关于端口和进程的映射

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/sdpdww/archive/2007/07/26/1710011.aspx 

 

 

 

网上的那些所谓的谈端口和进程映射的例子都不能使用，后来买了这本书，找到了好用的例子。真不明白那些人为什么要把没有用的了例子放到网上去恶心人，自己连试也不试就放到了网上，真的很让人恶心。
    这个例子是《visusl c++网络程序设计实例详解》（人民邮电）第七章里面的最后一个例子，很好用，所以放到网上来和大家分享一下。
    使用下面的代码的前提是要安装windows2003的PlatformSDK，可以到这里下载http://www.microsoft.com/msdownload/platformsdk/sdkupdate/psdk-full.htm
//////////////////////////////////////////////////////////////////////
// netstate.cpp文件

#include <stdio.h>
#include <windows.h>
#include <Iphlpapi.h>
#include <tlhelp32.h>

#pragma comment(lib, "Iphlpapi.lib")
#pragma comment(lib, "WS2_32.lib")

typedef struct
{
  DWORD   dwState;         // 连接状态
  DWORD   dwLocalAddr;     // 本地地址
  DWORD   dwLocalPort;     // 本地端口
  DWORD   dwRemoteAddr;    // 远程地址
  DWORD   dwRemotePort;    // 远程端口
  DWORD   dwProcessId;  // 进程ID号
} MIB_TCPEXROW, *PMIB_TCPEXROW;

typedef struct
{
 DWORD   dwNumEntries;
 MIB_TCPEXROW table[ANY_SIZE];
} MIB_TCPEXTABLE, *PMIB_TCPEXTABLE;

typedef struct
{
  DWORD   dwLocalAddr;     // 本地地址
  DWORD   dwLocalPort;     // 本地端口
  DWORD   dwProcessId;  // 进程ID号
} MIB_UDPEXROW, *PMIB_UDPEXROW;

typedef struct
{
 DWORD   dwNumEntries;
 MIB_UDPEXROW table[ANY_SIZE];
} MIB_UDPEXTABLE, *PMIB_UDPEXTABLE;

// 扩展函数原型
typedef DWORD (WINAPI *PFNAllocateAndGetTcpExTableFromStack)(
  PMIB_TCPEXTABLE *pTcpTable,
  BOOL bOrder,            
  HANDLE heap,
  DWORD zero,
  DWORD flags
);

typedef DWORD (WINAPI *PFNAllocateAndGetUdpExTableFromStack)(
  PMIB_UDPEXTABLE *pUdpTable, 
  BOOL bOrder,             
  HANDLE heap,
  DWORD zero,
  DWORD flags
);

PCHAR ProcessPidToName(HANDLE hProcessSnap, DWORD ProcessId, PCHAR ProcessName);

int main()
{
 // 定义扩展函数指针
 PFNAllocateAndGetTcpExTableFromStack pAllocateAndGetTcpExTableFromStack;
 PFNAllocateAndGetUdpExTableFromStack pAllocateAndGetUdpExTableFromStack;

 // 获取扩展函数的入口地址
 HMODULE hModule = ::LoadLibrary("iphlpapi.dll");
 pAllocateAndGetTcpExTableFromStack =
   (PFNAllocateAndGetTcpExTableFromStack)::GetProcAddress(hModule,
         "AllocateAndGetTcpExTableFromStack");
 
 pAllocateAndGetUdpExTableFromStack =
   (PFNAllocateAndGetUdpExTableFromStack)::GetProcAddress(hModule,
         "AllocateAndGetUdpExTableFromStack");

 if(pAllocateAndGetTcpExTableFromStack == NULL || pAllocateAndGetUdpExTableFromStack == NULL)
 {
  printf(" Ex APIs are not present /n ");
  // 说明你应该调用普通的IP帮助API去获取TCP连接表和UDP监听表
  return 0;
 }

 // 调用扩展函数，获取TCP扩展连接表和UDP扩展监听表

 PMIB_TCPEXTABLE pTcpExTable;
 PMIB_UDPEXTABLE pUdpExTable;

 // pTcpExTable和pUdpExTable所指的缓冲区自动由扩展函数在进程堆中申请
 if(pAllocateAndGetTcpExTableFromStack(&pTcpExTable, TRUE, GetProcessHeap(), 2, 2) != 0)
 {
   printf(" Failed to snapshot TCP endpoints./n");
   return -1;
 }
 if(pAllocateAndGetUdpExTableFromStack(&pUdpExTable, TRUE, GetProcessHeap(), 2, 2) != 0)
 {
   printf(" Failed to snapshot UDP endpoints./n");
   return -1;
 }

 // 给系统内的所有进程拍一个快照
 HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 if(hProcessSnap == INVALID_HANDLE_VALUE)
 {
  printf(" Failed to take process snapshot. Process names will not be shown./n/n");
  return -1;
 }

 printf(" Active Connections /n/n");
 char szLocalAddr[128];
 char szRemoteAddr[128];
 char szProcessName[128];
 in_addr inadLocal, inadRemote;
 char    strState[128];
 DWORD   dwRemotePort = 0;

 // 打印TCP扩展连接表信息
 for(UINT i = 0; i < pTcpExTable->dwNumEntries; ++i)
 {
  // 状态
  switch (pTcpExTable->table[i].dwState)
  {
  case MIB_TCP_STATE_CLOSED:
   strcpy(strState, "CLOSED");
   break;
  case MIB_TCP_STATE_TIME_WAIT:
   strcpy(strState, "TIME_WAIT");
   break;
  case MIB_TCP_STATE_LAST_ACK:
   strcpy(strState, "LAST_ACK");
   break;
  case MIB_TCP_STATE_CLOSING:
   strcpy(strState, "CLOSING");
   break;
  case MIB_TCP_STATE_CLOSE_WAIT:
   strcpy(strState, "CLOSE_WAIT");
   break;
  case MIB_TCP_STATE_FIN_WAIT1:
   strcpy(strState, "FIN_WAIT1");
   break;
  case MIB_TCP_STATE_ESTAB:
   strcpy(strState, "ESTAB");
   break;
  case MIB_TCP_STATE_SYN_RCVD:
   strcpy(strState, "SYN_RCVD");
   break;
  case MIB_TCP_STATE_SYN_SENT:
   strcpy(strState, "SYN_SENT");
   break;
  case MIB_TCP_STATE_LISTEN:
   strcpy(strState, "LISTEN");
   break;
  case MIB_TCP_STATE_DELETE_TCB:
   strcpy(strState, "DELETE");
   break;
  default:
   printf("Error: unknown state!/n");
   break;
  }
  // 本地IP地址
  inadLocal.s_addr = pTcpExTable->table[i].dwLocalAddr;
 
  // 远程端口
  if(strcmp(strState, "LISTEN") != 0)
  {
   dwRemotePort = pTcpExTable->table[i].dwRemotePort;
  }
  else
   dwRemotePort = 0;

  // 远程IP地址
  inadRemote.s_addr = pTcpExTable->table[i].dwRemoteAddr;
 

  sprintf(szLocalAddr, "%s:%u", inet_ntoa(inadLocal),
     ntohs((unsigned short)(0x0000FFFF & pTcpExTable->table[i].dwLocalPort)));
  sprintf(szRemoteAddr, "%s:%u", inet_ntoa(inadRemote),
     ntohs((unsigned short)(0x0000FFFF & dwRemotePort)));

  // 打印出此入口的信息
  printf("%-5s %s:%d/n      State:   %s/n", "[TCP]",
   ProcessPidToName(hProcessSnap, pTcpExTable->table[i].dwProcessId, szProcessName),
   pTcpExTable->table[i].dwProcessId,
   strState);

  printf("      Local:   %s/n      Remote:  %s/n",
   szLocalAddr, szRemoteAddr);
 }

 // 打印UDP监听表信息
 for(i = 0; i < pUdpExTable->dwNumEntries; ++i)
 {
  // 本地IP地址
  inadLocal.s_addr = pUdpExTable->table[i].dwLocalAddr;

  sprintf(szLocalAddr,  "%s:%u", inet_ntoa(inadLocal),
    ntohs((unsigned short)(0x0000FFFF & pUdpExTable->table[i].dwLocalPort)));

  // 打印出此入口的信息
  printf("%-5s %s:%d/n", "[UDP]",
   ProcessPidToName(hProcessSnap, pUdpExTable->table[i].dwProcessId, szProcessName),
   pUdpExTable->table[i].dwProcessId );
  printf("      Local:   %s/n      Remote:  %s/n",
   szLocalAddr, "*.*.*.*:*" );
 }
 
 
 ::CloseHandle(hProcessSnap);
 ::LocalFree(pTcpExTable);
 ::LocalFree(pUdpExTable);
 ::FreeLibrary(hModule);
 return 0;
}

// 将进程ID号（PID）转化为进程名称
PCHAR ProcessPidToName(HANDLE hProcessSnap, DWORD ProcessId, PCHAR ProcessName)
{
 PROCESSENTRY32 processEntry;
 processEntry.dwSize = sizeof(processEntry);
 // 找不到的话，默认进程名为“???”
 strcpy(ProcessName, "???");
 if(!::Process32First(hProcessSnap, &processEntry))
  return ProcessName;
 do
 {
  if(processEntry.th32ProcessID == ProcessId) // 找到和id相对应的进程名称
  {
   strcpy(ProcessName, processEntry.szExeFile);
   break;
  }
 }
 while(::Process32Next(hProcessSnap, &processEntry));
 return ProcessName;
}
   做这个工程的时候，网上的很多朋友，尤其是csdn里面的很多朋友给了很大的帮助，所以我觉得有了好的代码也应该拿出来，这样才能共同进步，还是希望那些乱贴所谓的谈端口进程映射的伪君子以后注意一点，不要把没有用的东西放到网上，浪费大家的时间，而且还让人恶心。
   这篇文章和代码任何看到的人都可以随意复制，不过希望大家尽量注明出处（visusl c++网络程序设计实例详解》（人民邮电）张越），以便尊重作者。有需要的朋友可以和我联系，我可以提供源代码，我的QQ251552062.