端口扫描之[3]多线程扫描

下面的程序，使用了多线程。端口连接方面，使用的是异步套接字(ioctlsocket)，使用I/O复用Select实现异步端口查询，加快程序速度。

但是超时时间不好定，优化的还有很多。

#include <stdio.h>
#include <WinSock2.h>
#include <time.h>
#pragma comment(lib, "ws2_32.lib")

char    *host;
int     nThreadNum, nMaxThread, nTotalPort;
long    lNowPort;
// select
TIMEVAL timeout;
FD_SET  mask;
void Usage()
{
    printf("\tusage: %s IP StartPort-EndPort Maxthread(1000)\n");
    printf("\tExample:192.168.0.1 1-10000 500\n");
}

// 状态提示函数
void Display()
{
    static int play = 0;
    char *playsProgress[12] = {
        " | ",
        " / ",
        " - ",
        " \\ ",
        " | ",
        " / ",
        " - ",
        " \\ ",
        " | ",
        " / ",
        " - ",
        " \\ "
    };
    // 显示进度条和线程数
    printf(" = %s = \t %d threads   %d%s Completed. \r",
            playsProgress[play], nThreadNum, (lNowPort*100) /(nTotalPort+1), "%");
    play = (play == 11)?0:play + 1;
    Sleep(1);
}

void WaitThreadEnd()
{
    Sleep(1000);
    printf("\n Thread Ending...\n");
    while(nThreadNum > 0)
    {
        Sleep(1);
        printf("=|=\t%d threads \r", nThreadNum);
    }
    printf("\n Thread ended!\n");
}

DWORD WINAPI ThreadFunc(LPVOID lp)
{
    int port = *(DWORD*)lp;
    SOCKET  socketUse;
    struct  sockaddr_in addr;

    u_long  value;
    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = inet_addr(host);
    value = 1;
    socketUse = socket(AF_INET, SOCK_STREAM, 0);
    if(socketUse == INVALID_SOCKET)
    {
        printf("Socket error!\n");
        // 线程数减一
        InterlockedExchangeAdd((long*)&nThreadNum, -1); //
        return 0;
    }
    // 把socket设定为非阻塞模式
    ioctlsocket(socketUse, FIONBIO, &value);
    addr.sin_port = htons(port);
    // 连接测试
    connect(socketUse, (struct sockaddr*)&addr, sizeof(addr));
    // I/O复用
    FD_ZERO(&mask);
    FD_SET(socketUse, &mask);
    value = select(0, NULL, &mask, NULL, &timeout);
    if(value == 0 || value == -1)
    {
        closesocket(socketUse);
        Sleep(50);
        InterlockedExchangeAdd((long*)&nThreadNum, -1); //
        return 0;
    }
    else
    {
        // 阻止socket接收和发送数据
        shutdown(socketUse, 0);
        printf("\tFound port %d open.\r\n", port);
        closesocket(socketUse);
        Sleep(50);
        InterlockedExchangeAdd((long*)&nThreadNum, -1);
    }
    return 0;
}

int main(int argc, char **argv)
{
    WSADATA     ws;
    char*       pPorts;
    int         nStartPort, nEndPort;
    clock_t     start, end;
    float       costTime;
    if(argc != 4)
    {
        Usage();
        return 0;
    }
    long lResult;
    lResult = WSAStartup(MAKEWORD(2, 2), &ws);
    pPorts = argv[2];
    if(strstr(argv[2], "-"))
    {
        nStartPort = atoi(argv[2]);
        for(; *pPorts; )
        {
            if(*(pPorts++) == '-')
                break;
        }
        nEndPort = atoi(pPorts);
        if(nStartPort<1 || nEndPort > 65535)
        {
            printf("Port Error!\n");
            return 0;
        }
    }
    host = argv[1];
    nMaxThread = (atoi(argv[3])-1 > 999)? 999 : atoi(argv[3])-1;
    //Usage();
    // 设置连接超时， 如果线程数大于500， 则超时为两秒
    timeout.tv_usec = 3;
    if(nMaxThread > 500)
        timeout.tv_usec = 4;
    // begin
    start = clock();
    nTotalPort = nEndPort - nStartPort;
    for(int nPort = nStartPort; nPort < nEndPort; nPort++, lNowPort++, nThreadNum++)
    {
        Display();
        while(nThreadNum > nMaxThread)
            Sleep(10);
        // 线程
        CreateThread(NULL, 0, ThreadFunc, &nPort, 0, NULL);
    }
    end = clock();
    costTime = (float)(end - start);
    printf("\nCost time: %f Sec\n", costTime);
    printf("\n\n");
    WaitThreadEnd();
    WSACleanup();
    system("pause");
    return 0;
}

 

参考：<<Hack编程实例精讲>>