33) && (IcmpData[i]<122) )

printf("%3c [%3x]", IcmpData[i], IcmpData[i]);

else printf(" [%3x]", abs(IcmpData[i]));

}

printf("\n [DATA END]\n\n\n");

}

return true;

}

file://命令行参数处理

bool GetCmdLine(int argc, char ** argv)

{

if (argc<2) return CMD_PARAM_HELP;

for(int i=1;i<argc;i++)

{

if(argv[i][0]!='/') return CMD_PARAM_HELP;

else switch (argv[i][1])

{

case 't':

case 'T': ParamTcp=true; break;

case 'u':

case 'U': ParamUdp=true; break;

case 'i':

case 'I': ParamIcmp=true; break;

case 'p':

case 'P': ParamDecode=true; break;

case 'f':

case 'F':

{

strFromIpFilter=(char*)malloc(16*sizeof(char));

memset(strFromIpFilter,0,16*sizeof(char));

strcpy(strFromIpFilter,argv[i]+3);

break;

}

case 'd':

case 'D':

{

strDestIpFilter=(char*)malloc(16*sizeof(char));

memset(strDestIpFilter,0,16*sizeof(char));

strcpy(strDestIpFilter,argv[i]+3);

break;

}

case 's':

case 'S':

{

strSensitive=(char*)malloc(255*sizeof(char));

memset(strSensitive,0,255*sizeof(char));

strcpy(strSensitive,argv[i]+3);

break;

}

case 'o':

case 'O':

{

iPortFilter=atoi(argv[i]+3);

break;

}

}

}

printf("\nWill Sniffer");

if(ParamTcp) printf(" TCP");

if(ParamUdp) printf(" UDP");

if(ParamIcmp) printf(" ICMP");

if(strFromIpFilter) printf(" FromIp:%s",strFromIpFilter);

if(strDestIpFilter) printf(" DestIp:%s",strDestIpFilter);

if(ParamDecode) printf(" DECODE ON");

if(strSensitive) printf(" Sensitive String:'%s'",strSensitive);

printf("\n\tCTRL+C to quit\nStart:\n");

return (!CMD_PARAM_HELP);

}

file://使用说明

void usage(void)

{

printf("GUNiffer\n");

printf("\tSinffer for Win2K By Shotgun (Ver 0.3)\n");

printf("tShotgun@Xici.netn");

printf("\thttp://It.Xici.Net\n");

printf("\thttp://www.Patching.Net\n\n");

printf("USAGE:\n");

printf("\t/t Output TCP Packets\n");

printf("\t/u Output UDP Packets\n");

printf("\t/i Output ICMP Packets\n");

printf("\t/p Decode Packets (default OFF)\n");

printf("\t/f: fromIP Output Packets FromIp=fromIP (default ALL)\n");

printf("\t/d: destIP Output Packets DestIp=destIP (default ALL)\n");

printf("\t/s: string Output Packets Include sensitive String(TCP only)\n");

printf("\t/o: port Output Packets from or to the port(ICMP is TYPE)\n");

printf("Example:\n");

printf("\tGUNiffer.exe /d>GUNiffer.log\n");

printf("\tGUNiffer.exe /t /u /f:192.168.15.231\n");

printf("\tGUNiffer.exe /t /p /s:PASS\n");

}

file://SOCK错误处理程序

void CheckSockError(int iErrorCode, char *pErrorMsg)

{

if(iErrorCode==SOCKET_ERROR)

{

printf("%s Error:%d\n", pErrorMsg, GetLastError());

closesocket(SockRaw);

exit(0);

}

}

========================================================

以下是mstcpip.h文件:

// Copyright (C) Microsoft Corporation, 1996-1999

#if _MSC_VER > 1000

#pragma once

#endif

/* Argument structure for SIO_KEEPALIVE_VALS */

struct tcp_keepalive {

u_long onoff;

u_long keepalivetime;

u_long keepaliveinterval;

};

// New WSAIoctl Options

#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)

#define SIO_RCVALL_MCAST _WSAIOW(IOC_VENDOR,2)

#define SIO_RCVALL_IGMPMCAST _WSAIOW(IOC_VENDOR,3)

#define SIO_KEEPALIVE_VALS _WSAIOW(IOC_VENDOR,4)

#define SIO_ABSORB_RTRALERT _WSAIOW(IOC_VENDOR,5)

#define SIO_UCAST_IF _WSAIOW(IOC_VENDOR,6)

#define SIO_LIMIT_BROADCASTS _WSAIOW(IOC_VENDOR,7)

#define SIO_INDEX_BIND _WSAIOW(IOC_VENDOR,8)

#define SIO_INDEX_MCASTIF _WSAIOW(IOC_VENDOR,9)

#define SIO_INDEX_ADD_MCAST _WSAIOW(IOC_VENDOR,10)

#define SIO_INDEX_DEL_MCAST _WSAIOW(IOC_VENDOR,11)

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
2023年上半年GDP全球前十五强
 百态   2023-10-24
美众议院议长启动对拜登的弹劾调查
 百态   2023-09-13
上海、济南、武汉等多地出现不明坠落物
 探索   2023-09-06
印度或要将国名改为“巴拉特”
 百态   2023-09-06
男子为女友送行,买票不登机被捕
 百态   2023-08-20
手机地震预警功能怎么开?
 干货   2023-08-06
女子4年卖2套房花700多万做美容:不但没变美脸,面部还出现变形
 百态   2023-08-04
住户一楼被水淹 还冲来8头猪
 百态   2023-07-31
女子体内爬出大量瓜子状活虫
 百态   2023-07-25
地球连续35年收到神秘规律性信号,网友:不要回答!
 探索   2023-07-21
全球镓价格本周大涨27%
 探索   2023-07-09
钱都流向了那些不缺钱的人,苦都留给了能吃苦的人
 探索   2023-07-02
倩女手游刀客魅者强控制(强混乱强眩晕强睡眠)和对应控制抗性的关系
 百态   2020-08-20
美国5月9日最新疫情:美国确诊人数突破131万
 百态   2020-05-09
荷兰政府宣布将集体辞职
 干货   2020-04-30
倩女幽魂手游师徒任务情义春秋猜成语答案逍遥观:鹏程万里
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案神机营:射石饮羽
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案昆仑山:拔刀相助
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案天工阁:鬼斧神工
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案丝路古道:单枪匹马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:与虎谋皮
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:李代桃僵
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:指鹿为马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:小鸟依人
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:千金买邻
 干货   2019-11-12
 
推荐阅读
 
 
 
>>返回首頁<<
 
靜靜地坐在廢墟上,四周的荒凉一望無際,忽然覺得,淒涼也很美
© 2005- 王朝網路 版權所有