● Source of Lan Data listening - 荔园在线 | 深圳大学学生论坛,荔园晨风BBS,深大在线网站

荔园之美，在春之萌芽，在夏之绽放，在秋之收获，在冬之沉淀

发信人: Mill (听日), 信区: Hacker
标  题: Source of Lan Data listening
发信站: BBS 荔园晨风站 (Thu Oct 29 00:12:04 1998), 站内信件

ne2000 0x60  should be run before this program runs

if your INT # is different than 0x60 , then you modify
the program receiver.asm : CallInt60

I compile it using BC 3.1

cut the message below into 3 files:
ethhead.h
nethear.c
receiver.asm

/************** ethhead.h **************/
struct EthHead {
char DestAddr[6];
char SousAddr[6];
unsigned int  Type;
char Data[1024];
};
struct IP_PACKET {
unsigned char VerHLen;
unsigned char ServiceType;
unsigned short int TotalLen;
unsigned short int Identif;
unsigned short int FlagOffset;
unsigned char TTL;
unsigned char Protocol;
unsigned short int CheckSum;
unsigned char IPSour[4];
unsigned char IPDest[4];
unsigned char Data[2000];
};

struct TCP_PACKET {
unsigned short int SourPort;
unsigned short int DestPort;
unsigned long  int SerialNo;
unsigned long  int CertifyNo;
unsigned short int HLenCode ;
unsigned short int Window;
unsigned short int CheckSum;
unsigned short int UrgentPtr;
unsigned char  Data[2000];
};
/******************* ethhead.h : above ************/

/********************* the C program *******************/

/*********
         run with 2 args:
   nethear xxx.yyy.zzz.www aaa.bbb.ccc.ddd
   to hear data between the machines with the two IP
   all data between them using IP packet is heard.
*****************/
/*********** the C program should be linked with receive.asm********/

#include    "ethhead.h"
#include        <string.h>
#include        <dos.h>
#include        <stdio.h>
#include        <bios.h>
#include        <conio.h>

extern void far receiver(void);
extern void CallInt60(void);
extern int Handle;
extern struct EthHead AFrame;
extern int GetFlag;
struct EthHead BFrame;
/***********
          you could get more details about
          packet_driver interface
          from many books which are easy to find
*******************/
void InitAll(void)
{
union {
void far (* Afunc)(void);
unsigned int WD[2];
} au;
int dsvar,ahandle;
GetFlag = 0;
au.Afunc = receiver;
dsvar = _DS;
_ES = au.WD[1];
_DI = au.WD[0];
_DS = 0;
_SI = 0;
_CX = 0;
_DL = 0;
_BX = 0xffff;
_AX = 0x0201;
  CallInt60();
  ahandle = _AX;
  _BX = _AX;
  _AH = 20;
  _CX=6;
  CallInt60();
  _DS = dsvar;
  Handle = ahandle;
}
void CloseAll(void)
{
_BX = Handle;
_AH = 3;
CallInt60();
}
/************ convert xx.yy.zz.ww to Integer***********/
void ArgToIP(char * args, unsigned char * sour)
{int i,j[4];
char c;
sscanf(args,"%d%c%d%c%d%c%d",&j[0],&c,&j[1],&c,&j[2],&c,&j[3]);
for(i=0;i<4;i++)
  sour[i] = j[i] ;
}
char ijk[320][140];
int  main(int argc,char * argv[])
{
FILE * fp;
struct IP_PACKET * Iper;
struct TCP_PACKET * Tcper;
unsigned char  dester[]={ 202, 48 , 168 ,31 };
unsigned  char sourer[]={ 202, 48 , 164 ,10 };
unsigned int i,j;
char * CPtr;
unsigned long int * LPtr , l;

   ArgToIP(argv[1],sourer);
   ArgToIP(argv[2],dester);
   InitAll();
  i=0;
  while(kbhit()==0)
  {
   if(GetFlag!=0)
   {GetFlag = 0;
   memcpy(&BFrame,&AFrame,sizeof(BFrame));
      /*  IP Protocol */
   if(BFrame.Type == 8)     /********** IP protocol type: 08 ********/
   {

     Iper = (struct IP_PACKET *) &(BFrame.Data);

      if(memcmp(&(Iper->IPDest),dester,4)==0 ||
         memcmp(&(Iper->IPSour),dester,4)==0 ||
         memcmp(&(Iper->IPDest),sourer,4)==0 ||
         memcmp(&(Iper->IPSour),sourer,4)==0
         )
      {
          i++;
          if(i<320) {
          memcpy(ijk[i],Iper,120);
          }
         }
      }
    }
}
CloseAll();

for(j=0;j<i;j++)
  for(l=120;l<140;l++)
  ijk[j][l] ='!';

fp =fopen("net.hear","a+b");
fwrite(ijk,i,120,fp);
fclose(fp);
return 0;
}
/******************** receive.asm *****************/
RECE_TEXT       segment byte public 'CODE'
DGROUP  group   _DATA,_BSS
        assume  cs:RECE_TEXT,ds:DGROUP
RECE_TEXT       ends
_DATA   segment word public 'DATA'
d@      label   byte
d@w     label   word
_DATA   ends
_BSS    segment word public 'BSS'
b@      label   byte
b@w     label   word
        ?debug  C E93AA22A1F06726563652E63
        ?debug  C E9C0A12A1F09457468486561642E68
        ?debug  C E900101D11115C6E73645C74635C696E635C646F732E68
_BSS    ends
RECE_TEXT       segment byte public 'CODE'
_receiver       proc    far
        push    ax
        push    ds
        push    ax
        assume ds:dgroup
        mov     ax,dgroup
        mov     ds,ax
        pop     ax
        cmp     bx,_Handle
        jnz han_err
        cmp     ax,0
        jnz     second_call
        mov     ax,ds
        mov     es,ax
        mov     di,offset dgroup:_AFrame
        jmp done
no_buf:
        xor di,di
        mov es,di
        jmp done
han_err:
        cmp ax,0
        jnz done
        jmp no_buf
second_call:
        mov _GetFlag,1
done:   pop ds
        pop ax
        ret
_receiver       endp
_CallInt60      proc    far
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;; you perhaps shloud change 60h to other #
;;;;;;;;;;;;;;;;if you packer Driver does not use 0x60
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
        int 60h
        ret
_CallInt60      endp
RECE_TEXT       ends
_BSS    segment word public 'BSS'
_AFrame label   word
        db      2063 dup (?)
_Handle label   word
        db      2 dup (?)
_GetFlag        label   word
        db      2 dup (?)
_BSS    ends
_DATA   segment word public 'DATA'
s@      label   byte
_DATA   ends
RECE_TEXT       segment byte public 'CODE'
RECE_TEXT       ends
        public  _receiver
        public  _GetFlag
        public  _Handle
        public  _AFrame
        public  _CallInt60
        end
/*************************************/

--
取下天上的月亮后，我拿给你  Email:s7110109@szu.eud.cn  Icq:11869999  MacroBird
                         ┏━━━━━━━━━━━━━┯┓
                         ┃ 弃我去者,昨日之日不可留, ┕┫
                         ┃ 乱我心者,今日之日多烦忧。  ┃
                         ┗━━━━━━━━━━━━━━┛
Mill           MacroBird

※ 来源:．BBS 荔园晨风站 bbs.szu.edu.cn．[FROM: 192.168.0.167]

荔园在线首页友情链接：深圳大学深大招生荔园晨风BBS S-Term软件网络书店