ANTICHAT — форум по информационной безопасности, OSINT и технологиям

//---------------------------------------------------------------------------

#include <vcl.h>
#pragma hdrstop

#include <winsock.h>
#include <time.h>
#define HAVE_REMOTE
#include "inc/pcap.h"
#include "inc/remote-ext.h"

#include "Unit1.h"
//---------------------------------------------------------------------------
#pragma package(smart_init)
#pragma resource "*.dfm"
#pragma comment(lib,"wpcap.lib")
#pragma comment(lib,"packet.lib")

TForm1 *Form1;
TMemo *Memo1;

typedef struct ip_address{
	u_char byte1;
	u_char byte2;
	u_char byte3;
	u_char byte4;
}ip_address;

/* IPv4 header */
typedef struct ip_header{
	u_char	ver_ihl;		// Version (4 bits) + Internet header length (4 bits)
	u_char	tos;			// Type of service
	u_short tlen;			// Total length
	u_short identification; // Identification
	u_short flags_fo;		// Flags (3 bits) + Fragment offset (13 bits)
	u_char	ttl;			// Time to live
	u_char	proto;			// Protocol
	u_short crc;			// Header checksum
	ip_address	saddr;		// Source address
	ip_address	daddr;		// Destination address
	u_int	op_pad;			// Option + Padding
}ip_header;

/* UDP header*/
typedef struct udp_header{
	u_short sport;			// Source port
	u_short dport;			// Destination port
	u_short len;			// Datagram length
	u_short crc;			// Checksum
}udp_header;

/* prototype of the packet handler */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);

//---------------------------------------------------------------------------
__fastcall TForm1::TForm1(TComponent* Owner)
        : TForm(Owner)
{
}
//---------------------------------------------------------------------------


void __fastcall TForm1::Button1Click(TObject *Sender)
{
pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=0;
pcap_t *adhandle;
char errbuf[PCAP_ERRBUF_SIZE];
u_int netmask;
char packet_filter[] = "ip and udp";
struct bpf_program fcode;

	/* Retrieve the device list */
	if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)
	{
                Memo1->Lines->Add("Error in pcap_findalldevs:" + IntToStr(errbuf));
		exit(1);
	}

	/* Print the list */

	inum = 2;

	/* Jump to the selected adapter */
	for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);

	/* Open the adapter */
	if ((adhandle= pcap_open(d->name, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000,  NULL, errbuf)) == NULL)
	{
                Memo1->Lines->Add("Unable to open the adapter.");
		pcap_freealldevs(alldevs);
		exit(1);
	}

	/* Check the link layer. We support only Ethernet for simplicity. */

	if(d->addresses != NULL)
		netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
	else
		netmask=0xffffff;
	//compile the filter
	if (pcap_compile(adhandle, &fcode, packet_filter, 1, netmask) <0 )
	{
                Memo1->Lines->Add("Unable to compile the packet filter. Check the syntax.");
		pcap_freealldevs(alldevs);
		exit(-1);
	}

	if (pcap_setfilter(adhandle, &fcode)<0)
	{
                Memo1->Lines->Add("Error setting the filter.");
		pcap_freealldevs(alldevs);
		exit(-1);
	}
	pcap_freealldevs(alldevs);
	pcap_loop(adhandle, 0, packet_handler, NULL);
}

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
        TForm *Form1;
	ip_header *ih;
	udp_header *uh;
	u_int ip_len;
	u_short sport,dport;

	ih = (ip_header *) (pkt_data + 14); //length of ethernet header

	/* retireve the position of the udp header */
	ip_len = (ih->ver_ihl & 0xf) * 4;
	uh = (udp_header *) ((u_char*)ih + ip_len);

	/* convert from network byte order to host byte order */
	sport = ntohs( uh->sport );
	dport = ntohs( uh->dport );

	/* print ip addresses and udp ports */
        Memo1->Lines->Add(ih->saddr.byte1 + ih->saddr.byte2 + ih->saddr.byte3 + ih->saddr.byte4);
}
//---------------------------------------------------------------------------

        Memo1->Lines->Add(ih->saddr.byte1 + ih->saddr.byte2 + ih->saddr.byte3 + ih->saddr.byte4);