WIN2K命令行Sniffer的源码
以下是为代码: #include <stdio.h> #include <string.h> #include <Winsock2.h> #include "mstcpip.h" #pragma comment(lib,"WS2_32.lib") #define STATUS_FAILED 0xFFFF //定义异常出错代码 #define MAX_PACK_LEN 65535 //接收的最大IP报文 #define MAX_ADDR_LEN 16 //点分十进制地址的最大长度 #define MAX_PROTO_TEXT_LEN 16 //子协议名称(如"TCP")最大长度 #define MAX_PROTO_NUM 12 //子协议数量 #define MAX_HOSTNAME_LAN 255 //最大主机名长度 #define CMD_PARAM_HELP true typedef struct _iphdr { unsigned char h_lenver; //4位首部长度+4位IP版本号 unsigned char tos; //8位服务类型TOS unsigned short total_len; //16位总长度(字节) unsigned short ident; //16位标识 unsigned short frag_and_flags; //3位标志位 unsigned char ttl; //8位生存时间 TTL unsigned char proto; //8位协议 (TCP, UDP 或其他) unsigned short checksum; //16位IP首部校验和 unsigned int sourceIP; //32位源IP地址 unsigned int destIP; //32位目的IP地址 }IP_HEADER; typedef struct _tcphdr //定义TCP首部 { USHORT th_sport; //16位源端口 USHORT th_dport; //16位目的端口 unsigned int th_seq; unsigned int th_ack; unsigned char th_lenres; //4位首部长度/6位保留字 unsigned char th_flag; //6位标志位 USHORT th_win; //16位窗口大小 USHORT th_sum; //16位校验和 USHORT th_urp; //16位紧急数据偏移量 }TCP_HEADER; typedef struct _udphdr //定义UDP首部 { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_sum; } UDP_HEADER; typedef struct _icmphdr //定义ICMP首部 { BYTE i_type; //8位类型 BYTE i_code; //8位代码 USHORT i_cksum; //16位校验和 USHORT i_id; //识别号(一般用进程号作为识别号) USHORT i_seq; //报文序列号 ULONG timestamp; //时间戳 }ICMP_HEADER; typedef struct _protomap //定义子协议映射表 { int ProtoNum; char ProtoText[MAX_PROTO_TEXT_LEN]; }PROTOMAP; PROTOMAP ProtoMap[MAX_PROTO_NUM]={ //为子协议映射表赋值 { IPPROTO_IP, "IP" }, { IPPROTO_ICMP, "ICMP" }, { IPPROTO_IGMP, "IGMP" }, { IPPROTO_GGP, "GGP" }, { IPPROTO_TCP, "TCP" }, { IPPROTO_PUP, "PUP" }, { IPPROTO_UDP, "UDP" }, { IPPROTO_IDP, "IDP" }, { IPPROTO_ND, "NP" }, { IPPROTO_RAW, "RAW" }, { IPPROTO_MAX, "MAX" }, { NULL, "" } }; SOCKET SockRaw; char TcpFlag[6]={ ’F’,’S’,’R’,’P’,’A’,’U’ }; //定义TCP标志位 bool ParamTcp =false; // -t关注TCP 报文 bool ParamUdp =false; // -u关注UDP 报文 bool ParamIcmp =false; // -i关注ICMP报文 bool ParamDecode=true; // -d对协议进行解码 char *strFromIpFilter=NULL; // 源IP地址过滤 char *strDestIpFilter=NULL; // 目的地址过滤 int DecodeIpPack(char *,int); int DecodeTcpPack(char *); int DecodeUdpPack(char *); int DecodeIcmpPack(char *); void CheckSockError(int,char*); char * CheckProtocol(int); void usage(void); bool GetCmdLine(int, char **); void main(int argc, char ** argv) { int iErrorCode; char RecvBuf[MAX_PACK_LEN] = { 0 }; usage(); if(GetCmdLine(argc, argv)==CMD_PARAM_HELP) exit(0); //初始化SOCKET WSADATA wsaData; iErrorCode = WSAStartup(MAKEWORD(2,1),&wsaData); CheckSockError(iErrorCode, "WSAStartup"); SockRaw = socket(AF_INET , SOCK_RAW , IPPROTO_IP); CheckSockError(SockRaw, "socket"); //获取本机IP地址 char FAR name[MAX_HOSTNAME_LAN]; iErrorCode = gethostname(name, MAX_HOSTNAME_LAN); CheckSockError(iErrorCode, "gethostname"); struct hostent FAR * pHostent; pHostent = (struct hostent * )malloc(sizeof(struct hostent)); pHostent = gethostbyname(name); SOCKADDR_IN sa; sa.sin_family = AF_INET; sa.sin_port = htons(6000); memcpy(&sa.sin_addr.S_un.S_addr, pHostent->h_addr_list[0], pHostent->h_length); iErrorCode = bind(SockRaw, (PSOCKADDR)&sa, sizeof(sa)); CheckSockError(iErrorCode, "bind"); //设置SOCK_RAW为SIO_RCVALL,以便接收所有的IP包 DWORD dwBufferLen[10] ; DWORD dwBufferInLen = 1 ; DWORD dwBytesReturned = 0 ; iErrorCode=WSAIoctl(SockRaw,SIO_RCVALL,&dwBufferInLen,sizeof(dwBufferInLen),&dwBufferLen, sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL ); CheckSockError(iErrorCode, "Ioctl"); //侦听IP报文 while(1) { memset(RecvBuf, 0, sizeof(RecvBuf)); iErrorCode = recv(SockRaw, RecvBuf, sizeof(RecvBuf), 0); CheckSockError(iErrorCode, "recv"); iErrorCode = DecodeIpPack(RecvBuf, iErrorCode); CheckSockError(iErrorCode, "Decode"); } } //IP解包程序 int DecodeIpPack(char *buf, int iBufSize) { IP_HEADER *pIpheader; int iProtocol, iTTL; char szProtocol[MAX_PROTO_TEXT_LEN]; char szSourceIP[MAX_ADDR_LEN], szDestIP[MAX_ADDR_LEN]; SOCKADDR_IN saSource, saDest; pIpheader = (IP_HEADER *)buf; //Check Proto iProtocol = pIpheader->proto; strncpy(szProtocol, CheckProtocol(iProtocol), MAX_PROTO_TEXT_LEN); if((iProtocol==IPPROTO_TCP) && (!ParamTcp)) return true; if((iProtocol==IPPROTO_UDP) && (!ParamUdp)) return true; if((iProtocol==IPPROTO_ICMP) && (!ParamIcmp)) return true; //Check Source IP saSource.sin_addr.s_addr = pIpheader->sourceIP; strncpy(szSourceIP, inet_ntoa(saSource.sin_addr), MAX_ADDR_LEN); if (strFromIpFilter) if (strcmp(strFromIpFilter,szSourceIP)) return true; //Check Dest IP saDest.sin_addr.s_addr = pIpheader->destIP; strncpy(szDestIP, inet_ntoa(saDest.sin_addr), MAX_ADDR_LEN); if (strDestIpFilter) if (strcmp(strDestIpFilter,szDestIP)) return true; iTTL = pIpheader->ttl; //Output printf("%s ", szProtocol); printf("%s->%s ", szSourceIP, szDestIP); printf("bytes=%d TTL=%d ",iBufSize,iTTL); //Calculate IP Header Length int iIphLen = sizeof(unsigned long) * (pIpheader->h_lenver & 0xf); //Decode Sub Protocol:TCP, UDP, ICMP, etc switch(iProtocol) { case IPPROTO_TCP :DecodeTcpPack(buf+iIphLen);break; case IPPROTO_UDP :DecodeUdpPack(buf+iIphLen);break; case IPPROTO_ICMP :DecodeIcmpPack(buf+iIphLen);break; default :break; } //printf("/n"); return true; } //SOCK错误处理程序 void CheckSockError(int iErrorCode, char *pErrorMsg) { if(iErrorCode==SOCKET_ERROR) { printf("%s Error:%d/n", pErrorMsg, GetLastError()); closesocket(SockRaw); exit(0); } } //协议识别程序 char * CheckProtocol(int iProtocol) { for(int i=0; i<MAX_PROTO_NUM; i++) if(ProtoMap[i].ProtoNum==iProtocol) return ProtoMap[i].ProtoText; return ""; } //TCP解包程序 int DecodeTcpPack(char * TcpBuf) { TCP_HEADER * pTcpHeader; int i; pTcpHeader = (TCP_HEADER * )TcpBuf; printf("Port:%d->%d ", ntohs(pTcpHeader->th_sport),ntohs(pTcpHeader->th_dport)); unsigned char FlagMask = 1; for( i=0; i<6; i++ ) { if((pTcpHeader->th_flag) & FlagMask) printf("%c",TcpFlag[i]); else printf("-"); FlagMask=FlagMask<<1; } printf("/n"); return true; } //UDP解包程序 int DecodeUdpPack(char * UdpBuf) { UDP_HEADER *pUdpHeader; pUdpHeader = (UDP_HEADER * )UdpBuf; printf("Port:%d->%d ", ntohs(pUdpHeader->uh_sport), ntohs(pUdpHeader->uh_dport)); printf("Len=%d/n", ntohs(pUdpHeader->uh_len)); return true; } //ICMP解包程序 int DecodeIcmpPack(char * IcmpBuf) { ICMP_HEADER *pIcmpHeader; pIcmpHeader = (ICMP_HEADER * )IcmpBuf; printf("Type:%d,%d ", pIcmpHeader->i_type,pIcmpHeader->i_code); printf("ID=%d SEQ=%d/n", pIcmpHeader->i_id, pIcmpHeader->i_seq); return true; } //命令行参数处理 bool GetCmdLine(int argc, char ** argv) { if (argc<2) return CMD_PARAM_HELP; for(int i=1;i<argc;i++) { if(argv[i][0]!=’/’) return CMD_PARAM_HELP; else switch (argv[i][1]) { case ’t’: case ’T’: ParamTcp=true; break; case ’u’: case ’U’: ParamUdp=true; break; case ’i’: case ’I’: ParamIcmp=true; break; case ’p’: case ’P’: ParamDecode=true; break; case ’f’: case ’F’: { strFromIpFilter=(char*)malloc(16*sizeof(char)); memset(strFromIpFilter,0,16*sizeof(char)); strcpy(strFromIpFilter,argv[i]+3); break; } case ’d’: case ’D’: { strDestIpFilter=(char*)malloc(16*sizeof(char)); memset(strDestIpFilter,0,16*sizeof(char)); strcpy(strDestIpFilter,argv[i]+3); break; } } } printf("/nWill Sniffer"); if(ParamTcp) printf(" TCP"); if(ParamUdp) printf(" Udp"); if(ParamIcmp) printf(" ICMP"); if(strFromIpFilter) printf(" FromIp:%s",strFromIpFilter); if(strDestIpFilter) printf(" DestIp:%s",strDestIpFilter); printf("/n/tCTRL+C to quit/nStart:/n"); return (!CMD_PARAM_HELP); } void usage(void) { printf("GUNiffer/n"); printf("/tSinffer for Win2K (Ver 0.2)/n"); printf("USAGE:/n"); printf("/t/t Output TCP Packets/n"); printf("/t/u Output UDP Packets/n"); printf("/t/i Output ICMP Packets/n"); printf("/t/p Decode Packets (default OFF)/n"); printf("/t/f: fromIP Output Packets FromIp=fromIP (default ALL)/n"); printf("/t/d: destIP Output Packets DestIp=destIP (default ALL)"); printf("/nExample:/n"); printf("/tGUNiffer.exe /d>IpPack.log/n"); printf("/tGUNiffer.exe /t /u /f:192.168.15.231/n"); } |