+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [VB.Net] Local/Remote TCP info from process [Source] (/showthread.php?tid=1350310)
Pages: Pages
1
2
[VB.Net] Local/Remote TCP info from process [Source] - The-One - Jun 4, 2011
Hey,
I never really intended to release it as I had some shit with this getting it to work. Though I had lots of help with this since I liked it more then WireShark and I got all the info I needed without searching.
I've used this for packet logging of: HWID applications, games and other things you will find out while using this.
Screenshot:
[img]http://i.min.us/jcNZU2.png[/img]
We are going to use iphlpapi.dll (GetExtendedTcpTable) to get the information.
First, declare the API and some structures we need:
Code
<DllImport("iphlpapi.dll", SetLastError:=True)> _
Private Function GetExtendedTcpTable(ByVal pTcpTable As IntPtr, ByRef OutBufLen As Integer, ByVal sort As Boolean, ByVal ipVersion As Integer, ByVal tblClass As Integer, ByVal reserved As Integer) As UInteger
End Function
Private Structure tcprows
Public LocalAddress As Integer
Public LocalPort As Integer
Public RemoteAddress As Integer
Public RemotePort As Integer
Public ProcessID As Integer
End Structure
Private Structure tcptable
Public NumEntries As Integer
End StructureNow comes the most important function of this, the part where we get all the connections.
Code
Private Function GetAllTcpConnections() As tcprows()
Const NO_ERROR As Integer = 0
Const IP_v4 As Integer = 2
Dim tTable As tcprows() = Nothing
Dim buffSize As Integer = 0
GetExtendedTcpTable(IntPtr.Zero, buffSize, True, IP_v4, 5, 0)
Dim buffTable As IntPtr = Marshal.AllocHGlobal(buffSize)
Try
If NO_ERROR <> GetExtendedTcpTable(buffTable, buffSize, True, IP_v4, 5, 0) Then
Return Nothing
End If
Dim tab As tcptable = Marshal.PtrToStructure(buffTable, GetType(tcptable))
Dim rowPtr As IntPtr = CLng(buffTable) + Marshal.SizeOf(tab.NumEntries)
tTable = New tcprows(tab.NumEntries - 1) {}
Dim rowSize As Integer = Marshal.SizeOf(GetType(tcprows))
For i As Integer = 0 To tab.NumEntries - 1
Dim tcpRow As tcprows = Marshal.PtrToStructure(rowPtr, GetType(tcprows))
tTable(i) = tcpRow
rowPtr = CInt(rowPtr) + rowSize
Next
Finally
Marshal.FreeHGlobal(buffTable)
End Try
Return tTable
End FunctionAs I'm using a Command Application I made this:
Code
Public Sub CheckProcess_Tcp(ByVal procname As String)
Dim allTcpConns As tcprows() = GetAllTcpConnections()
For Each row As tcprows In allTcpConns
For Each p As Process In Process.GetProcessesByName(procname)
If row.ProcessID = p.Id Then
Console.ForegroundColor = ConsoleColor.White
Console.Write("--" & vbNewLine)
Console.Write("Remote: " & tIP(row.RemoteAddress) & ":" & tPort(row.RemotePort) & vbNewLine)
Console.Write("Local: " & tIP(row.LocalAddress) & ":" & tPort(row.LocalPort) & vbNewLine)
Console.Write("Process: " & procname & "(" & row.ProcessID & ")" & vbNewLine)
Try
For Each pm As ProcessModule In p.Modules
If pm.FileName.Contains(procname) Then
Console.Write("Location: " & pm.FileName() & vbNewLine)
Exit For
End If
Next
Catch
Console.Write("Location: Error - 32 bit process could not been read" & vbNewLine)
End Try
Console.Write("--" & vbNewLine)
End If
Next
Next
End SubThis will check if a row in the table contains the matched ID of the process we are looking for.
As you see there are some errors. We need to translate the port and IP.
Code
Private Function tPort(ByVal port As Integer) As Integer
Return ((port And &HFF) << 8 Or (port And &HFF00) >> 8)
End Function
Public Function tIP(ByVal LongIP As Double) As String
Dim ByteIP(4) As String
Dim x As Byte = Nothing
Dim IP As String
If LongIP < 4294967296.0# And LongIP >= 0 Then
ByteIP(0) = Fix(LongIP / (256 ^ 3))
ByteIP(1) = Fix(((LongIP - (ByteIP(0) * (256 ^ 3))) / (256 ^ 2)))
ByteIP(2) = Fix(((LongIP - (ByteIP(0) * (256 ^ 3)) - (ByteIP(1) * (256 ^ 2))) / 256))
ByteIP(3) = ((LongIP - (ByteIP(0) * (256 ^ 3)) - (ByteIP(1) * (256 ^ 2)) - (ByteIP(2) * 256)))
IP = ByteIP(3) & "." & ByteIP(2) & "." & ByteIP(1) & "." & ByteIP(0)
tIP = IP
Else
tIP = -1
End If
End FunctionEnjoy, any questions can be asked below. I'd appreciate if you reply below :D
* - Apple - Jun 4, 2011
Now everybody will be able to get Leaf's IP it connects to :(
Could you upload the binaries? I don't feel like writing a program lol
* - The-One - Jun 4, 2011
(Jun 4, 2011 01:32 PM)Apple Wrote: Now everybody will be able to get Leaf's IP it connects to :(
Could you upload the binaries? I don't feel like writing a program lol
VT: http://www.virustotal.com/file-scan/report.html?id=491cd0e3cd63f86ec439192c8e327030fdc20ad300741f8e786ce57c4fc333d6-1307222006
http://www.mediafire.com/?db6br1lnpb0nnlm
Btw, I just saw a HUGE grammar fault. can must be want. /facepalm.
* - Modesty - Jun 4, 2011
(Jun 4, 2011 01:32 PM)Apple Wrote: Now everybody will be able to get Leaf's IP it connects to :(
Could you upload the binaries? I don't feel like writing a program lol
What do you mean "now"?
You could already do that by going to:
![[Image: 34944ba3df92e6fdeca23c0939a1750d.png]](https://gyazo.com/34944ba3df92e6fdeca23c0939a1750d.png)
(Jun 4, 2011 01:32 PM)Apple Wrote: Now everybody will be able to get Leaf's IP it connects to :(
Could you upload the binaries? I don't feel like writing a program lol
What do you mean "now"?
You could already do that by going to:
* - The-One - Jun 4, 2011
(Jun 4, 2011 02:30 PM)Modesty Wrote: What do you mean "now"?
You could already do that by going to:
[img]'https://gyazo.com/34944ba3df92e6fdeca23c0939a1750d.png[/img]
What do you mean "now"?
You could already do that by going to:
[img']https://gyazo.com/34944ba3df92e6fdeca23c0939a1750d.png[/img]
Though, thats only on Ultimate, not on other versions.
* - xSilent - Jun 4, 2011
(Jun 4, 2011 01:32 PM)Apple Wrote: Now everybody will be able to get Leaf's IP it connects to :(
I really hope your being sarcastic.
* - Pulser - Jun 4, 2011
(Jun 4, 2011 01:32 PM)Apple Wrote: Now everybody will be able to get Leaf's IP it connects to :(
Could you upload the binaries? I don't feel like writing a program lol
You could do that with an HTTP Debugger anyway.
* - The-One - Jun 4, 2011
(Jun 4, 2011 03:04 PM)Mr. Predictable Wrote: You could do that with an HTTP Debugger anyway.
I'm sure there are some l33t anti's on this forum 🤩
* - Apple - Jun 4, 2011
Not everybody has knowledge of these types of programs and The-one has brought more attention to them. That's why I'm saying now people can get the IP. What I actually meant to say was now more people can get it.
* - The-One - Jun 4, 2011
(Jun 4, 2011 03:23 PM)Apple Wrote: Not everybody has knowledge of these types of programs and The-one has brought more attention to them. That's why I'm saying now people can get the IP. What I actually meant to say was now more people can get it.
Btw Apple, No offense on my last reply to you.
* - Apple - Jun 4, 2011
(Jun 4, 2011 03:24 PM)The-One Wrote: Btw Apple, No offense on my last reply to you.
What post are you referring to? I don't see any that could potentially give offense to me.
* - ra1d - Jun 4, 2011
Really nice share dude.
Keep up the good work :)
* - Modesty - Jun 4, 2011
(Jun 4, 2011 02:42 PM)The-One Wrote: Though, thats only on Ultimate, not on other versions.
This is on home premium...
* - The-One - Jun 4, 2011
(Jun 4, 2011 03:34 PM)Modesty Wrote: This is on home premium...
Yes and the older Windows versions, anyway people might find it useful to not have to spit though Wireshark.
(Jun 4, 2011 03:29 PM)Apple Wrote: What post are you referring to? I don't see any that could potentially give offense to me.
You said now everyone could get the IP of Leaf, then Mr. Predictable said you can use HTTP Debugger and I said: I'm sure there are some l33t anti's on this forum.
* - gifar_ucuL - Jun 11, 2011
wow nice man can i have a source :)