English: jne display_totcx push offset NoCxMsg jmp quit display_totcx: push ecx call _wsprintfA, offset outBuffer, offset TotCxMsg, ecx add esp, 4*3 call Write2Console, offset outBuffer pop ecx next_cx: push ecx ; counter push esi ; pointer ; try to find our IP/port : mov eax, dword ptr [esi+10h] ; dwRemoteAddr cmp eax, searchRemAddr jne unwanted mov TCPtable.dwRemoteAddr, eax mov eax, dword ptr [esi+14h] ; dwRemotePort cmp eax, searchRemPort jne unwanted mov TCPtable.dwRemotePort, eax ; found matching connection : mov eax, dword ptr [esi+0Ch] ; dwLocalPort mov TCPtable.dwLocalPort, eax xchg ah, al push eax mov eax, dword ptr [esi+08h] ; dwLocalAddr mov TCPtable.dwLocalAddr, eax ; convert IP to ASCII : call inet_ntoa, eax push eax push offset foundFormat push offset outBuffer call _wsprintfA add esp, 4*4 call Write2Console, offset outBuffer pop esi pop ecx ; kill the connection : mov TCPtable.dwState, 12 ; MIB_TCP_STATE_DELETE_TCB call dword ptr [SetTcpEntryAPI], offset TCPtable test eax, eax jnz kill_error push offset killOkMsg jmp quit kill_error: cmp eax, 5 ; ERROR_ACCESS_DENIED jne unknown_err push offset killErr1Msg jmp quit unknown_err: push offset killErr2Msg jmp quit unwanted: pop esi pop ecx dec ecx jcxz noMoreCX add esi, 18h ; next structure jmp next_cx noMoreCX: push offset notFoundMsg quit: call Write2Console cmp oldWinVer, 1 jnz noHeapFree ; free memory if AllocateAndGetTcpExTableFromStack was used : call HeapFree, hProcess, 0, [APIptr] jmp noGlobalFree noHeapFree: cmp APImemAlloc, 0 jz noGlobalFree call GlobalUnlock, [APImemAlloc] call GlobalFree, [APImemAlloc] noGlobalFree: push offset Exiting call Write2Console call ExitProcess, 0 endp ; ==================================================================== ; output text to console ; param : [esp+4] : msg to output Write2Console proc call lstrlenA, dword ptr [esp+4] call WriteFile, stdout, dword ptr [esp+4*4], eax, bytesWritten, 0 ; clean up stack retn 4 Write2Console endp ; ==================================================================== ; parse the command line parameters ; ret : success (eax == 0) or error (eax == 1) ParseCmdLine proc ; need to check whether there ; are quotes (") or not : cmp byte ptr [eax], 22h jne check_next find_last_quote: inc eax cmp byte ptr [eax], 22h jne find_last_quote check_next: inc eax ; look for space or NULL cmp byte ptr [eax], 20h je space_found cmp byte ptr [eax], 00h je cmdLineError jmp check_next space_found: ; some Windows versions have 2 spaces ; between program name and parameters : cmp byte ptr [eax+1], 20h je check_next inc eax mov esi, eax push eax call lstrlenA ; size must be from 9 to 21 characters : cmp eax, 9 jb cmdLineError cmp eax, 21 ja cmdLineError mov edi, offset ip_string next_ip_char: test eax, eax jz cmdLineError cmp byte ptr [esi], 3ah ; colon ?
French: jne display_totcx push offset NoCxMsg jmp quit display_totcx: push ecx call _wsprintfA, offset outBuffer, offset TotCxMsg, ecx add esp, 4*3 call Write2Console, offset outBuffer pop ecx next_cx: push ecx ; compteur push esi ; pointeur ; recherche notre IP/port : mov eax, dword ptr [esi+10h] ; dwRemoteAddr cmp eax, searchRemAddr jne unwanted mov TCPtable.dwRemoteAddr, eax mov eax, dword ptr [esi+14h] ; dwRemotePort cmp eax, searchRemPort jne unwanted mov TCPtable.dwRemotePort, eax ; on a trouvé la connexion : mov eax, dword ptr [esi+0Ch] ; dwLocalPort mov TCPtable.dwLocalPort, eax ; échange le contenu de ax : xchg ah, al push eax mov eax, dword ptr [esi+08h] ; dwLocalAddr mov TCPtable.dwLocalAddr, eax ; conversion IP => ASCII : call inet_ntoa, eax push eax push offset foundFormat push offset outBuffer call _wsprintfA add esp, 4*4 call Write2Console, offset outBuffer pop esi pop ecx ; force la fermeture de la connexion : mov TCPtable.dwState, 12 ; MIB_TCP_STATE_DELETE_TCB call dword ptr [SetTcpEntryAPI], offset TCPtable test eax, eax jnz kill_error push offset killOkMsg jmp quit kill_error: cmp eax, 5 ; ERROR_ACCESS_DENIED jne unknown_err push offset killErr1Msg jmp quit unknown_err: push offset killErr2Msg jmp quit unwanted: pop esi pop ecx dec ecx jcxz noMoreCX add esi, 18h ; structure suivante jmp next_cx noMoreCX: push offset notFoundMsg quit: call Write2Console cmp oldWinVer, 1 jnz noHeapFree ; libère la mémoire allouée si on a utilisé ; AllocateAndGetTcpExTableFromStack : call HeapFree, hProcess, 0, [APIptr] jmp noGlobalFree noHeapFree: cmp APImemAlloc, 0 jz noGlobalFree call GlobalUnlock, [APImemAlloc] call GlobalFree, [APImemAlloc] noGlobalFree: push offset Exiting call Write2Console call ExitProcess, 0 endp ; ==================================================================== ; affiche le texte dans la console ; param : [esp+4] : message à afficher Write2Console proc call lstrlenA, dword ptr [esp+4] call WriteFile, stdout, dword ptr [esp+4*4], eax, bytesWritten, 0 ; réajuste la pile retn 4 Write2Console endp ; ==================================================================== ; récupère l'IP et le port dans les param. ; ret : succès (eax == 0) or erreur (eax == 1) ParseCmdLine proc ; vérifie s'il y a des quotes (") : cmp byte ptr [eax], 22h jne check_next find_last_quote: inc eax cmp byte ptr [eax], 22h jne find_last_quote check_next: inc eax ; recherche d'un caractère NULL/espace cmp byte ptr [eax], 20h je space_found cmp byte ptr [eax], 00h je cmdLineError jmp check_next space_found: ; certaines versions de Windows mettent 2 espaces ; entre le nom du programme et ses paramètres : cmp byte ptr [eax+1], 20h je check_next inc eax mov esi, eax push eax call lstrlenA ; la taille totale doit être comprise entre 9 to 21 : cmp eax, 9 jb cmdLineError cmp eax, 21 ja cmdLineError mov edi, offset ip_string next_ip_char: test eax, eax jz cmdLineError cmp byte ptr [esi], 3ah ; ":" ?