使用WINPCAP时使用pcap_loop()出错

[凄凄迷人]

使用VISUAL STUDIO6.0开写一个小的SNIFFER，用WINPCAP的函数
获取驱动列表及打开网卡都可以。但是执行到pcap_loop的时候（
用pcap_dispatch()也一样）出现
First-chance exception in mysniffer.exe (KERNEL32.DLL): 0xC0000005: Access Violation.
这种错误。
网上看过出现的情况都是调用pcap_findalldevs的时候出这个错误。不知道咋回事。


代码如下：
// 监听结果处理
void dispatcher_handler(u_char *temp1, const pcap_pkthdr *header, const u_char *pkt_data)
{
ResultPacket packet;
ip_header *ih;
udp_header *uh;
u_int ip_len;
u_short sport, dport;

ih = (ip_header *)(pkt_data + 14);

ip_len = (ih->ver_ihl & 0xf) * 4;
uh = (udp_header *)((u_char*)ih + ip_len);

sport = uh->sport;
dport = uh->dport;

CString sip_str,sport_str,dip_str,dport_str,proto_str;
sip_str.Format("%s.%s.%s.%s", ih->saddr.byte1, ih->saddr.byte2, ih->saddr.byte3, ih->saddr.byte4);
dip_str.Format("%s.%s.%s.%s", ih->daddr.byte1, ih->daddr.byte2, ih->daddr.byte3, ih->daddr.byte4);
sport_str.Format("%d", sport);
dport_str.Format("%d", dport);
proto_str.Format("%s", ih->proto);

packet.m_sip = sip_str;
packet.m_sport = sport_str;
packet.m_dip = dip_str;
packet.m_dport = dport_str;
packet.m_content = _T("teststr");

CMainFrame *frame = (CMainFrame*)(AfxGetApp()->GetMainWnd());
frame->m_dlgResult.AddItem(packet); //显示结果
}

// 监听函数
UINT do_listen(LPVOID pparam)
{
CMainFrame *frame = (CMainFrame*)(AfxGetApp()->GetMainWnd());
//执行到此处出错。进不去这个函数
pcap_loop(frame->ahandle, 0, dispatcher_handler, NULL);
return 0;
}

[lingyin55]

CMainFrame *frame = (CMainFrame*)(AfxGetApp()->GetMainWnd());
执行完上面那句之后先判断一下指针frame是否为空。

[凄凄迷人]

谢谢楼上。
不过在那一句下断点看到FRAME正常的，里面的属性值也都正常。
而且把pcap_loop的参数都设为空也报同样的错误。。。晕了

[lingyin55]

The first-chance exception can be ignored because it is safely handled by the operating system.
INFO: First and Second Chance Exception Handling (Q105675)
Structured exception handling (SEH) takes a little getting used to, particularly when debugging. It is common practice to use SEH as a signaling mechanism. Some application programming interfaces (APIs) register an exception handler in anticipation of a failure condition that is expected to occur in a lower layer. When the exception occurs, the handler may correct or ignore the condition rather than allowing a failure to propagate up through intervening layers. This is very handy in complex environments such as networks where partial failures are expected and it is not desirable to fail an entire operation simply because one of several optional parts failed. In this case, the exception can be handled so that the application is not aware that an exception has occurred.

However, if the application is being debugged, it is important to realize that the debugger will see all exceptions before the program does. This is the distinction between the first and second chance exception. The debugger gets the "first chance," hence the name. If the debugger continues the exception unhandled, the program will see the exception as usual. If the program does not handle the exception, the debugger will see it again (the "second chance"). In this latter case, the program normally would have crashed had the debugger not been present.

If you do not want to see the first chance exception in the debugger, then disable the feature. Otherwise, during execution, when the debugger gets the first chance, continue the exception unhandled and allow the program to handle the exception as usual. Check the documentation for the debugger that you are using for descriptions of the commands to be used.

[lingyin55]

通常见到的“First-chance exception”一般是“0xC0000005: Access Violation”，“0xC00000FD: Stack Overflow”等，这些都说明程序中有缺陷，需要修正。
　　但是也有一些属于正常的情况，例如“First-chance exception in xxx.exe (KERNEL32.DLL): 0xE06D7363: Microsoft C++ Exception”。Windows 操作系统中广泛使用了结构化异常（SEH）来处理特殊情况，许多和底层打交道的API都靠SEH来处理可能发生的意外。并且，这些API中都有捕获SEH的代码，产生的异常不会对程序造成影响。但是由于上面提到的“First-chance exception，Second-chance exception”机制，VC仍然会有输出，但是我们完全可以忽略。如果你实在不喜欢这些输出信息，那你就必须禁用对特定异常的“First-chance exception”捕获。

[凄凄迷人]

搞定了。。OVER