English: MIB_TCP ends TCPtable MIB_TCP oldWinVer db 0 APIaddress dd 0 hProcess dd 0 null dd 0 APImemAlloc dd 0 APIptr dd 0 memAlloc dd 0 SetTcpEntryAPI dd 0 bytesWritten dd 0 stdout dd 0 ip_string db 16 dup (0) port_string db 5 dup (0) searchRemAddr dd 0 searchRemPort dd 0 outBuffer db 150 dup (0) ; ==================================================================== .code start: ; get console handle : call GetStdHandle, -11 mov stdout, eax call Write2Console, offset copyrightMsg ; look for iphlpapi.dll : call LoadLibraryA, offset DLLname test eax, eax jnz DLL_found push offset DLLnotfoundMsg jmp quit DLL_found: mov null, eax ; look for AllocateAndGetTcpExTableFromStack : call GetProcAddress, eax, offset winOldAPIname test eax, eax jz isNewer mov oldWinVer, 1 mov APIaddress, eax call GetProcessHeap mov hProcess, eax jmp API_found isNewer: ; look for GetExtendedTcpTable : call GetProcAddress, null, offset winNewApiName test eax, eax jnz isNewer2 push offset APInotfoundMsg jmp quit isNewer2: mov APIaddress, eax ; allocate a 10Kb buffer for the TcpTable : call GlobalAlloc, 42h, 10240 ; GHND mov APImemAlloc, eax call GlobalLock, eax mov APIptr, eax API_found: ; look for SetTcpEntry : call GetProcAddress, null, offset SetTcpEntry test eax, eax jnz saveTcpEntry push offset SetTcpErrMsg jmp quit saveTcpEntry: mov SetTcpEntryAPI, eax ; fetch command line parameters : call GetCommandLineA ; parse it : call ParseCmdLine test eax, eax jz display_lookingMsg push offset syntaxMsg jmp quit display_lookingMsg: ; display what we are looking for : call _wsprintfA, offset outBuffer, offset lookingMsg, \ offset ip_string, offset port_string add esp, 4*4 call Write2Console, offset outBuffer ; convert IP/port to network byte order : call inet_addr, offset ip_string cmp eax, 0ffffffffh jne convert_port push offset endianErrMsg jmp quit convert_port: mov searchRemAddr, eax mov esi, offset port_string xor ecx, ecx xor eax, eax mov bl, 9 cld convert_port_loop: lodsb sub al, '0' js convert_port_end_loop cmp al, bl ja convert_port_end_loop lea ecx, [ecx+4*ecx] lea ecx, [2*ecx+eax] jmp short convert_port_loop convert_port_end_loop: push ecx call htons cmp eax, 0ffffffffh jne convert_port2 push offset endianErrMsg jmp quit convert_port2: mov searchRemPort, eax cmp oldWinVer, 1 jnz GetExtendedTcpTable ; AllocateAndGetTcpExTableFromStack : call dword ptr [APIaddress], offset APIptr, 0, \ hProcess, 0, 2 test eax, eax ; ERROR_SUCCESS ?
French: MIB_TCP ends TCPtable MIB_TCP oldWinVer db 0 APIaddress dd 0 hProcess dd 0 null dd 0 APImemAlloc dd 0 APIptr dd 0 memAlloc dd 0 SetTcpEntryAPI dd 0 bytesWritten dd 0 stdout dd 0 ip_string db 16 dup (0) port_string db 5 dup (0) searchRemAddr dd 0 searchRemPort dd 0 outBuffer db 150 dup (0) ; ==================================================================== .code start: ; récupère le handle de la console : call GetStdHandle, -11 mov stdout, eax call Write2Console, offset copyrightMsg ; charge iphlpapi.dll : call LoadLibraryA, offset DLLname test eax, eax jnz DLL_found push offset DLLnotfoundMsg jmp quit DLL_found: mov null, eax ; recherche AllocateAndGetTcpExTableFromStack : call GetProcAddress, eax, offset winOldAPIname test eax, eax jz isNewer mov oldWinVer, 1 mov APIaddress, eax call GetProcessHeap mov hProcess, eax jmp API_found isNewer: ; recherche GetExtendedTcpTable : call GetProcAddress, null, offset winNewApiName test eax, eax jnz isNewer2 push offset APInotfoundMsg jmp quit isNewer2: mov APIaddress, eax ; alloue un buffer de 10Ko pour TcpTable : call GlobalAlloc, 42h, 10240 ; GHND mov APImemAlloc, eax call GlobalLock, eax mov APIptr, eax API_found: ; recherche le point d'entrée de SetTcpEntry : call GetProcAddress, null, offset SetTcpEntry test eax, eax jnz saveTcpEntry push offset SetTcpErrMsg jmp quit saveTcpEntry: mov SetTcpEntryAPI, eax ; récupère les paramètres de ligne de commande : call GetCommandLineA ; récupère l'IP/port : call ParseCmdLine test eax, eax jz display_lookingMsg push offset syntaxMsg jmp quit display_lookingMsg: ; affiche ce que l'on cherche : call _wsprintfA, offset outBuffer, offset lookingMsg, \ offset ip_string, offset port_string add esp, 4*4 call Write2Console, offset outBuffer ; conversion IP/port => network byte order : call inet_addr, offset ip_string cmp eax, 0ffffffffh jne convert_port push offset endianErrMsg jmp quit convert_port: mov searchRemAddr, eax mov esi, offset port_string xor ecx, ecx xor eax, eax mov bl, 9 cld convert_port_loop: lodsb sub al, '0' js convert_port_end_loop cmp al, bl ja convert_port_end_loop lea ecx, [ecx+4*ecx] lea ecx, [2*ecx+eax] jmp short convert_port_loop convert_port_end_loop: push ecx call htons cmp eax, 0ffffffffh jne convert_port2 push offset endianErrMsg jmp quit convert_port2: mov searchRemPort, eax cmp oldWinVer, 1 jnz GetExtendedTcpTable ; AllocateAndGetTcpExTableFromStack : call dword ptr [APIaddress], offset APIptr, 0, \ hProcess, 0, 2 test eax, eax ; ERROR_SUCCESS ?