本帖最后由 kennedy_98 于 2016-12-2 10:47 编辑
写一个应该是很简单的进程检测工具,pc1发请求检测pc2上的某个进程是否存在,抓包看每一次请求都成功返回了,抓包就结果如下:
一次请求返回3条tcp消息
1、
0000 44 37 e6 3a 24 aa 1c 6f 65 05 8a df 08 00 45 00 D7.:$..o e.....E.
0010 00 34 2e 70 40 00 80 06 4b 13 0a 2f b6 df 0a 2f .4.p@... K../.../
0020 b6 03 45 71 f0 a5 18 9f 12 e3 75 b1 f5 30 80 12 ..Eq.... ..u..0..
0030 20 00 01 44 00 00 02 04 05 b4 01 03 03 08 01 01 ..D.... ........
0040 04 02
2、我检测的notepad.exe进程结果就在这条消息里
0000 44 37 e6 3a 24 aa 1c 6f 65 05 8a df 08 00 45 00 D7.:$..o e.....E.
0010 00 50 2e 71 40 00 80 06 4a f6 0a 2f b6 df 0a 2f .P.q@... J../.../
0020 b6 03 45 71 f0 a5 18 9f 12 e4 75 b1 f5 31 50 18 ..Eq.... ..u..1P.
0030 01 00 a5 bb 00 00 31 30 2e 34 37 2e 31 38 32 2e ......10 .47.182.
0040 32 32 33 6e 6f 74 65 70 61 64 2e 65 78 65 2d 2d 223notep ad.exe--
0050 2d 2d 2d 50 49 44 3a 20 35 32 31 32 0d 0a ---PID: 5212..
3、
0000 44 37 e6 3a 24 aa 1c 6f 65 05 8a df 08 00 45 00 D7.:$..o e.....E.
0010 00 28 2e 72 40 00 80 06 4b 1d 0a 2f b6 df 0a 2f .(.r@... K../.../
0020 b6 03 45 71 f0 a5 18 9f 13 0c 75 b1 f5 31 50 14 ..Eq.... ..u..1P.
0030 00 00 61 ea 00 00 00 00 00 00 00 00 ..a..... ....
但有一个问题,就是tcprecv()时常为空,不是显示控件的问题,用msg打印$recv也是空的,不知道哪里有问题,请高手帮忙指点,两侧的代码如下:
pc1侧代码(请求查询进程并显示返回值的子程序)Func prochk2()
;$a=223
$a= 223
Local $szIPADDRESS = "10.47.182."&$a
Local $nPORT = 17777
Local $ConnectedSocket, $szData
;MsgBox(0,"O(∩_∩)O","启动完毕")
TCPStartup()
; 初始化变量
;==============================================
$ConnectedSocket = -1
$ConnectedSocket = TCPConnect($szIPADDRESS, $nPORT)
; 错误提示
If @error Then
MsgBox(4112, "错误", "TCPConnect 失败于 WSA 错误: " & @error)
Else
Local $szData1=3
$szData=StringToBinary($szData1,4)
TCPSend($ConnectedSocket, $szData)
While 1
$recv = BinaryToString(TCPRecv($ConnectedSocket,2048),4)
If @error Then ExitLoop
;$recv = BinaryToString ($recv,4)
MsgBox(0,"O(∩_∩)O",$recv)
If $recv <> "" Then GUICtrlSetData($edit, $recv & @CRLF )
If @error Or $recv = "" Then ExitLoop
WEnd
If $ConnectedSocket <> -1 Then TCPCloseSocket($ConnectedSocket)
TCPShutdown()
EndIf
TCPShutdown()
EndFunc
pc2侧代码Example()
Func Example()
While 1
tcpstar()
WEnd
EndFunc ;==>Example
Func tcpstar()
Global $szIPADDRESS = "10.47.182.223"
Local $nPORT = 17777
Global $MainSocket, $GOOEY, $edit, $ConnectedSocket, $szIP_Accepted
Local $msg, $recv
TCPStartup()
$MainSocket = TCPListen($szIPADDRESS,$nPORT)
$ConnectedSocket = -1
Do
$Connectedsocket=TCPAccept($MainSocket)
Until $ConnectedSocket<> -1
While 1
$recv = TCPRecv($ConnectedSocket, 2048,1)
If @error Then ExitLoop
$recv=BinaryToString($recv,4)
If $recv == "1" Then Run ("notepad.exe")
If $recv == "2" Then Run ("cmd.exe")
If $recv == "3" Then procheck()
WEnd
If $ConnectedSocket <> -1 Then TCPCloseSocket($ConnectedSocket)
TCPShutdown()
EndFunc
Func procheck()
Global $i
Local $aProcessList = ProcessList("notepad.exe")
For $i = 1 To $aProcessList[0][0]
Local $senddata=StringToBinary($szIPADDRESS&$aProcessList[$i][0] & "-----" & "PID: " & $aProcessList[$i][1]& @CRLF,4)
;MsgBox($MB_SYSTEMMODAL, "", $aProcessList[$i][0] & "-----" & "PID: " & $aProcessList[$i][1]& @CRLF)
TCPSend($ConnectedSocket,$senddata)
Next
If $aProcessList[0][0]= 0 Then TCPSend($ConnectedSocket,$szIPADDRESS &"null"&@CRLF)
TCPShutdown()
EndFunc
|