400RMB 求用winpcap 抓取网络数据包并提取出http数据包内容-『脚本交易』-AUTOIT CN

yorker0503 发表于 2012-10-15 05:56:51

400RMB 求用winpcap 抓取网络数据包并提取出http数据包内容

这个源代码实现了抓取指定网卡数据包并解释报文头的功能，但不能够像wireshark一样解码出报文内容，如：
GET /cgi-bin/getcomposedata?&t=compose_data_json&fun=compose&error=app&f=xhtml&apv=0.9.8&sid=obMO7mhKmf_EaGY2RrHTyfNf,4,zbIpjeD0D HTTP/1.1
Host: i.mail.qq.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Mobile/9A405
Cookie: new_mail_num=241600018&693;qm_username=241600018;appkey=e249624a;k=1833;curuin=241600018
Accept: */*
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
Connection: keep-alive

我想请高手修改此源代码，从抓取到的包里解析出http内容。

源代码：winpcap_demo.au3; Winpcap autoit3 UDF demo - V1.2c
; Copyleft GPL3 Nicolas Ricquemaque 2009-2011

#include <Array.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#Include <GuiListView.au3>
#include <StaticConstants.au3>
#include <ComboConstants.au3>

#include <Winpcap.au3>

$winpcap=_PcapSetup()
If ($winpcap=-1) Then
MsgBox(16,"Pcap error !","WinPcap not found !")
exit
EndIf

$pcap_devices=_PcapGetDeviceList()
If ($pcap_devices=-1) Then
MsgBox(16,"PcapGetDevice error !",_PcapGetLastError())
exit
EndIf

GUICreate("Packet capture", 500, 350)
$interface=GUICtrlCreateCombo("", 80, 15, 400,default,$CBS_DROPDOWNLIST)
GUICtrlSetData(-1, "Pcap capture file")
For $i = 0 to Ubound($pcap_devices)-1
GUICtrlSetData(-1, $pcap_devices[$i])
Next
$filter=GUICtrlCreateInPut ("tcp port 80", 80, 45, 300)
$promiscuous=GUICtrlCreateCheckbox ( "promiscuous", 400, 45)
$start=GUICtrlCreateButton ( "Start", 20, 310, 60)
$stop=GUICtrlCreateButton ( "Stop", 110, 310,60)
GUICtrlSetState (-1, $GUI_DISABLE )
$clear=GUICtrlCreateButton ( "Clear", 200, 310,60)
$stats=GUICtrlCreateButton ( "Stats", 290, 310,60)
GUICtrlSetState (-1, $GUI_DISABLE )
$save=GUICtrlCreateCheckbox ( "Save packets", 395, 310,90,30)
GUICtrlSetStyle(GUICtrlCreateLabel ( "Interface :", 10, 20, 60),$SS_RIGHT)
GUICtrlSetStyle(GUICtrlCreateLabel ( "Filter :", 10, 50, 60),$SS_RIGHT)
$packetwindow = GUICtrlCreateListView("No|Time|Len|Packet", 10, 90, 480, 200)
_GUICtrlListView_SetColumn($packetwindow,0,"No",40,1)
_GUICtrlListView_SetColumnWidth($packetwindow, 1, 80)
_GUICtrlListView_SetColumn($packetwindow,2,"Len",40,1)
_GUICtrlListView_SetColumnWidth($packetwindow, 3, 300)

GUISetState()

$i=0
$pcap=0
$packet=0
$pcapfile=0

Do
$msg = GUIGetMsg()
If ($msg=$start) Then
If GUICtrlRead($promiscuous)=$GUI_CHECKED Then
$prom=1
Else
$prom=0
EndIf
$int=""
If (GUICtrlRead($interface)="Pcap capture file") Then
$file=FileOpenDialog ( "Pcap file to open ?", ".", "Pcap (*.pcap)|All files (*.*)" ,1 )
If $file="" Then ContinueLoop
$int="file://"&$file
Else
For $n = 0 to Ubound($pcap_devices)-1
If $pcap_devices[$n]=GUICtrlRead($interface) Then
$int=$pcap_devices[$n]
ExitLoop
EndIf
Next
EndIf
$pcap=_PcapStartCapture($int,GUICtrlRead($filter),$prom)
If ($pcap=-1) Then
MsgBox(16,"Pcap error !",_PcapGetLastError())
ContinueLoop
EndIf
$linktype=_PcapGetLinkType($pcap)
If ($linktype<>"EN10MB") Then
MsgBox(16,"Pcap error !","This example only works for Ethernet captures")
ContinueLoop
Endif
If GUICtrlRead($save)=$GUI_CHECKED Then
$file=FileSaveDialog ( "Pcap file to write to ?", ".", "Pcap (*.pcap)" ,16 )
If ($file<>"") Then
If StringLower(StringRight($file,5))<>".pcap" Then $file&=".pcap"
$pcapfile=_PcapSaveToFile($pcap,$file)
If ($pcapfile=0) Then MsgBox(16,"Pcap error !",_PcapGetLastError())
EndIf
EndIf
GUICtrlSetState ($stop, $GUI_ENABLE)
GUICtrlSetState ($stats, $GUI_ENABLE)
GUICtrlSetState ($start, $GUI_DISABLE)
GUICtrlSetState ($save, $GUI_DISABLE)
EndIf

If ($msg=$stop) Then
If IsPtr($pcapfile) Then
_PcapStopCaptureFile($pcapfile)
$pcapfile=0
EndIf
if Not IsInt($pcap) Then _PcapStopCapture($pcap)
$pcap=0
GUICtrlSetState ($stop, $GUI_DISABLE)
GUICtrlSetState ($stats, $GUI_DISABLE)
GUICtrlSetState ($start, $GUI_ENABLE)
GUICtrlSetState ($save, $GUI_ENABLE)
EndIf

If ($msg=$clear) Then
_PcapGetStats($pcap)
_GUICtrlListView_DeleteAllItems($packetwindow)
$i=0
EndIf

If ($msg=$stats) Then
$s=_PcapGetStats($pcap)
_ArrayDisplay($s,"Capture statistics")
EndIf

If IsPtr($pcap) Then ; If $pcap is a Ptr, then the capture is running
$time0=TimerInit()
While (TimerDiff($time0)<500) ; Retrieve packets from queue for maximum 500ms before returning to main loop, not to "hang" the window for user
$packet=_PcapGetPacket($pcap)
If IsInt($packet) Then ExitLoop
GUICtrlCreateListViewItem($i&"|"&StringTrimRight($packet,4)&"|"&$packet&"|"&MyDissector($packet), $packetwindow)
$data=$packet
_GUICtrlListView_EnsureVisible($packetwindow, $i)
$i+=1
If IsPtr($pcapfile) Then _PcapWriteLastPacket($pcapfile)
Wend
EndIf

Until $msg=$GUI_EVENT_CLOSE

If IsPtr($pcapfile) Then _PcapStopCaptureFile($pcapfile) ; A file is still open: close it
if IsPtr($pcap) Then _PcapStopCapture($pcap) ; A capture is still running: close it
_PcapFree()

Exit

Func MyDissector ($data) ; Quick example packet dissector....
Local $macdst=StringMid ($data,3,2)&":"&StringMid ($data,5,2)&":"&StringMid ($data,7,2)&":"&StringMid ($data,9,2)&":"&StringMid ($data,11,2)&":"&StringMid ($data,13,2)
Local $macsrc=StringMid ($data,15,2)&":"&StringMid ($data,17,2)&":"&StringMid ($data,19,2)&":"&StringMid ($data,21,2)&":"&StringMid ($data,23,2)&":"&StringMid ($data,25,2)
Local $ethertype=BinaryMid ( $data, 13 ,2 )

If $ethertype="0x0806" Then return "ARP "&$macsrc&" -> "&$macdst

If $ethertype="0x0800" Then
Local $src=Number(BinaryMid ($data, 27 ,1))&"."&Number(BinaryMid ($data, 28 ,1))&"."&Number(BinaryMid ($data, 29 ,1))&"."&Number(BinaryMid ($data, 30 ,1))
Local $dst=Number(BinaryMid ($data, 31 ,1))&"."&Number(BinaryMid ($data, 32 ,1))&"."&Number(BinaryMid ($data, 33 ,1))&"."&Number(BinaryMid ($data, 34 ,1))
Switch BinaryMid ($data, 24 ,1)
Case "0x01"
   return "ICMP "&$src&" -> "&$dst
Case "0x02"
   return "IGMP "&$src&" -> "&$dst
Case "0x06"
Local $srcport=Number(BinaryMid ($data, 35 ,1))*256+Number(BinaryMid ($data, 36 ,1))
Local $dstport=Number(BinaryMid ($data, 37 ,1))*256+Number(BinaryMid ($data, 38 ,1))
Local $flags=BinaryMid ($data, 48 ,1)
Local $f=""
If BitAND($flags,0x01) Then $f="Fin "
If BitAND($flags,0x02) Then $f&="Syn "
If BitAND($flags,0x04) Then $f&="Rst "
If BitAND($flags,0x08) Then $f&="Psh "
If BitAND($flags,0x10) Then $f&="Ack "
If BitAND($flags,0x20) Then $f&="Urg "
If BitAND($flags,0x40) Then $f&="Ecn "
If BitAND($flags,0x80) Then $f&="Cwr "
$f=StringTrimRight(StringReplace($f," ",","),1)
return "TCP("&$f&") "&$src&":"&$srcport&" -> "&$dst&":"&$dstport
Case "0x11"
Local $srcport=Number(BinaryMid ($data, 35 ,1))*256+Number(BinaryMid ($data, 36 ,1))
Local $dstport=Number(BinaryMid ($data, 37 ,1))*256+Number(BinaryMid ($data, 38 ,1))
return "UDP "&$src&":"&$srcport&" -> "&$dst&":"&$dstport
Case Else
return "IP "&BinaryMid ($data, 24 ,1)&" "&$src&" -> "&$dst
EndSwitch
return BinaryMid ( $data, 13 ,2 )&" "&$src&" -> "&$dst
EndIf

If $ethertype="0x8137" OR $ethertype="0x8138" OR $ethertype="0x0022" OR $ethertype="0x0025" OR $ethertype="0x002A" OR $ethertype="0x00E0" OR $ethertype="0x00FF" Then
return "IPX "&$macsrc&" -> "&$macdst
EndIf

return "["&$ethertype&"] "&$macsrc&" -> "&$macdst
EndFunc引用文件 winpcap.au3; Winpcap autoit3 UDF - V1.2c
; Copyleft GPL3 Nicolas Ricquemaque 2009-2011
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Run_AU3Check=n
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
; *********************** Initialisation functions **************************
Global $Pcap_dll
Global $Pcap_errbuf
Global $Pcap_ptrhdr
Global $Pcap_ptrpkt
Global $Pcap_statV ; Total volume captured
Global $Pcap_statN ; Total number of packets captured
Global $Pcap_starttime ; Start time of Capture
Global $Pcap_timebias

Func _PcapSetup() ; return WinPCAP version as full text or -1 if winpcap is not installed, and opens dll
If Not FileExists( @SystemDir & "\wpcap.dll") Then return -1
$Pcap_dll=DllOpen ( @SystemDir & "\wpcap.dll" )
$Pcap_errbuf = DLLStructCreate("char")
$Pcap_ptrhdr=0
$Pcap_ptrpkt=0
$Pcap_timebias = (2^32 - RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation", "ActiveTimeBias")) * 60
Local $v = DllCall($Pcap_dll, "str:cdecl", "pcap_lib_version")
if (@error > 0) Then return -1
return $v
EndFunc

Func _PcapFree() ; free resources opened by _PcapSetup
DllClose($Pcap_dll)
EndFunc

; *********************** Information functions **************************

Func _PcapGetLastError($pcap=0) ; returns text from last pcap error
If NOT IsPtr($pcap) Then return DllStructGetData($Pcap_errbuf,1)
Local $v = DllCall($Pcap_dll, "str:cdecl", "pcap_geterr","ptr",$pcap)
return DllStructGetData($Pcap_errbuf,1)&$v
EndFunc

Func _PcapGetDeviceList() ; returns 2D array with pcap devices (name;desc;mac;ipv4_addr;ipv4_netmask;ipv4_broadaddr;ipv6_addr;ipv6_netmask;ipv6_broadaddr;flags) or -1 if error
Local $alldevs=DLLStructCreate("ptr")
Local $r=DllCall($Pcap_dll, "int:cdecl", "pcap_findalldevs_ex", "str", "rpcap://", "ptr", 0, "ptr", DllStructGetPtr($alldevs), "ptr", DllStructGetPtr($Pcap_errbuf))
if (@error > 0) Then return -1
if $r=-1 Then return -1
Local $next=DllStructGetData($alldevs,1)
Local $list
Local $i=0;
while ($next<>0)
Local $pcap_if = DllStructCreate("ptr next;ptr name;ptr desc;ptr addresses;uint flags",$next)
Local $len_name = DllCall("kernel32.dll", "int", "lstrlen", "ptr", DllStructGetData($pcap_if,2))
Local $len_desc = DllCall("kernel32.dll", "int", "lstrlen", "ptr", DllStructGetData($pcap_if,3))
$list[$i]=DllStructGetData(DllStructCreate("char["&($len_name+1)&"]",DllStructGetData($pcap_if,2)),1)
$list[$i]=DllStructGetData(DllStructCreate("char["&($len_desc+1)&"]",DllStructGetData($pcap_if,3)),1)
Local $next_addr=DllStructGetData($pcap_if,"addresses")

; retrieve mac address
Local $device=StringTrimLeft($list[$i],8)
Local $snames = DllStructCreate("char Name["&(StringLen($device)+1)&"]")
DllStructSetData($snames,1,$device)
Local $handle=DllCall("packet.dll", "ptr:cdecl", "PacketOpenAdapter", "ptr", DllStructGetPtr($snames))
If IsPtr($handle) Then
Local $packetoiddata = DllStructCreate("ulong oid;ulong length;ubyte data")
DllStructSetData($packetoiddata,1,0x01010102); OID_802_3_CURRENT_ADDRESS
DllStructSetData($packetoiddata,2,6)
Local $status=DllCall("packet.dll", "byte:cdecl", "PacketRequest", "ptr", $handle,"byte",0,"ptr",DllStructGetPtr($packetoiddata))
If $status Then
Local $mac=DllStructGetData($packetoiddata,3)
$list[$i]=StringMid($mac,3,2)&":"&StringMid($mac,5,2)&":"&StringMid($mac,7,2)&":"&StringMid($mac,9,2)&":"&StringMid($mac,11,2)&":"&StringMid($mac,13,2)
EndIf
Local $nettype = DllStructCreate("uint type;uint64 speed")
$status=DllCall("packet.dll", "byte:cdecl", "PacketGetNetType", "ptr", $handle, "ptr", DllStructGetPtr($nettype))
If $status Then
$list[$i]=DllStructGetData($nettype,2)
EndIf
DllCall("packet.dll", "none:cdecl", "PacketCloseAdapter", "ptr", $handle)
EndIf

; retrieve lintypes
Local $pcap=_PcapStartCapture($list[$i],"host 1.2.3.4",0,32)
If IsPtr($pcap) Then
Local $types=_PcapGetLinkType($pcap)
If IsArray($types) Then
$list[$i]=$types
$list[$i]=$types
$list[$i]=$types
EndIf
_PcapStopCapture($pcap)
EndIf

; retrieve ip addresses
while $next_addr<>0
Local $pcap_addr = DllStructCreate("ptr next;ptr addr;ptr netmask;ptr broadaddr;ptr dst",$next_addr)
Local $j,$addr
For $j=2 to 4
$addr=_PcapSock2addr(DllStructGetData($pcap_addr,$j))
If StringLen($addr)>15 Then
$list[$i][$j+8]=$addr
ElseIf StringLen($addr)>6 Then
$list[$i][$j+5]=$addr
EndIf
Next
$next_addr=DllStructGetData($pcap_addr,1)
Wend

$list[$i]=DllStructGetData($pcap_if,5)
$next=DllStructGetData($pcap_if,1)
$i+=1
if $next<>0 Then Redim $list[$i+1]
Wend
DllCall($Pcap_dll, "none:cdecl", "pcap_freealldevs", "ptr", DllStructGetData($alldevs,1))
return $list
EndFunc

Func _PcapGetLinkType($pcap) ; returns a array with LinkType for opened capture $pcap. : int value of link type, name of linktype, description of linktype
If NOT IsPtr($pcap) Then return -1
Local $type
Local $t=DllCall($Pcap_dll, "int:cdecl", "pcap_datalink", "ptr", $pcap)
$type=$t
Local $name=DllCall($Pcap_dll, "str:cdecl", "pcap_datalink_val_to_name", "int", $t)
$type=$name
Local $desc=DllCall($Pcap_dll, "str:cdecl", "pcap_datalink_val_to_description", "int", $t)
$type=$desc
return $type
EndFunc

Func _PcapListLinkTypes($pcap) ; returns a 2D array with possible LinkTypes for opened capture $pcap. For each one: : int value of link type, name of linktype, description of linktype
If NOT IsPtr($pcap) Then return -1
Local $ptr=DLLStructCreate("ptr")
Local $n=DllCall($Pcap_dll, "int:cdecl", "pcap_list_datalinks", "ptr", $pcap,"ptr",DllStructGetPtr($ptr))
if $n<1 then return -1
Local $dlts=DLLStructCreate("int["&$n&"]",DllStructGetData($ptr,1))
Local $i,$name,$desc
Local $types[$n]
For $i=0 to $n-1
$types[$i]=DllStructGetData($dlts,1,$i+1)
$name=DllCall($Pcap_dll, "str:cdecl", "pcap_datalink_val_to_name", "int", $types[$i])
$types[$i]=$name
$desc=DllCall($Pcap_dll, "str:cdecl", "pcap_datalink_val_to_description", "int", $types[$i])
$types[$i]=$desc
Next
return $types
EndFunc

Func _PcapSetLinkType($pcap,$dlt)
If NOT IsPtr($pcap) Then return -1
Local $n=DllCall($Pcap_dll, "int:cdecl", "pcap_set_datalink", "ptr", $pcap,"int",$dlt)
return $n
EndFunc

Func _PcapGetStats($pcap) ; returns array =received packets =droped packets by driver =dropped packets by if =captured packets =Captured volume in bytes =time in ms since beginning
If NOT IsPtr($pcap) Then return -1
Local $statsize=DLLStructCreate("int")
Local $s=DllCall($Pcap_dll, "ptr:cdecl", "pcap_stats_ex", "ptr", $pcap, "ptr", DllStructGetPtr($statsize))
If $s=0 Then return -1
Local $stats=DLLStructCreate("uint recv;uint drop;uint ifdrop;uint capt",$s)
Local $ps
$ps=DllStructGetData($stats,1)
$ps="Packets received by Interface"
$ps=DllStructGetData($stats,2)
$ps="Packets dropped by WinPcap"
$ps=DllStructGetData($stats,3)
$ps="Packets dropped by Interface"
$ps=DllStructGetData($stats,4)
$ps="Packets captured"
$ps=$PCap_statV
$ps="Bytes in packets captured"
$ps=int(TimerDiff($Pcap_starttime))
$ps="mS since capture start"
return $ps
EndFunc

; *********************** Capture functions **************************

Func _PcapStartCapture($DeviceName,$filter="",$promiscuous=0,$PacketLen=65536,$buffersize=0,$realtime=1) ; start a capture in non-blocking mode on device $DeviceName with optional parameters: $PacketLen, $promiscuous, $filter. Returns -1 on failure or pcap handler
Local $handle=DllCall($Pcap_dll, "ptr:cdecl", "pcap_open", "str", $DeviceName, "int", $PacketLen, "int",$promiscuous,"int",1000,"ptr",0,"ptr", DllStructGetPtr($Pcap_errbuf) )
if (@error > 0) Then return -1
if ($handle = 0) Then return -1
DllCall($Pcap_dll, "int:cdecl", "pcap_setnonblock", "ptr", $handle, "int", 1, "ptr", DllStructGetPtr($Pcap_errbuf))
if ($filter<>"") Then
Local $fcode=DLLStructCreate("UINT;ptr")
Local $comp=DllCall($Pcap_dll, "int:cdecl", "pcap_compile", "ptr", $handle, "ptr", DllStructGetPtr($fcode), "str", $filter,"int", 1, "int",0)
if ($comp=-1) Then
Local $v = DllCall($Pcap_dll, "str:cdecl", "pcap_geterr","ptr",$handle)
DLLStructSetData($Pcap_errbuf,1,"Filter: "&$v)
_PcapStopCapture($handle)
return -1
EndIf
Local $set=DllCall($Pcap_dll, "int:cdecl", "pcap_setfilter", "ptr", $handle, "ptr", DllStructGetPtr($fcode))
if ($set=-1) Then
Local $v = DllCall($Pcap_dll, "str:cdecl", "pcap_geterr","ptr",$handle)
DLLStructSetData($Pcap_errbuf,1,"Filter: "&$v)
_PcapStopCapture($handle)
return -1
DllCall($Pcap_dll, "none:cdecl", "pcap_freecode", "ptr", $fcode)
EndIf
EndIf
If $buffersize>0 Then DllCall($Pcap_dll, "int:cdecl", "pcap_setbuff", "ptr", $handle, "int", $buffersize)
If $realtime Then DllCall($Pcap_dll, "int:cdecl", "pcap_setmintocopy", "ptr", $handle, "int", 1)
$Pcap_statV=0
$Pcap_statN=0
$Pcap_starttime=TimerInit()
return $handle
EndFunc

Func _PcapStopCapture($pcap) ; stop capture started with _PcapStartCapture
If NOT IsPtr($pcap) Then return
DllCall($Pcap_dll, "none:cdecl", "pcap_close", "ptr", $pcap)
EndFunc

Func _PcapGetPacket($pcap) ; return 0: timeout, -1:error, -2:EOF in file or if successfull array=time =captured len =packet len =packet data
If NOT IsPtr($pcap) Then return -1
$Pcap_ptrhdr=DllStructCreate ("ptr")
$Pcap_ptrpkt=DllStructCreate ("ptr")
Local $pk
Local $res = DllCall($Pcap_dll, "int:cdecl", "pcap_next_ex","ptr",$pcap, "ptr",DllStructGetPtr($Pcap_ptrhdr),"ptr",DllStructGetPtr($Pcap_ptrpkt))
If ($res<>1) Then return $res
Local $pkthdr=DllStructCreate ( "int s;int us;int caplen;int len",DllStructGetData($Pcap_ptrhdr,1))
Local $packet=DLLStructCreate("ubyte["&DllStructGetData($pkthdr,3)&"]",DllStructGetData($Pcap_ptrpkt,1))
Local $time_t=Mod(DllStructGetData($pkthdr,1)+$Pcap_timebias,86400)
$pk=StringFormat ("%02d:%02d:%02d.%06d",int($time_t/3600),int(Mod($time_t,3600)/60),Mod($time_t,60),DllStructGetData($pkthdr,2))
$pk=DllStructGetData($pkthdr,3)
$pk=DllStructGetData($pkthdr,4)
$pk=DllStructGetData($packet,1)
; stats
$Pcap_statV+=$pk
$Pcap_statN+=1
return $pk
EndFunc

Func _PcapSendPacket($pcap,$data) ; data in Binary Format
If NOT IsPtr($pcap) Then return -1
Local $databuffer=DllStructCreate ("ubyte["&BinaryLen($data)&"]")
DLLStructSetData($databuffer,1,$data)
Local $r=DllCall($Pcap_dll, "int:cdecl", "pcap_sendpacket","ptr",$pcap, "ptr",DllStructGetPtr($databuffer),"int",BinaryLen($data))
return $r
EndFunc

Func _PcapDispatchToFunc($pcap,$func) ; call $func with an data array as parameters as many times as there are packets in buffer, then returns the number of packets read or -1 (error) or -2 (break received)
If NOT IsPtr($pcap) Then return -1
Local $CallBack = DLLCallbackRegister ("_PcapHandler", "none:cdecl", "str;ptr;ptr")
If $CallBack=0 Then return -1
Local $r=DllCall($Pcap_dll, "int:cdecl", "pcap_dispatch", "ptr", $pcap, "int",-1, "ptr", DllCallbackGetPtr($CallBack), "str", $func)
DllCallbackFree ( $CallBack )
return $r
EndFunc

Func _PcapHandler($user,$hdr,$data)
Local $pk
Local $pkthdr=DllStructCreate ( "int s;int us;int caplen;int len",$hdr)
Local $packet=DLLStructCreate("ubyte["&DllStructGetData($pkthdr,3)&"]",$data)
Local $time_t=Mod(DllStructGetData($pkthdr,1)+$Pcap_timebias,86400)
$pk=StringFormat ("%02d:%02d:%02d.%06d",int($time_t/3600),int(Mod($time_t,3600)/60),Mod($time_t,60),DllStructGetData($pkthdr,2))
$pk=DllStructGetData($pkthdr,3)
$pk=DllStructGetData($pkthdr,4)
$pk=DllStructGetData($packet,1)
; stats
$Pcap_statV+=$pk
$Pcap_statN+=1
call($user,$pk)
EndFunc

Func _PcapIsPacketReady($pcap)
If NOT IsPtr($pcap) Then return -1
Local $handle=DllCall($Pcap_dll, "ptr:cdecl", "pcap_getevent", "ptr", $pcap)
Local $state = DllCall("kernel32.dll", "dword", "WaitForSingleObject", "ptr", $handle,"dword",0)
return $state=0
EndFunc

; *********************** Save to file functions **************************

Func _PcapSaveToFile($pcap,$filename) ; Open a file to save packets in pcap format
If NOT IsPtr($pcap) Then return -1
Local $save=DllCall($Pcap_dll, "ptr:cdecl", "pcap_dump_open", "ptr", $pcap, "str", $filename)
if $save=0 then return -1
return $save
EndFunc

Func _PcapWriteLastPacket($handle) ; Write the last received packet to file opened by _PcapSaveToFile
if NOT IsPtr($handle) Then return -1
DllCall($Pcap_dll, "none:cdecl", "pcap_dump", "ptr", $handle, "ptr", DllStructGetData($Pcap_ptrhdr,1), "ptr", DllStructGetData($Pcap_ptrpkt,1))
EndFunc

Func _PcapStopCaptureFile($handle) ; Close capture file opened by _PcapSaveToFile
if NOT IsPtr($handle) Then return -1
DllCall($Pcap_dll, "none:cdecl", "pcap_dump_close", "ptr", $handle)
EndFunc

; *********************** Utility functions **************************

Func _PcapSock2addr ($sockaddr_ptr) ; internat function to convert a sockaddr structure into an string containing an IP address
If ($sockaddr_ptr=0) Then return ""
Local $sockaddr = DllStructCreate("ushort family;char data",$sockaddr_ptr)
Local $family=DllStructGetData($sockaddr,1)
If ($family = 2) Then ; AF_INET = IPv4
Local $sockaddr_in = DllStructCreate("short family;ushort port;ubyte addr;char zero",$sockaddr_ptr)
return DllStructGetData($sockaddr_in,3,1)&"."&DllStructGetData($sockaddr_in,3,2)&"."&DllStructGetData($sockaddr_in,3,3)&"."&DllStructGetData($sockaddr_in,3,4)
EndIf
If ($family = 23) Then ; AF_INET6 = IPv6
Local $sockaddr_in6 = DllStructCreate("ushort family;ushort port;uint flow;ubyte addr;uint scope",$sockaddr_ptr)
Local $bin=DllStructGetData($sockaddr_in6,4)
Local $i,$ipv6
For $i=0 to 7
$ipv6&=StringMid($bin,3+$i*4,4)&":"
Next
return StringTrimRight($ipv6,1)
EndIf
return ""
EndFunc

; Extract a $bytes bytes value from a $data binary string, starting from offset $offset (1 for first byte)
Func _PcapBinaryGetVal($data,$offset,$bytes)
Local $val32=Dec(StringMid($data, 3+($offset-1)*2 ,$bytes*2))
If $val32<0 Then return 2^32+$val32
return $val32
EndFunc

; Sets (replaces) a $bytes (up to 8) bytes value $value inside a $data binary string, starting at offset $offset (1 for first byte)
; User should make sure before calling this function that $data contains at least $offset+$bytes binary bytes !
Func _PcapBinarySetVal(Byref $data,$offset,$value,$bytes)
$data=StringReplace($data,3+($offset-1)*2,hex($value,$bytes*2))
EndFunc

; $data is the packet data as a binary string
; $ipoffset is offset to the ip header; 14 bytes by default for an ethernet frame
; one should check before calling this function that data actualy contains an IP packet !
Func _PcapIpCheckSum ($data,$ipoffset=14)
Local $iplen=BitAnd(_PcapBinaryGetVal($data,$ipoffset+1,1),0xF)*4
Local $sum=0,$i
For $i=1 To $iplen step 2
$sum+=BitAnd(0xFFFF,_PcapBinaryGetVal($data,$ipoffset+$i,2))
Next
$sum-=_PcapBinaryGetVal($data,$ipoffset+11,2)
While $sum>0xFFFF
$sum = BitAnd($sum,0xFFFF)+BitShift($sum,16)
Wend
return BitXOR($sum,0xFFFF)
EndFunc

; $data is the packet data as a binary string
; $ipoffset is offset to the ip header; 14 bytes by default for an ethernet frame
; one should check before calling this function that data actualy contains an ICMP packet !
Func _PcapIcmpCheckSum ($data,$ipoffset=14)
Local $iplen=BitAnd(_PcapBinaryGetVal($data,$ipoffset+1,1),0xF)*4
Local $len=_PcapBinaryGetVal($data,$ipoffset+3,2)-$iplen; ip len - ip header len
Local $sum=0,$i
For $i=1 To BitAnd($len,0xFFFE) step 2
$sum+=BitAnd(0xFFFF,_PcapBinaryGetVal($data,$ipoffset+$iplen+$i,2))
Next
If BitAnd($len,1) Then
$sum+=BitAnd(0xFF00,BitShift(_PcapBinaryGetVal($data,$ipoffset+$iplen+$len,1),-8))
EndIf
$sum-=_PcapBinaryGetVal($data,$ipoffset+$iplen+3,2)
While $sum>0xFFFF
$sum = BitAnd($sum,0xFFFF)+BitShift($sum,16)
Wend
return BitXOR($sum,0xFFFF)
EndFunc

; $data is the packet data as a binary string
; $ipoffset is offset to the ip header; 14 bytes by default for an ethernet frame
; one should check before calling this function that data actualy contains a TCP packet !
Func _PcapTcpCheckSum ($data,$ipoffset=14)
Local $iplen=BitAnd(_PcapBinaryGetVal($data,$ipoffset+1,1),0xF)*4
Local $len=_PcapBinaryGetVal($data,$ipoffset+3,2)-$iplen; ip len - ip header len
Local $sum=0,$i
For $i=1 To BitAnd($len,0xFFFE) step 2
$sum+=BitAnd(0xFFFF,_PcapBinaryGetVal($data,$ipoffset+$iplen+$i,2))
Next
If BitAnd($len,1) Then
$sum+=BitAnd(0xFF00,BitShift(_PcapBinaryGetVal($data,$ipoffset+$iplen+$len,1),-8))
EndIf
$sum+=_PcapBinaryGetVal($data,$ipoffset+13,2)+_PcapBinaryGetVal($data,$ipoffset+15,2)+_PcapBinaryGetVal($data,$ipoffset+17,2)+_PcapBinaryGetVal($data,$ipoffset+19,2)+$len+6-_PcapBinaryGetVal($data,$ipoffset+$iplen+17,2) ; tcp pseudo header
While $sum>0xFFFF
$sum = BitAnd($sum,0xFFFF)+BitShift($sum,16)
Wend
return BitXOR($sum,0xFFFF)
EndFunc

; $data is the packet data as a binary string
; $ipoffset is offset to the ip header; 14 bytes by default for an ethernet frame
; one should check before calling this function that data actualy contains a UDP packet !
; Also, if the packet UDP value is set to 0x0000, no need to call this function, it means the CRC is not used in this packet.
Func _PcapUdpCheckSum ($data,$ipoffset=14)
Local $iplen=BitAnd(_PcapBinaryGetVal($data,$ipoffset+1,1),0xF)*4
Local $len=_PcapBinaryGetVal($data,$ipoffset+3,2)-$iplen; ip len - ip header len
Local $sum=0,$i
For $i=1 To BitAnd($len,0xFFFE) step 2
$sum+=BitAnd(0xFFFF,_PcapBinaryGetVal($data,$ipoffset+$iplen+$i,2))
Next
If BitAnd($len,1) Then
$sum+=BitAnd(0xFF00,BitShift(_PcapBinaryGetVal($data,$ipoffset+$iplen+$len,1),-8))
EndIf
$sum+=_PcapBinaryGetVal($data,$ipoffset+13,2)+_PcapBinaryGetVal($data,$ipoffset+15,2)+_PcapBinaryGetVal($data,$ipoffset+17,2)+_PcapBinaryGetVal($data,$ipoffset+19,2)+$len+17-_PcapBinaryGetVal($data,$ipoffset+$iplen+7,2) ; udp pseudo header
While $sum>0xFFFF
$sum = BitAnd($sum,0xFFFF)+BitShift($sum,16)
Wend
Local $crc=BitXOR($sum,0xFFFF)
If $crc=0x0000 Then return 0xFFFF
return $crc
EndFunc

Func _PcapCleanDeviceName($fullname) ; returns a cleaner device name without 'Network adapter ' etc if any
Local $name=StringRegExp($fullname,"^Network adapter '(.*)' on",1)
If @error=0 Then return StringStripWS($name,7)
return StringStripWS($fullname,7)
EndFunc

yorker0503 发表于 2012-10-15 08:54:25

自己搞定了把176行改成If StringInStr($f,"Psh") Then ;此标志为发送数据
return "TCP("&$f&") "&$src&":"&$srcport&" -> "&$dst&":"&$dstport&" Content: " & BinaryToString(BinaryMid ($data,67))
Else
return "TCP("&$f&") "&$src&":"&$srcport&" -> "&$dst&":"&$dstport
EndIf

yorker0503 发表于 2012-10-15 08:55:33

无法改帖子为已解决{:face (270):}

hz453673181 发表于 2012-11-1 14:01:04

好东西，但是看不懂

sdc7 发表于 2013-6-22 13:47:21

不错··看看能修改数据包不··

gb23 发表于 2014-8-3 23:59:23

如此好东西居然没人顶！必须顶！

gb23 发表于 2014-8-4 00:18:19

请问汉字乱码怎么转换啊？弱弱的问数据包中的汉字怎么办啊？

gb23 发表于 2014-8-11 23:33:57

pcap 不懂啊~~~

wozijisun 发表于 2014-10-24 10:30:50

高手你好，我是新手，想问个问题。
1、咱们这个程序是不是能将PCAP包中的所有信息都解析出来？
2、怎么判断某个字段在哪里？比如：sequence。
3、能不能将PCAP中的所有信息按照Wireshark工具打开的顺序输出出来？
其实，这三个问题，好像是一个问题。但是，非常期待你的解答。

wozijisun 发表于 2014-10-24 14:44:22

回复 9# wozijisun

问题已经解决了。

gb23 发表于 2015-1-16 22:32:17

今天再看看~~~此贴值得深研，谢谢楼主的无私！真心的！

qqgghh1 发表于 2015-2-12 11:16:08

快过年了，顶一个。楼主真心无私奉献，抓网络数据包分析真的很有用。可惜小弟基本不懂

x11lang 发表于 2015-2-16 10:43:21

mark，后面慢慢看

yuly 发表于 2015-7-1 17:11:52

无私的人,谢谢,,用的上

页: [1]

AUTOIT CN's Archiver

400RMB 求 用winpcap 抓取网络数据包并提取出http数据包内容

400RMB 求用winpcap 抓取网络数据包并提取出http数据包内容