winpcap

Index > Main > winpcap

Author

Thread

gavin

Joined: 20 Jul 2008
Posts: 23

gavin 14 Aug 2008, 02:54

First of all my code works .
Whats wrong is on the example page
http://www.winpcap.org/docs/docs_40_2/html/group__wpcap__tut3.html

the pcap_findalldevs_ex function uses some fancy structures .
The structure page is here

http://www.winpcap.org/docs/docs_40_2/html/annotated.html
and its name is pcap_if

As you can see my code is no good without a uniform way of finding the adapters like they have using c.

If you don't understand anything just ask .
Thanks alot.

Code:

;NASM Win32 stack
;
;compile with:
;NASMW.EXE -fobj sniffer.asm
;link with:
;ALINK.EXE sniffer.obj -c -oPE -subsys console

%include "D:\programming\nasm\include\windows.inc"


EXTERN pcap_findalldevs_ex
IMPORT pcap_findalldevs_ex wpcap.dll

EXTERN pcap_open
IMPORT pcap_open wpcap.dll

EXTERN pcap_freealldevs
IMPORT pcap_freealldevs wpcap.dll

EXTERN pcap_next_ex
IMPORT pcap_next_ex wpcap.dll


EXTERN printf
IMPORT printf Msvcrt.dll
EXTERN ExitProcess
IMPORT ExitProcess kernel32.dll



segment .DATA USE32

        
                PCAP_SRC_IF_STRING  db  "rpcap://",0
                          
                            
segment .DATA? USE32

                alldevs             resd 254
                errbuf              resb 256
                adhandle            resd 1
                adapter             resd 1
                           
segment .CODE USE32

..start

;--------------------------------------------------------------------
; Retrieve the device list from the local machine 
;--------------------------------------------------------------------

push dword errbuf
push dword alldevs
push dword 0
push dword PCAP_SRC_IF_STRING
call[pcap_findalldevs_ex]



mov ebx,dword [alldevs]

push dword [ebx]   ;0
push dword [ebx+4] ;name
push dword [ebx+8] ;description
push dword ebx


mov ebx,dword [alldevs]
add ebx,204
push dword [ebx]   ;name
push dword [ebx+4] ;description
push dword [ebx+8] ;0
push dword ebx
mov eax,[ebx]
mov [adapter],eax







push dword errbuf
push dword 0
push dword 1000
push dword 1                         ;PROMISCUOUS
push dword 65536
push dword [adapter]                    
call[pcap_open]
mov [adhandle],dword eax

      
push dword 0
call [ExitProcess]

14 Aug 2008, 02:54

okasvi

Joined: 18 Aug 2005
Posts: 382
Location: Finland

okasvi 15 Aug 2008, 12:38

is this what you were trying to do?

Code:

format PE console
include 'win32ax.inc'
;______________________________________________________________________________
struct pcap_if
        next            rd 1 ; struct pcap_if *
        name            rd 1 ; char *
        description     rd 1 ; char *
        addresses       rd 1 ; struct pcap_addr *
        flags           rd 1
ends
;______________________________________________________________________________
entry $
main:
                invoke  pcap_findalldevs_ex, _rpcap, 0, devs, errbuf
                cmp     eax, -1
                jnz     .l1
                cinvoke printf, err1, errbuf
                jmp     .err
        .l1:    mov     edi, devs
                xor     ebx, ebx
        .l2:    cinvoke printf, msg1, ebx, [edi+pcap_if.name]
                cmp     [edi+pcap_if.description], 0
                je      .l3
                cinvoke printf, msg2, [edi+pcap_if.description]
                jmp     .l4
        .l3:    cinvoke printf, msg3
        .l4:    inc     ebx
                mov     edi, [edi+pcap_if.next]
                cmp     edi, 0
                jnz     .l2
        .l5:    test    ebx, ebx
                jnz     .l6
                cinvoke printf, err2
                jmp     .err
        .l6:    cinvoke printf, msg4
                invoke  scanf, _scanf, intf
                cmp     [intf], 1
                jae     .l7
                cmp     [intf], ebx
                jnb     .l7
                cinvoke printf, err3
                invoke  pcap_freealldevs, [devs]
                jmp     .err
        .l7:    mov     edi, devs
                xor     ebx, ebx
        .l8:    cmp     ebx, [intf]
                jae     .l9
                inc     ebx
                mov     edi, [edi+pcap_if.next]
                jmp     .l8
        .l9:    invoke  pcap_open, [edi+pcap_if.name], 65536, 1, 100, 0, errbuf
                mov     esi, eax
                test    eax, eax
                jnz     .l10
                cinvoke printf, err4, [edi+pcap_if.name]
                invoke  pcap_freealldevs, [devs]
                jmp     .err
        .l10:   cinvoke printf, msg5, dword [edi+pcap_if.description]
                invoke  pcap_freealldevs, [devs]
;                invoke  pcap_loop, esi, 0, packet_handler, 0
                xor     eax, eax
                jmp     .exit
        .err:   mov     eax, 1
        .exit:  invoke  ExitProcess, eax
;______________________________________________________________________________
;proc packet_handler
; ....
;               ret
;endp
;______________________________________________________________________________
_rpcap  db 'rpcap://',0
_scanf  db '%d',0
err1    db 'errfindalldevs_ex %s',13,10,0
err2    db 'no interfaces found',13,10,0
err3    db 'out of range',13,10,0
err4    db 'not supported %s',13,10,0
err5    db '',13,10,0
msg1    db '%d. %s',13,10,0
msg2    db 9,'%s',13,10,0
msg3    db 'no description',13,10,0
msg4    db 'interface #:',0
msg5    db 'listening %s',13,10,0
;______________________________________________________________________________
data import
library wpcap,'wpcap',\
        msvcrt,'msvcrt',\
        kernel32,'kernel32'
import  wpcap,\
        pcap_open,'pcap_open',\
        pcap_loop,'pcap_loop',\
        pcap_freealldevs,'pcap_freealldevs',\
        pcap_findalldevs_ex,'pcap_findalldevs_ex'
import  msvcrt,\
        printf,'printf',\
        scanf,'scanf'
import  kernel32,\
        ExitProcess,'ExitProcess'
end data
;______________________________________________________________________________
        intf            rd 1
        devs            rd 1
        errbuf          rb 256

btw. we're at board.FLATASSEMBLER.net Wink

15 Aug 2008, 12:38

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr 18 Aug 2008, 00:05

"Wherever particular people congregate" Wink

18 Aug 2008, 00:05

gavin

Joined: 20 Jul 2008
Posts: 23

gavin 18 Aug 2008, 15:02

Okasvi I'm not sure how you understood the structs but thanks a million.
I couldn't of asked for a better reply to my question.
You must of spent a good few hours writting that, so all i can say is thanks alot.
I can now carry on writting my packet sniffer.
Your code is very nice.

A few questions.
My code worked but it was horrible as you know .
How or where did you learn to interpret them strucs used by the library?
I know it is flat assembler but nasm is very similiar.

18 Aug 2008, 15:02

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly 18 Aug 2008, 15:37

Quote:

I know it is flat assembler but nasm is very similiar.

So why don't you switch to fasm then? Wink

About interpreting the fields types it is very simple because C has very few native types:

Code:

; Always in 32-bit x86 C
char = byte (db, rb)

short int = word (dw, rw)
int = dword (dd, rd)
long int = dword (dd, rd)
long long int = qword (dq, rq)

float = dword (dd, rd)
double = qword (dq, rq)
long double = tword (dt, rt)

If I remember right, char is signed by default so if it has no prefix you must consider the byte as signed (in branches, divisions, etc). All types but floating-point ones accept signed and unsigned prefix.

If the field type is none of the native types then it is a typedef, so you must look inside the header files (or in the lines above the definition of the structure) to see what native type is. Since the typedef could be again another structure you need a recursive search Smile

(But in such case define all the strucs in the path in your Assembly source instead of expanding all native types fields)

I hope I haven't confused you much, I suggest you read The C Programming Language book which I'm sure it was available for reading online (legally) but now I can't find it Sad

18 Aug 2008, 15:37

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum