CAPTURE ET DESENCAPSULATION DE TRAMES SUR LE RÉSEAU

#pragma hdrstop
#include <vcl.h>
#include <dos.h>
#include <conio.h> 
#include <stdio.h>
#include <stdlib.h>
#include <iostream.h>
#include <packet32.h>
#include <ntddndis1.h>

//Déclaration de variable globales
wchar_t Buffer_Liste_Interfaces[8192];
wchar_t *Liste_PT_Interfaces[10];
//------------------------------------------------------------------------------
void affiche_menu()
{
        printf("Choissisez votre type de capture\n\n");
        printf("1) Capture en mode synthetique\n");
        printf("2) Capture en mode detaille\n");
        printf("3) Capture en mode analyse\n");
        printf("4) Obtenir l'adresse IP d'une interface\n");
        printf("5) Quitter\n");
}
//------------------------------------------------------------------------------
int saisir_choix()
{
int L_choix;

        do
        {
                printf("\nChoix : ");
                scanf("%d",&L_choix);
        }
        while(L_choix<1||L_choix>5);
        
        return(L_choix);
}
//------------------------------------------------------------------------------
void Affiche_Trame(BYTE *P_Buffer,int P_Taille)
{
int L_index;

        printf("\n\nTrame prise\n\n");
        printf("Taille de la trame : %d\n\n", P_Taille);
        for(L_index=0; L_index<P_Taille; L_index++)
        {
                printf("%02X ",P_Buffer[L_index]);
                printf(" ");
        }
}
//------------------------------------------------------------------------------
void Affiche_Trame_synthetique(BYTE *P_Buffer,int P_Taille)
{
int L_code;
int L_index;
int L_ligne;
int L_octet;
int L_octet2;
int L_taille;
int L_indice;
int L_char;
int L_compteur;
int L_compteur2;
int L_space;
bool ok;

        L_ligne=0;
        L_octet=0;
        L_octet2=0;
        L_space=0;
        printf("\n");

        while(1)
        {
                        printf("\n%08X    ",L_ligne);
                        L_compteur=0;
                        do
                        {
                                if(L_octet<P_Taille)
                                {
                                        printf("%02X ", P_Buffer[L_octet]);
                                        L_octet++;
                                }

                                if(L_space>=P_Taille)
                                {
                                        printf("   ");
                                }
                                L_compteur++;
                                L_space++ ;
                        }
                        while(L_compteur<16);

                        printf("    ");

                        L_compteur2=0;

                        do
                        {
                                if(isalnum(P_Buffer[L_octet2])!=0)
                                {
                                        printf("%c",P_Buffer[L_octet2]);
                                }
                                else
                                {
                                        printf(".");
                                }
                                L_octet2++;

                                if(L_octet2>=P_Taille)break;
                                L_compteur2++;
                        }
                        while(L_compteur2<16);

                        if(L_octet2>=P_Taille)break;
                        L_ligne=L_ligne+16;
        }

        printf("\n\nAdresse destination : ");
        for(L_index=0; L_index<6; L_index++)
        {
                printf("%02X ", P_Buffer[L_index]);

        }
        printf("\nAdresse source : ");
        for(L_index=6; L_index<12; L_index++)
        {
                printf("%02X ", P_Buffer[L_index]);
        }
        printf("\nCode protocolaire : ");
        for(L_index=12; L_index<14; L_index++)
        {
                printf("%02X ", P_Buffer[L_index]);
        }

        L_code= P_Buffer[12]<<8;
        L_code=L_code^P_Buffer[13];

        if(L_code>1500)
        {

               printf("\nType de trame : ETHERNET II\n");
        }
        else
        {

                printf("\nType de trame : 802.3\n");
                printf("\nTaille des donnees : ");
                L_taille= P_Buffer[12]+ P_Buffer[13];
                printf("%d octets",L_taille);

                printf("\nDSAP : ");
                if(P_Buffer[14]==0xE0)printf("IPX Protocol");
                if(P_Buffer[14]==0xF0)printf("NetBeui Protocol");
                else{printf("Unnamed Protocol");}

                printf("\nSSAP : %02X",P_Buffer[15]);

                printf("\nCommand : ");
                if(P_Buffer[15]==0)printf("Trame I\n");
                if(P_Buffer[15]==64)printf("Trame S\n");
                else{printf("Unnamed Trame");}
        }
}
//------------------------------------------------------------------------------
void obtenir_liste_interfaces()
{
DWORD L_Taille;
WORD L_Taille_Chaine;
WORD L_Index;
wchar_t* L_Position;

        L_Taille=sizeof(Buffer_Liste_Interfaces);
        PacketGetAdapterNames((char*)Buffer_Liste_Interfaces,&L_Taille);
        L_Position=Buffer_Liste_Interfaces;

        L_Index=0;
        printf("\nListe des interfaces actuelles : \n\n");
        do
        {
                Liste_PT_Interfaces[L_Index] = L_Position;
                wprintf(L"%d]%s\n",L_Index, Liste_PT_Interfaces[L_Index]);
                L_Taille_Chaine=wcslen(Liste_PT_Interfaces[L_Index]);
                L_Position=L_Position+L_Taille_Chaine+1;
                L_Index++;
        }
        while(*L_Position!=0);
}
//------------------------------------------------------------------------------
int choisir_interface()
{
int L_interface;

        printf("\nChoisissez l'interface que vous voulez exploiter : ");
        scanf("%d",&L_interface);
        return(L_interface);
}
//------------------------------------------------------------------------------
LPADAPTER ouverture_interface(int P_numero)
{
LPADAPTER L_Interface;

        L_Interface=PacketOpenAdapter((char*)Liste_PT_Interfaces[P_numero]);
        PacketSetHwFilter(L_Interface,NDIS_PACKET_TYPE_PROMISCUOUS);
        PacketSetBuff(L_Interface,1024000);
        PacketSetReadTimeout(L_Interface,5000);
        return(L_Interface);
}
//------------------------------------------------------------------------------
bool capture_trame(LPADAPTER P_Interface, BYTE *P_Buffer, int P_taille)
{
_PACKET L_Packet;
bool L_Trame_Est_Capture;

        L_Packet.Buffer= P_Buffer;
        L_Packet.Length=P_taille;
        L_Trame_Est_Capture=PacketReceivePacket(P_Interface,&L_Packet,TRUE);
        return(L_Trame_Est_Capture);
}
//------------------------------------------------------------------------------
void fermeture_interface(LPADAPTER P_Interface)
{
        PacketCloseAdapter(P_Interface);
}
//------------------------------------------------------------------------------
void capture_synthetique()
{
int L_numero;
unsigned int L_Taille_Trame;
bool L_Trame_Est_Capture;
BYTE L_Buffer[1514+sizeof(bpf_hdr)];
LPADAPTER L_Interface;

        obtenir_liste_interfaces();

        L_numero=choisir_interface();

        L_Interface=ouverture_interface(L_numero);

        L_Trame_Est_Capture=capture_trame(L_Interface, L_Buffer,sizeof(L_Buffer));

        if(L_Trame_Est_Capture==true)
        {
                L_Taille_Trame=((bpf_hdr*)L_Buffer)->bh_datalen;
                Affiche_Trame(L_Buffer+sizeof(bpf_hdr),L_Taille_Trame);
           Affiche_Trame_synthetique(L_Buffer+sizeof(bpf_hdr),L_Taille_Trame);
        }

        fermeture_interface(L_Interface);
}
//------------------------------------------------------------------------------
void affiche_ICMP(BYTE *P_Buffer)
{
        printf("\n\nNiveau 4 : ICMP");
        printf("\nType : ");

                switch(P_Buffer[34])
                {
                        case 0  : printf("Echo Replay\n"); break;
                        case 3  : printf("Destination Unreachable\n"); break;
                        case 4  : printf("Sourece Quench\n"); break;
                        case 5  : printf("Redirect\n"); break;
                        case 8  : printf("Echo Request\n"); break;
                        case 11 : printf("Time Exceeded\n"); break;
                        case 12 : printf("Parameter Problem\n"); break;
                        case 13 : printf("Timestamp Request\n"); break;
                        case 14 : printf("Timestamp Reply\n"); break;
                        case 15 : printf("Information Request\n"); break;
                        case 16 : printf("Information Reply\n"); break;
                        case 17 : printf("Address Mask Request\n"); break;
                        case 18 : printf("Addresse Mask Reply\n"); break;
                }
        printf("Code : %02X",P_Buffer[35]);
        printf("\nChecksum : %02X %02X",P_Buffer[36],P_Buffer[37]);
}
//------------------------------------------------------------------------------
void affiche_TCP(BYTE *P_Buffer)
{
int L_seize_bits;
int L_HLEN;
int L_flag;
int L_flag_masque; 

        printf("\n\nNiveau 4 : TCP");
        printf("\nSource Port : %02X %02X",P_Buffer[34],P_Buffer[35]);
        printf("\nDestination Port : %02X %02X",P_Buffer[36],P_Buffer[37]);
        printf("\nSequence Number : %02X %02X ",P_Buffer[38],P_Buffer[39]);
        printf("%02X %02X",P_Buffer[40],P_Buffer[41]);
        printf("\nAcknolegement Number : %02X %02X ",P_Buffer[42],P_Buffer[43]);
        printf("%02X %02X",P_Buffer[44],P_Buffer[45]);

        L_HLEN=P_Buffer[46]>>4;
        printf("\nHeader Length : %d bytes",L_HLEN);

        L_flag_masque=63;                     //masque pour les 6 derniers bits de l'octet 47
        L_flag=P_Buffer[47] & L_flag_masque;
        printf("\nFlag : %d",L_flag);
        printf("\n\t-URG : %d",(L_flag&32)>>5);
        printf("\n\t-ACK : %d",(L_flag&16)>>4);
        printf("\n\t-PSH : %d",(L_flag&8)>>3);
        printf("\n\t-RST : %d",(L_flag&4)>>2);
        printf("\n\t-SYN : %d",(L_flag&2)>>1);
        printf("\n\t-FIN : %d",L_flag&1);

        printf("\nWindows : %02X %02X",P_Buffer[48],P_Buffer[49]);
        printf("\nChecksum : %02X %02X",P_Buffer[50],P_Buffer[51]);
        printf("\nUrgent pointer : %02X",P_Buffer[52],P_Buffer[53]);
}
//------------------------------------------------------------------------------
void affiche_UDP(BYTE *P_Buffer)
{
        printf("\n\nNiveau 4 : UDP");
        printf("\nSource Port : %02X %02X",P_Buffer[34],P_Buffer[35]);
        printf("\nDestination Port : %02X %02X",P_Buffer[36],P_Buffer[37]);
        printf("\nMessage Length : %d bytes",P_Buffer[38]+P_Buffer[39]);
        printf("\nHeader Checksum : %02X %02X", P_Buffer[40],P_Buffer[41]);
}
//------------------------------------------------------------------------------
void affiche_IP(BYTE *P_Buffer)
{
int L_index;
int L_masque;
int L_masque2;
int L_dizaine;
int L_unite;
int L_Length;
int L_id;
int frag;
int position;

        L_masque=15;
        L_masque2=8191;

        printf("\nNiveau 3 : IP");

        L_unite=P_Buffer[14]&L_masque;                  //récupération de l'unité
        L_dizaine=P_Buffer[14]>>4;                      //récupération de la dizaine
        L_dizaine=L_dizaine&L_masque;
        printf("\nVersion : %d",L_dizaine);
        printf("\nHeader Length : %d bytes",L_unite);
        printf("\nType of service : %d",P_Buffer[15]);

        L_Length=P_Buffer[16]+P_Buffer[17];
        printf("\nTotal Length : %d bytes",L_Length);

        L_id=P_Buffer[18]+P_Buffer[19];
        printf("\nIdentification : %d",L_id);

        frag=P_Buffer[20]>>5;                           //récupération des
        printf("\nFraguement : %d",frag);               //trois premiers bits

        position=P_Buffer[20]<<8;                       //concaténation des octets
        position=position ^ P_Buffer[21];               //20 et 21 puis récupération
        position=position & L_masque2;                  //des 13 derniers bits
        printf("\nPositionnement : %02X",position);

        printf("\nDuree de vie : %d",P_Buffer[22]);

        printf("\nProtocole : %d",P_Buffer[23]);

        printf("\nHeader Cheksum : %02X %02X",P_Buffer[24],P_Buffer[25]);

        printf("\nAdresse source : ");
        for(L_index=26;L_index<30;L_index++)
        {printf("%d.",P_Buffer[L_index]);}

        printf("\nAdresse de destination : ");
        for(L_index=30;L_index<34;L_index++)
        {printf("%d.",P_Buffer[L_index]);}

                switch(P_Buffer[23])
                {
                        case 1 : affiche_ICMP(P_Buffer);
                                        break;
                        case 6 : affiche_TCP(P_Buffer);
                                        break;
                        case 7 : affiche_UDP(P_Buffer);
                                        break;
                }
}
//------------------------------------------------------------------------------
void affiche_ARP(BYTE *P_Buffer)
{
int L_index;

        printf("\nNiveau 3 : ARP");

        printf("\nNetwork Type : ");
        if(P_Buffer[15]==1)printf("Ethernet");
        if(P_Buffer[15]==3)printf("Token Ring");

        printf("\nProtocole Type : ");
        if((P_Buffer[16]==8) && (P_Buffer[17]==0))printf("IP");

        printf("\nHardware Adress Length : %d bytes",P_Buffer[18]);
        printf("\nLogical Adress Length : %d bytes",P_Buffer[19]);

        printf("\nOperation : ");
        if(P_Buffer[21]==1)printf("Request ARP");
        if(P_Buffer[21]==2)printf("Answer ARP");

        printf("\nSender Hardware Adress : ");
        for(L_index=22;L_index<28;L_index++)
        {printf("%02X ",P_Buffer[L_index]);}

        printf("\nSender Internet Adress : ");
        for(L_index=28;L_index<32;L_index++)
        {printf("%d.",P_Buffer[L_index]);}

        printf("\nTarget Hardware Adress : ");
         for(L_index=32;L_index<38;L_index++)
        {printf("%02X ",P_Buffer[L_index]);}

        printf("\nTarget Internet Adress : ");
         for(L_index=38;L_index<42;L_index++)
        {printf("%d.",P_Buffer[L_index]);}

}
//------------------------------------------------------------------------------
void affiche_detail(BYTE *P_Buffer, int P_Taille)
{

        Affiche_Trame_synthetique(P_Buffer, P_Taille);

        if((P_Buffer[12]==8) &&  (P_Buffer[13]==0))
        {
                affiche_IP(P_Buffer);
        }

        if( (P_Buffer[12]==8) && (P_Buffer[13]==6))
        {
                affiche_ARP(P_Buffer);
        }
}
//------------------------------------------------------------------------------
void capture_detaille()
{
BYTE L_Buffer[1514+sizeof(bpf_hdr)];
LPADAPTER L_Interface;
int L_numero;
int L_Taille;
bool L_ok;
bool L_Trame_Est_Capture;


        obtenir_liste_interfaces();

        L_numero=choisir_interface();

        L_Interface=ouverture_interface(L_numero);

        L_Trame_Est_Capture=capture_trame(L_Interface,L_Buffer,sizeof(L_Buffer));

        if(L_Trame_Est_Capture==true)
        {
                L_Taille=((bpf_hdr*)L_Buffer)->bh_datalen;
                affiche_detail(L_Buffer+sizeof(bpf_hdr), L_Taille);
        }

        fermeture_interface(L_Interface);
}
//------------------------------------------------------------------------------
int choix_nombre_trame()
{
int L_nombre;
        printf("\nEntrer le nombre de trame a capturer : ");
        scanf("%d",&L_nombre);
        return(L_nombre);
}
//------------------------------------------------------------------------------
int broadcast(BYTE *P_Buffer,bool P_action)
{
int L_index;
int L_broadcast;
int L_arp;
int L_retour;
bool ok;

        if(P_action==true)
        {
                L_index=0;

                do
                {
                        if(P_Buffer[L_index]==0xFF)ok=true;
                        else ok=false;
                        L_index++;
                }
                while(L_index<6 && ok!=false);

                if(ok==true)L_broadcast=1;
                if(ok==false)L_broadcast=0;
                L_retour=L_broadcast;
        }

        if(P_action==false)
        {
                if( (P_Buffer[12]==8) && (P_Buffer[13]==6) )L_arp=1;
                else L_arp=0;
                L_retour=L_arp;
        }

        return(L_retour);
}
//------------------------------------------------------------------------------
void capture_analyse()
{
BYTE L_Buffer[1514+sizeof(bpf_hdr)];
LPADAPTER L_Interface;
_PACKET L_Packet;
int L_numero;
int L_taille;
int L_compteur;
int L_nombre_trame;
int L_broadcast;
int L_compteur_broadcast;
int L_arp;
int L_compteur_arp;
bool L_Trame_Capture;
float L_pourcentage_cast;
float L_pourcentage_arp;

        L_compteur_broadcast=0;
        L_compteur_arp=0;

        obtenir_liste_interfaces();

        L_numero=choisir_interface();

        L_nombre_trame=choix_nombre_trame();

        L_Interface=ouverture_interface(L_numero);

        for(L_compteur=0;L_compteur<L_nombre_trame;L_compteur++)
        {

        L_Trame_Capture=capture_trame(L_Interface,L_Buffer,sizeof(L_Buffer));

                if(L_Trame_Capture==true)
                {
                        L_taille=((bpf_hdr*)L_Buffer)->bh_datalen;
                        printf("\nTrame prise\n\n");
                        printf("Taille de la trame : %d\n\n", L_taille);
                        affiche_detail(L_Buffer+sizeof(bpf_hdr), L_taille);
                        L_broadcast=broadcast(L_Buffer+sizeof(bpf_hdr),true);
                        L_arp=broadcast(L_Buffer+sizeof(bpf_hdr),false);
                        L_compteur_broadcast=L_compteur_broadcast+L_broadcast;
                        L_compteur_arp=L_compteur_arp+L_arp;
                }
        }

        L_pourcentage_cast=float(L_compteur_broadcast*100)/L_nombre_trame;
        printf("\n\nNombre de trame Broadcast : ");
        printf("%d, soit %4.2f%% ",L_compteur_broadcast,L_pourcentage_cast);
        printf("de la capture\n");

        if(L_compteur_broadcast!=0)                     //division par 0 impossible
        {
        L_pourcentage_arp=float(L_compteur_arp*100)/L_compteur_broadcast;
        printf("Nombre de trame ARP : ");
        printf("%d, soit %4.2f%% ",L_compteur_arp,L_pourcentage_arp);
        printf("des trames broadcast\n");
        fermeture_interface(L_Interface);
        }
}
//------------------------------------------------------------------------------
void ip()
{
npf_if_addr* L_adresse;
int L_numero;
long L_mask;

        printf("\nEn cours de developpement ! ! ! ");
        obtenir_liste_interfaces();
        L_numero=choisir_interface();
        PacketGetNetInfoEx((char*)Liste_PT_Interfaces[L_numero], L_adresse, &L_mask);
        printf("\nL'adresse de l'interface est : %02X",L_adresse);
        printf("\nSon masque est : %02X",L_mask);
}
//------------------------------------------------------------------------------
void traitement_choix(int P_choix)
{
        switch(P_choix)
        {
                case 1 : capture_synthetique();
                                break;
                case 2 : capture_detaille();
                                break;
                case 3 : capture_analyse();
                                break;
                case 4 : ip();
                                break;
                case 5 : printf("\nAu revoir ! ! !\n"); _sleep(2); exit(0);
        }
}
//------------------------------------------------------------------------------
void main()
{
int L_choix;

        do
        {
                clrscr();
                affiche_menu();
                L_choix=saisir_choix();
                traitement_choix(L_choix);
                printf("\n\nRecommencer oui(o), non(hit any key)\n");
        }
        while(getch()=='o');
}
//---------------------------------FIN------------------------------------------