SnifferRawSocket/rawsocket.cpp

385 lines
8.5 KiB
C++
Raw Normal View History

init init
2022-04-14 13:59:39 +00:00
#include "rawsocket.h"
// ȫ<>ֱ<EFBFBD><D6B1><EFBFBD>
SOCKET g_RawSocket = 0;
HOSTIP g_HostIp;
BOOL g_bStopRecv = FALSE;
// <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
void ShowError(char *lpszText)
{
char szErr[MAX_PATH] = {0};
::wsprintf(szErr, "%s Error!\nError Code Is:%d\n", lpszText, ::GetLastError());
::MessageBox(NULL, szErr, "ERROR", MB_OK | MB_ICONERROR);
}
BOOL InitRawSocket()
{
// <20><><EFBFBD>ð汾
WSADATA wsaData = {0};
if(0 != WSAStartup(MAKEWORD(2, 2), &wsaData))
{
ShowError("WSAStartup");
return FALSE;
}
// <20><><EFBFBD><EFBFBD>ԭʼ<D4AD>׽<EFBFBD><D7BD><EFBFBD>
// <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Windows<77><73>û<EFBFBD>취<EFBFBD><ECB7A8>Raw SocketץMAC<41><43><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD><DDB0><EFBFBD>ֻ<EFBFBD><D6BB>ץ<EFBFBD><D7A5>IP<49>㼰<EFBFBD><E3BCB0><EFBFBD>ϵ<EFBFBD><CFB5><EFBFBD><EFBFBD>ݰ<EFBFBD><DDB0><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
g_RawSocket = socket(AF_INET, SOCK_RAW, IPPROTO_IP); // ע<><D7A2><EFBFBD>˴<EFBFBD><CBB4><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!!!
// g_RawSocket = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if (INVALID_SOCKET == g_RawSocket)
{
WSACleanup();
ShowError("socket");
return FALSE;
}
// <20>󶨵<EFBFBD><F3B6A8B5>ӿ<EFBFBD>
// <20><>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
char szHostName[MAX_PATH] = {0};
if (SOCKET_ERROR == ::gethostname(szHostName, MAX_PATH))
{
closesocket(g_RawSocket);
WSACleanup();
ShowError("gethostname");
return FALSE;
}
// <20><><EFBFBD>ݱ<EFBFBD><DDB1><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD>IP<49><50>ַ
hostent *lpHostent = ::gethostbyname(szHostName);
if(NULL == lpHostent)
{
closesocket(g_RawSocket);
WSACleanup();
ShowError("gethostbyname");
return FALSE;
}
// IP<49><50>ַת<D6B7><D7AA><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>IP<49><50>ַ
g_HostIp.iLen = 0;
::lstrcpy(g_HostIp.szIPArray[g_HostIp.iLen], "127.0.0.1");
g_HostIp.iLen++;
char *lpszHostIP = NULL;
while (NULL != (lpHostent->h_addr_list[(g_HostIp.iLen - 1)]))
{
lpszHostIP = inet_ntoa(*(in_addr *)lpHostent->h_addr_list[(g_HostIp.iLen - 1)]);
::lstrcpy(g_HostIp.szIPArray[g_HostIp.iLen], lpszHostIP);
g_HostIp.iLen++;
}
// ѡ<><D1A1>IP<49><50>ַ<EFBFBD><D6B7>Ӧ<EFBFBD><D3A6><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>̽
printf("Choose A IP Address To Sniff:\n");
for (int i = 0; i < g_HostIp.iLen; i++)
{
printf("\tIP %d:%s\n", i, g_HostIp.szIPArray[i]);
}
printf("Input A Number: ");
int iChoose = 0;
scanf("%d", &iChoose);
getchar();
if ((0 > iChoose) || (iChoose >= g_HostIp.iLen))
{
printf("Choose Error!\nExit Now!!!\n");
system("pause");
exit(0);
}
printf("Sniffing...\n");
if ((0 <= iChoose) && (iChoose < g_HostIp.iLen))
{
lpszHostIP = g_HostIp.szIPArray[iChoose];
}
// ::MessageBox(NULL, lpszHostIP, "HOST IP", MB_OK);
// <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD>ṹ
sockaddr_in SockAddr = {0};
RtlZeroMemory(&SockAddr, sizeof(sockaddr_in));
SockAddr.sin_addr.S_un.S_addr = inet_addr(lpszHostIP);
SockAddr.sin_family = AF_INET;
SockAddr.sin_port = htons(0);
// <20><><EFBFBD><EFBFBD>
if (SOCKET_ERROR == ::bind(g_RawSocket, (sockaddr *)(&SockAddr), sizeof(sockaddr_in)))
{
closesocket(g_RawSocket);
WSACleanup();
ShowError("bind");
return FALSE;
}
// <20><><EFBFBD>û<EFBFBD><C3BB><EFBFBD>ģʽ<C4A3><CABD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ܲ<EFBFBD><DCB2><EFBFBD><EFBFBD><EFBFBD><EFBFBD>е<EFBFBD><D0B5><EFBFBD><EFBFBD>ݰ<EFBFBD>
DWORD dwSetVal = 1;
if (SOCKET_ERROR == ioctlsocket(g_RawSocket, SIO_RCVALL, &dwSetVal))
{
closesocket(g_RawSocket);
WSACleanup();
ShowError("ioctlsocket");
return FALSE;
}
return TRUE;
}
BOOL ReceivePacket()
{
sockaddr_in RecvAddr = { 0 };
int iRecvBytes = 0;
int iRecvAddrLen = sizeof(sockaddr_in);
DWORD dwBufSize = 12000;
BYTE *lpRecvBuf = new BYTE[dwBufSize];
int i = 0;
g_bStopRecv = TRUE;
// <20><><EFBFBD><EFBFBD>
while (g_bStopRecv)
{
RtlZeroMemory(&RecvAddr, iRecvAddrLen);
iRecvBytes = recvfrom(g_RawSocket, (char *)lpRecvBuf, dwBufSize, 0, (sockaddr *)(&RecvAddr), &iRecvAddrLen);
if (0 < iRecvBytes)
{
// <20><><EFBFBD>յ<EFBFBD><D5B5><EFBFBD><EFBFBD>ݰ<EFBFBD>
// <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>
AnalyseRecvPacket(lpRecvBuf);
}
}
// <20>ͷ<EFBFBD><CDB7>ڴ<EFBFBD>
delete[]lpRecvBuf;
lpRecvBuf = NULL;
return TRUE;
}
BOOL ReceivePacket_Print()
{
sockaddr_in RecvAddr = { 0 };
int iRecvBytes = 0;
int iRecvAddrLen = sizeof(sockaddr_in);
DWORD dwBufSize = 12000;
BYTE *lpRecvBuf = new BYTE[dwBufSize];
int i = 0;
g_bStopRecv = TRUE;
// <20><><EFBFBD><EFBFBD>
char szTemp[10] = {0};
FILE *fp = fopen("RecvInfo.txt", "w+");
while (g_bStopRecv)
{
RtlZeroMemory(&RecvAddr, iRecvAddrLen);
iRecvBytes = recvfrom(g_RawSocket, (char *)lpRecvBuf, dwBufSize, 0, (sockaddr *)(&RecvAddr), &iRecvAddrLen);
if (0 < iRecvBytes)
{
// <20><><EFBFBD>յ<EFBFBD><D5B5><EFBFBD>Ϣ
printf("[RECV] %dbytes\n", iRecvBytes);
::wsprintf(szTemp, "[RECV] %dbytes\n", iRecvBytes);
fputs(szTemp, fp);
for (i = 0; i < iRecvBytes; i++)
{
if (!g_bStopRecv)
{
break;
}
if ((0 == (i % 8)) && (0 != i))
{
printf(" ");
::wsprintf(szTemp, "%s", " ");
fputs(szTemp, fp);
}
if ((0 == (i % 16)) && (0 != i))
{
printf("\n");
::wsprintf(szTemp, "%s", "\n");
fputs(szTemp, fp);
}
printf("%02x ", lpRecvBuf[i]);
::wsprintf(szTemp, "%02X ", lpRecvBuf[i]);
fputs(szTemp, fp);
}
printf("\n");
::wsprintf(szTemp, "%s", "\n");
fputs(szTemp, fp);
}
}
fclose(fp);
// <20>ͷ<EFBFBD><CDB7>ڴ<EFBFBD>
delete[]lpRecvBuf;
lpRecvBuf = NULL;
return TRUE;
}
void MyPrintf(const char * _Format, ...)
{
char szTemp[MAX_PATH] = {0};
// <20><>1<EFBFBD><31><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>б<EFBFBD><D0B1>ı<EFBFBD><C4B1><EFBFBD>
va_list arg_ptr;
// <20><>2<EFBFBD><32><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʼ<EFBFBD><CABC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>б<EFBFBD>
va_start(arg_ptr, _Format);
// <20><>3<EFBFBD><33><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȡarg_ptrָ<72><D6B8><EFBFBD>ĵ<EFBFBD>ǰ<EFBFBD><C7B0><EFBFBD><EFBFBD>
vsprintf(szTemp, _Format, arg_ptr);
// <20><>4<EFBFBD><34><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
va_end(arg_ptr);
// <20><>ʾ
printf("%s", szTemp);
// <20><><EFBFBD>浽<EFBFBD>ļ<EFBFBD>
SaveToFile("RecvInfo.txt", szTemp);
}
void SaveToFile(char *lpszFileName, char *lpBuf)
{
FILE *fp = fopen(lpszFileName, "a+");
if(NULL == fp)
{
return ;
}
fputs(lpBuf, fp);
fclose(fp);
}
BOOL ExitRawSocket()
{
g_bStopRecv = FALSE;
Sleep(500);
closesocket(g_RawSocket);
WSACleanup();
return TRUE;
}
void AnalyseRecvPacket(BYTE *lpBuf)
{
/*
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Windows<EFBFBD><EFBFBD>û<EFBFBD>취<EFBFBD><EFBFBD>Raw SocketץMAC<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD><EFBFBD><EFBFBD>ֻ<EFBFBD><EFBFBD>ץ<EFBFBD><EFBFBD>IP<EFBFBD>㼰<EFBFBD><EFBFBD><EFBFBD>ϵ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
ע<EFBFBD>⣺
<EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ֽ<EFBFBD>˳<EFBFBD><EFBFBD>ת<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>⣡<EFBFBD><EFBFBD><EFBFBD><EFBFBD>
//<2F><><EFBFBD><EFBFBD>Ҫ<EFBFBD><D2AA><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ֽ<EFBFBD><D6BD><EFBFBD>ת<EFBFBD><D7AA>Ϊ<EFBFBD><CEAA><EFBFBD><EFBFBD><EFBFBD>ֽ<EFBFBD><D6BD><EFBFBD>
*/
//<2F><><EFBFBD><EFBFBD>IPЭ<50><D0AD>
PIPV4HEADER ip = (PIPV4HEADER)lpBuf;
//<2F><><EFBFBD><EFBFBD>IP<49><50><EFBFBD><EFBFBD>Э<EFBFBD><D0AD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
switch (ip->ipv4_pro)
{
case IPPROTO_ICMP:
{
MyPrintf("[ICMP]\n");
AnalyseRecvPacket_All(lpBuf);
break;
}
case IPPROTO_IGMP:
{
MyPrintf("[IGMP]\n");
AnalyseRecvPacket_All(lpBuf);
break;
}
case IPPROTO_TCP:
{
//<2F><><EFBFBD><EFBFBD>tcpЭ<70><D0AD>
MyPrintf("[TCP]\n");
AnalyseRecvPacket_TCP(lpBuf);
break;
}
case IPPROTO_UDP:
{
//<2F><><EFBFBD><EFBFBD>udpЭ<70><D0AD>
MyPrintf("[UDP]\n");
AnalyseRecvPacket_UDP(lpBuf);
break;
}
default:
{
MyPrintf("[OTHER IP]\n");
AnalyseRecvPacket_All(lpBuf);
break;
}
}
}
void AnalyseRecvPacket_All(BYTE *lpBuf)
{
struct sockaddr_in saddr, daddr;
PIPV4HEADER ip = (PIPV4HEADER)lpBuf;
saddr.sin_addr.s_addr = ip->ipv4_sourpa;
daddr.sin_addr.s_addr = ip->ipv4_destpa;
MyPrintf("From:%s --> ", inet_ntoa(saddr.sin_addr));
MyPrintf("To:%s\n", inet_ntoa(daddr.sin_addr));
}
void AnalyseRecvPacket_UDP(BYTE *lpBuf)
{
struct sockaddr_in saddr, daddr;
PIPV4HEADER ip = (PIPV4HEADER)lpBuf;
PUDPHEADER udp = (PUDPHEADER)(lpBuf + (ip->ipv4_ver_hl & 0x0F) * 4);
int hlen = (int)((ip->ipv4_ver_hl & 0x0F) * 4 + sizeof(UDPHEADER));
int dlen = (int)(ntohs(udp->udp_hlen) - 8);
// int dlen = (int)(udp->udp_hlen - 8);
saddr.sin_addr.s_addr = ip->ipv4_sourpa;
daddr.sin_addr.s_addr = ip->ipv4_destpa;
MyPrintf("Protocol:UDP ");
MyPrintf("From:%s:%d -->", inet_ntoa(saddr.sin_addr), ntohs(udp->udp_sourport));
MyPrintf("To:%s:%d\n", inet_ntoa(daddr.sin_addr), ntohs(udp->udp_destport));
PrintData((lpBuf + hlen), dlen, 0);
}
void AnalyseRecvPacket_TCP(BYTE *lpBuf)
{
struct sockaddr_in saddr, daddr;
PIPV4HEADER ip = (PIPV4HEADER)lpBuf;
PTCPHEADER tcp = (PTCPHEADER)(lpBuf + (ip->ipv4_ver_hl & 0x0F) * 4);
int hlen = (ip->ipv4_ver_hl & 0x0F) * 4 + tcp->tcp_hlen * 4;
int dlen = ntohs(ip->ipv4_plen) - hlen; //<2F><><EFBFBD><EFBFBD>Ҫ<EFBFBD><D2AA><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ֽ<EFBFBD><D6BD><EFBFBD>ת<EFBFBD><D7AA>Ϊ<EFBFBD><CEAA><EFBFBD><EFBFBD><EFBFBD>ֽ<EFBFBD><D6BD><EFBFBD>
saddr.sin_addr.s_addr = ip->ipv4_sourpa;
daddr.sin_addr.s_addr = ip->ipv4_destpa;
MyPrintf("Protocol:TCP ");
MyPrintf("From:%s:%d --> ", inet_ntoa(saddr.sin_addr), ntohs(tcp->tcp_sourport));
MyPrintf("To:%s:%d ", inet_ntoa(daddr.sin_addr), ntohs(tcp->tcp_destport));
MyPrintf("ack:%u syn:%u length=%d\n", tcp->tcp_acknu, tcp->tcp_seqnu, dlen);
PrintData((lpBuf + hlen), dlen, 0);
}
void PrintData(BYTE *lpBuf, int iLen, int iPrintType)
{
if (0 == iPrintType) // 16<31><36><EFBFBD><EFBFBD>
{
for (int i = 0; i < iLen; i++)
{
if ((0 == (i % 8)) && (0 != i))
{
MyPrintf(" ");
}
if ((0 == (i % 16)) && (0 != i))
{
MyPrintf("\n");
}
MyPrintf("%02x ", lpBuf[i]);
}
MyPrintf("\n");
}
else if (1 == iPrintType) // ASCII<49><49><EFBFBD><EFBFBD>
{
for (int i = 0; i < iLen; i++)
{
MyPrintf("%c", lpBuf[i]);
}
MyPrintf("\n");
}
}