请问vc里面获得一个进程的tcp/ip连接 应该用什么方法

[xia0cai]

要做一个监控进程的东西
获得一个进程的tcp/ip 连接的api是什么
谢谢

[masterz]

搜索AllocateAndGetTcpExTableFromStack/AllocateAndGetUdpExTableFromStack

[qrlvls]

转帖自绿盟：

枚举打开端口最简单的方法是调用AllocateAndGetTcpTableFromStack和AllocateAndGetUdpTableFromStack函数，或者AllocateAndGetTcpExTableFromStack和AllocateAndGetUdpExTableFromStack函数，它们都来自iphlpapi.dll。带Ex的函数从Windows XP才开始有效。


typedef struct _MIB_TCPROW {
DWORD dwState;
DWORD dwLocalAddr;
DWORD dwLocalPort;
DWORD dwRemoteAddr;
DWORD dwRemotePort;
} MIB_TCPROW, *PMIB_TCPROW;

typedef struct _MIB_TCPTABLE {
DWORD dwNumEntries;
MIB_TCPROW table[ANY_SIZE];
} MIB_TCPTABLE, *PMIB_TCPTABLE;

typedef struct _MIB_UDPROW {
DWORD dwLocalAddr;
DWORD dwLocalPort;
} MIB_UDPROW, *PMIB_UDPROW;

typedef struct _MIB_UDPTABLE {
DWORD dwNumEntries;
MIB_UDPROW table[ANY_SIZE];
} MIB_UDPTABLE, *PMIB_UDPTABLE;

typedef struct _MIB_TCPROW_EX
{
DWORD dwState;
DWORD dwLocalAddr;
DWORD dwLocalPort;
DWORD dwRemoteAddr;
DWORD dwRemotePort;
DWORD dwProcessId;
} MIB_TCPROW_EX, *PMIB_TCPROW_EX;

typedef struct _MIB_TCPTABLE_EX
{
DWORD dwNumEntries;
MIB_TCPROW_EX table[ANY_SIZE];
} MIB_TCPTABLE_EX, *PMIB_TCPTABLE_EX;

typedef struct _MIB_UDPROW_EX
{
DWORD dwLocalAddr;
DWORD dwLocalPort;
DWORD dwProcessId;
} MIB_UDPROW_EX, *PMIB_UDPROW_EX;

typedef struct _MIB_UDPTABLE_EX
{
DWORD dwNumEntries;
MIB_UDPROW_EX table[ANY_SIZE];
} MIB_UDPTABLE_EX, *PMIB_UDPTABLE_EX;

DWORD WINAPI AllocateAndGetTcpTableFromStack(
OUT PMIB_TCPTABLE *pTcpTable,
IN BOOL bOrder,
IN HANDLE hAllocHeap,
IN DWORD dwAllocFlags,
IN DWORD dwProtocolVersion;
);

DWORD WINAPI AllocateAndGetUdpTableFromStack(
OUT PMIB_UDPTABLE *pUdpTable,
IN BOOL bOrder,
IN HANDLE hAllocHeap,
IN DWORD dwAllocFlags,
IN DWORD dwProtocolVersion;
);

DWORD WINAPI AllocateAndGetTcpExTableFromStack(
OUT PMIB_TCPTABLE_EX *pTcpTableEx,
IN BOOL bOrder,
IN HANDLE hAllocHeap,
IN DWORD dwAllocFlags,
IN DWORD dwProtocolVersion;
);

DWORD WINAPI AllocateAndGetUdpExTableFromStack(
OUT PMIB_UDPTABLE_EX *pUdpTableEx,
IN BOOL bOrder,
IN HANDLE hAllocHeap,
IN DWORD dwAllocFlags,
IN DWORD dwProtocolVersion;
);



还有另外一种方法。当程序创建了一个套接字并开始监听时，它就会有一个为它和打开端口的打开句柄。我们在系统中枚举所有的打开句柄并通过NtDeviceIoControlFile把它们发送到一个特定的缓冲区中，来找出这个句柄是否是一个打开端口的。这样也能给我们有关端口的信息。因为打开句柄太多了，所以我们只检测类型是File并且名字是\Device\Tcp或\Device\Udp的。打开端口只有这种类型和名字。

如果你看一下iphlpapi.dll里函数的代码，就会发现这些函数同样调用NtDeviceIoControlFile并发送到一个特定缓冲区来获得系统中所有打开端口的列表。这意味着我们要想隐藏端口只需要挂钩NtDeviceIoControlFile函数。

NTSTATUS NtDeviceIoControlFile(
IN HANDLE FileHandle
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG IoControlCode,
IN PVOID InputBuffer OPTIONAL,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer OPTIONAL,
IN ULONG OutputBufferLength
);

我们感兴趣的成员变量有这几个:FileHandle标明了要通信的设备的句柄，IoStatusBlock指向接收最后完成状态和请求操作信息的变量，IoControlCode是指定要完成的特定的I/O控制操作的数字，InputBuffer包含了输入的数据，长度为按字节计算的InputBufferLength，相似的还有OutputBuffer和OutputBufferLength。

[qrlvls]

需要安装 Platform SDK
http://www.microsoft.com/downloads/details.aspx?FamilyID=EBA0128F-A770-45F1-86F3-7AB010B398A3&displaylang=en

[AntonlioX]

mark
up