
 /*-----------------------------------------------------------------------*/
 /*                       R I N G 0,    I S S U E   # 1                   */
 /*-----------------------------------------------------------------------*/

                         win32

                                                          by CNerd/HangUP

          (  )    
       Win32.        ?    
   ... ;)       ,
         -  / 
     ,     , ... etc.  
      ,                    
       ,    
   .

    :              
          IP1-IP2,     
         Port1-Port2 (   ).
             .
   ,  .    .  
                 ,                WinPCap -
 http://netgroup-serv.polito.it/winpcap  .   . 
       ,     lib   VC +
   .

        ,  (lcc-win32 -  
   ),          lib'   .   exp,
 

 implib packet.dll > packet.exp

     .    3 :

 No .edata section in DLL
 Export table in .rdata section offset 0x6000
 Reading Packet.dll

  ...    ,         PACKET.DLL   
  buildlib:

 buildlib packet.exp

  , lib ,  ,   .

#include < windows.h >
#include < winsock.h >
#include < Packet32.h >

LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);

 HANDLE hndl;
 HWND hwnd;

 LPADAPTER  lpAdapter = 0;
 LPPACKET   lpPacket;

 //unicode strings (winnt)
 WCHAR AdapterName[512]; //  
 WCHAR *temp,*temp1;

 //ascii strings   (win9x)
 char AdapterNamea[512]; //  ,   Win9x
 char *tempa,*temp1a;

 char AdapterList[10][1024];
 char b1[65535],b2[65535],b3[65535];
 char buffer[256000];  // c  ,   

 int   AdapterNum=0,i;
 ULONG AdapterLength;

 struct bpf_stat stat;

/*-   -*/

void packets(LPPACKET lpPacket)
{
 ULONG        i, recv;
 u_int  off=0,hlen,tlen;
 struct bpf_hdr *hdr;
 char   *pack, *data, *buf;

 recv = lpPacket->ulBytesReceived;
 buf  = lpPacket->Buffer;

 while (off < recv) //  ,      
 {
  hdr=(struct bpf_hdr *)(buf+off);
  tlen=hdr->bh_datalen;
  hlen=hdr->bh_hdrlen;

  off+=hdr->bh_hdrlen;
  pack = (char*)(buf+off);

  if ((pack[23] == 6) && (tlen > 54)) //  TCP  54 ?
  {
   data = (char*)(buf+off+54); //    
                               // ( )

    //  SRC  DEST IP

   IN_ADDR ia[2];
   ia[1].s_addr=MAKELONG(MAKEWORD(pack[26],pack[27]), \
    MAKEWORD(pack[28],pack[29]));
   ia[2].s_addr=MAKELONG(MAKEWORD(pack[30],pack[31]), \
    MAKEWORD(pack[32],pack[33]));

    //  local  remote 

   int p[2];
   p[1]=MAKEWORD(pack[35],pack[34]);
   p[2]=MAKEWORD(pack[37],pack[36]);

    //      ,    
    // IP1-IP2  IP2-IP1   IP1-IP2  
    // .   , ,   - 
    //   -      .

   i=1;                      //  SRC -> DEST
   if (pack[0] != 0x20) i=2; // DEST -> SRC

   wsprintf(b1,"%s",inet_ntoa(ia[i]));             // dirname
   wsprintf(b1,"%s-%s",b1,inet_ntoa(ia[3-i]));

   wsprintf(b2,"%i-%i",p[i],p[3-i]);               // port

   wsprintf(b3,"\n\n%s:%u",inet_ntoa(ia[1]),p[1]); // direction
   wsprintf(b3,"%s -> %s:%u\n\n",b3,inet_ntoa(ia[2]),p[2]);

   char fn[700];                                   // save
   CreateDirectory(b1,NULL);
   wsprintf(fn,"%s\\%s",b1,b2);
   hndl=CreateFile(fn,GENERIC_WRITE,0,NULL,OPEN_ALWAYS, \
                   FILE_ATTRIBUTE_NORMAL,NULL);
   SetFilePointer(hndl,0,0,FILE_END);
   WriteFile(hndl,b3,strlen(b3),&i,NULL);
   WriteFile(hndl,data,tlen-54,&i,NULL);
   CloseHandle(hndl);
  }

  off = Packet_WORDALIGN(off+tlen); //  
 }
}

/*- Entry Point -*/

int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance, \
                   char *szCmdLine,int iCmdShow)
{
  //  
 AdapterLength=512; i=0;

 LPOSVERSIONINFO osver;
 GetVersionEx(osver);

 if (osver->dwPlatformId == VER_PLATFORM_WIN32_NT)
 {  //  Windows NT
  PacketGetAdapterNames(AdapterName,&AdapterLength);
  temp=AdapterName; temp1=AdapterName;

  while ((*temp!='\0')||(*(temp-1)!='\0'))
  {
   if (*temp=='\0')
   {
    memcpy(AdapterList[i],temp1,(temp-temp1)*2);
    temp1=temp+1;
    i++;
   }
   temp++;
  }

  AdapterNum=i;
  for (i=0;ihFile == INVALID_HANDLE_VALUE)) exit(1);

  //    promiscuous mode
 PacketSetHwFilter(lpAdapter,NDIS_PACKET_TYPE_PROMISCUOUS);

  //     
 PacketSetBuff(lpAdapter,512000);

  // 1000 ms   
 PacketSetReadTimeout(lpAdapter,1000);

  //     
  //    - 
 if ((lpPacket = PacketAllocatePacket()) == NULL) exit(1);
 PacketInitPacket(lpPacket,(char*)buffer,sizeof(buffer));

  //       - win32 -
 static char szAppName[] = " ";
 MSG msg;
 WNDCLASS wndclass;

 wndclass.style         = CS_HREDRAW|CS_VREDRAW;
 wndclass.lpfnWndProc   = WndProc;
 wndclass.cbClsExtra    = 0;
 wndclass.cbWndExtra    = 0;
 wndclass.hInstance     = hInstance;
 wndclass.hIcon         = NULL;
 wndclass.hCursor       = NULL;
 wndclass.hbrBackground = NULL;
 wndclass.lpszMenuName  = NULL;
 wndclass.lpszClassName = szAppName;

 RegisterClass(&wndclass);
 hwnd = CreateWindow(szAppName,"",WS_OVERLAPPEDWINDOW,0,0,0,0,NULL, \
                     NULL,hInstance,NULL);

 SetTimer(hwnd,1,1000,0); //    

 while (GetMessage(&msg,NULL,0,0))
 {
  TranslateMessage(&msg);
  DispatchMessage(&msg);
 }

 return msg.wParam ;
}

/*-   -*/

LRESULT CALLBACK WndProc(HWND hwnd, UINT iMsg, \
                         WPARAM wParam, LPARAM lParam)
{
 switch (iMsg)
 {
  case WM_TIMER: //      ...  
   PacketReceivePacket(lpAdapter,lpPacket,TRUE);
   packets(lpPacket);
  break;
 }
}

    ,      6  (lcc-win32)   15  (VC) ,
                  
 adapters.txt,               
   ,    TCP .   
    -   if.

           NT/2k/XP.  
  100%      9x -    .

  ...      .         ,  
 ,              ;)  -    
 hangup0xFF@yahoo.com. !
