dcsimg
Results 1 to 14 of 14

Thread: Calling winPcap from vb6

  1. #1

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Calling winPcap from vb6

    I have an app that does some tracking of tcp connections and statistics about individual connections using extended tcp statistics. In order to enable eStats and gather the information I capture the packet flow and look for the 3 way handshake and the obviously the connection ending.

    I have a working version using raw sockets and also a version that uses a legacy activeX wrapper (packetX) around WinPcap. The raw sockets version works well. The packetX version is slow and by the time my app gets the packets the connection is already gone more than half the time.

    In order to get the best performance (best means least CPU) I want to try to call WinPcap directly. I have tried really hard but don't seem to be able to get it going. I think I have two issues. One is that I believe WinPcap is compiled _Cdecl and the second is that I just do not seem to be able to get the function declare statements correct.

    Does anyone have any ideas on how to do this or if it is possible at all?

    I know it should be but after googling a million different things and looking at all sorts of alternatives like nPcap, WinPktFilter etc I just dont seem to be able to get anything of this nature working in VB. I have some c++ but its super limited.

  2. #2
    VB-aholic & Lovin' It LaVolpe's Avatar
    Join Date
    Oct 2007
    Location
    Beside Waldo
    Posts
    18,234

    Re: Calling winPcap from vb6

    To even move forward, you'll need the functions definitions. cDecl can be called from VB using thunks and/or DispCallFunc API, but you need to know what functions to call and how to call them.
    Insomnia is just a byproduct of, "It can't be done"

    Classics Enthusiast? Here's my 1969 Mustang Mach I Fastback. Her sister '67 Coupe has been adopted

    Newbie? Novice? Bored? Spend a few minutes browsing the FAQ section of the forum.
    Read the HitchHiker's Guide to Getting Help on the Forums.
    Here is the list of TAGs you can use to format your posts
    Here are VB6 Help Files online


    {Alpha Image Control} {Memory Leak FAQ} {Unicode Open/Save Dialog} {Resource Image Viewer/Extractor}
    {VB and DPI Tutorial} {Manifest Creator} {UserControl Button Template} {stdPicture Render Usage}

  3. #3

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Re: Calling winPcap from vb6

    Thanks for your reply. Yes I get that. I will post the definitions from the winPcap documentation that I am trying to call.

  4. #4

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Re: Calling winPcap from vb6

    BTW does the undocumented cDecl keyword in the prodecure declare statement actually do anything?

  5. #5
    VB-aholic & Lovin' It LaVolpe's Avatar
    Join Date
    Oct 2007
    Location
    Beside Waldo
    Posts
    18,234

    Re: Calling winPcap from vb6

    Quote Originally Posted by vbwins View Post
    BTW does the undocumented cDecl keyword in the prodecure declare statement actually do anything?
    For the compiler -- yes. That keyword determines how the stack is cleaned up once the function is called and the callee returns. VB expects stdCall functions, so its stack clean-up is based on that expectation. Mixing the two without the knowledge of one or the other (caller, callee) results in stack corruption.

    The DispCallFunc API can call various calling conventions, but has a bit of a learning curve for its usage. Thunks are simply routines written to executable memory that are told which calling convention is expected by the caller and callee and its code adjusts the stack properly, as needed. A tad bit more complex than that, but that is the gist.
    Insomnia is just a byproduct of, "It can't be done"

    Classics Enthusiast? Here's my 1969 Mustang Mach I Fastback. Her sister '67 Coupe has been adopted

    Newbie? Novice? Bored? Spend a few minutes browsing the FAQ section of the forum.
    Read the HitchHiker's Guide to Getting Help on the Forums.
    Here is the list of TAGs you can use to format your posts
    Here are VB6 Help Files online


    {Alpha Image Control} {Memory Leak FAQ} {Unicode Open/Save Dialog} {Resource Image Viewer/Extractor}
    {VB and DPI Tutorial} {Manifest Creator} {UserControl Button Template} {stdPicture Render Usage}

  6. #6

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Re: Calling winPcap from vb6

    Lets start with this one.

    BOOLEAN PacketGetAdapterNames ( PTSTR pStr,
    PULONG BufferSize
    )

    Retrieve the list of available network adapters and their description.

    Parameters:
    pStr User allocated string that will be filled with the names of the adapters.
    BufferSize Length of the buffer pointed by pStr. If the function fails, this variable contains the number of bytes that are needed to contain the adapter list.


    I would think I should pass a strptr value as a long for the pStr and a long by length for the buffer length? This is in packet.dll

    ftp://hacktic.nl/pub/security/packet...et32.html#ga87

  7. #7

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Re: Calling winPcap from vb6

    Lets start with this one.

    BOOLEAN PacketGetAdapterNames ( PTSTR pStr,
    PULONG BufferSize
    )

    Retrieve the list of available network adapters and their description.

    Parameters:
    pStr User allocated string that will be filled with the names of the adapters.
    BufferSize Length of the buffer pointed by pStr. If the function fails, this variable contains the number of bytes that are needed to contain the adapter list.


    I would think I should pass a strptr value as a long for the pStr and a long by length for the buffer length? This is in packet.dll

    ftp://hacktic.nl/pub/security/packet...et32.html#ga87

    But I either get the dreaded bad dll calling convention or the process gets blown away with an AV.

  8. #8
    VB-aholic & Lovin' It LaVolpe's Avatar
    Join Date
    Oct 2007
    Location
    Beside Waldo
    Posts
    18,234

    Re: Calling winPcap from vb6

    Ask the question or find the answer, you'll want to know what each of the variable types mean, relative to VB. I don't know if this is the right source. https://docs.microsoft.com/en-us/win...ows-data-types

    Based on that link: BOOL is defined as a TYPEDEF, which I believe is just 1 byte, but not sure. PULONG is defined as a pointer to a unsigned long value. PTSTR is either a pointer to a Unicode or ANSI string, and depends on how the DLL is compiled -- either using the Unicode directive or not. In any case, if we are talking about pointers, typically the value is passed ByRef. Unicode strings passed ByRef are done as ByVal StrPtr().

    I am going to assume PTSTR is ANSI vs Unicode. You need to verify whether the DLL is written for ANSI or Unicode.

    Others will correct me if I am wrong
    Code:
    Declare Function PacketGetAdapterNames Lib "whatever.dll"(pStr As Any, ByRef BufferSize As Long) As Long
    - since not sure how many bytes BOOL uses, may want to test 1st byte of return value & expect other bytes to be junk?
    - String can be passed like: ByVal myString for ANSI or ByVal StrPtr(myString) for unicode

    Again, if cDecl, you can't safely call this directly from VB anyway. Hope the above link and attempted translation of the function is helpful. Others with far more experience in converting C to VB will likely chime in since that stuff is in their playground.
    Last edited by LaVolpe; Jun 18th, 2019 at 09:48 AM.
    Insomnia is just a byproduct of, "It can't be done"

    Classics Enthusiast? Here's my 1969 Mustang Mach I Fastback. Her sister '67 Coupe has been adopted

    Newbie? Novice? Bored? Spend a few minutes browsing the FAQ section of the forum.
    Read the HitchHiker's Guide to Getting Help on the Forums.
    Here is the list of TAGs you can use to format your posts
    Here are VB6 Help Files online


    {Alpha Image Control} {Memory Leak FAQ} {Unicode Open/Save Dialog} {Resource Image Viewer/Extractor}
    {VB and DPI Tutorial} {Manifest Creator} {UserControl Button Template} {stdPicture Render Usage}

  9. #9

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Re: Calling winPcap from vb6

    Here is a link to the c++ header file for packet.dll if that helps.

    https://github.com/mscdex/cap/blob/m...ude/Packet32.h


    To even get started I need to be able to call

    BOOLEAN PacketGetAdapterNames(PTSTR pStr,PULONG BufferSize);

  10. #10

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Re: Calling winPcap from vb6

    Thanks LaVolpe. Will continue to try.

  11. #11

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Re: Calling winPcap from vb6

    This gives bad dll calling convention.

    Removing the "as long" from the function definition results in vb ide getting blown away.

    Option Explicit
    Private Declare Function PacketGetAdapterNames Lib "packet.dll" (ByVal stringBuffer As Long, ByRef bufferLength As Long) As Long
    Private Sub Form_Load()
    Dim bufferLength As Long
    Dim strBuffer As String
    strBuffer = Space$(100)
    bufferLength = 100
    If PacketGetAdapterNames(StrPtr(strBuffer), bufferLength) Then
    End If
    End Sub

  12. #12
    VB-aholic & Lovin' It LaVolpe's Avatar
    Join Date
    Oct 2007
    Location
    Beside Waldo
    Posts
    18,234

    Re: Calling winPcap from vb6

    If that function is cDecl calling convention, you already didn't heed my warnings -- don't call cDecl directly with a VB API declaration. Use DispCallFunc API or a Type Library with the cDecl functions declared in it (think you can find posts on that topic).

    FYI: When removing the "As Long", then you use "As Any" and pass parameter ByVal if needed. But above statement remains valid.

    And regarding the Bad calling convention -- most likely related to cDecl or having the return value or a parameter vartype declared wrong.
    Insomnia is just a byproduct of, "It can't be done"

    Classics Enthusiast? Here's my 1969 Mustang Mach I Fastback. Her sister '67 Coupe has been adopted

    Newbie? Novice? Bored? Spend a few minutes browsing the FAQ section of the forum.
    Read the HitchHiker's Guide to Getting Help on the Forums.
    Here is the list of TAGs you can use to format your posts
    Here are VB6 Help Files online


    {Alpha Image Control} {Memory Leak FAQ} {Unicode Open/Save Dialog} {Resource Image Viewer/Extractor}
    {VB and DPI Tutorial} {Manifest Creator} {UserControl Button Template} {stdPicture Render Usage}

  13. #13
    VB-aholic & Lovin' It LaVolpe's Avatar
    Join Date
    Oct 2007
    Location
    Beside Waldo
    Posts
    18,234

    Re: Calling winPcap from vb6

    Just FYI. Awhile back I wrote a wrapper for the DispCallFunc api. You can find it in the code bank
    http://www.vbforums.com/showthread.p...all-DLL-Calls)

    Edited: A sample call might look like this. Review the 1st two posts on that thread for more details. In a sense, that class becomes your adhoc API declarations via its function parameters.
    Code:
    Debug.Print myClass.CallFunction_DLL("packet.dll", "PacketGetAdapterNames", STR_NONE, _
           CR_LONG, CC_CDECL, StrPtr(strBuffer), VarPtr(bufferLength))
    FYI: When I used the above call, bufferLength was returned as zero, Err.LastDllError = 122 (ERROR_INSUFFICIENT_BUFFER). So the call worked and the DLL changed the value. From what I gather, bufferLength is set to zero when no adapters found. P.S. Looks as if the return value should be byte after reviewing the disassembled dll function -- only 8 bits of the eax register are being modified but Long is ok too, just look at the low byte

    I did not install winPcap, just downloaded packets.dll -- so return value probably expected.
    Last edited by LaVolpe; Jun 18th, 2019 at 12:46 PM.
    Insomnia is just a byproduct of, "It can't be done"

    Classics Enthusiast? Here's my 1969 Mustang Mach I Fastback. Her sister '67 Coupe has been adopted

    Newbie? Novice? Bored? Spend a few minutes browsing the FAQ section of the forum.
    Read the HitchHiker's Guide to Getting Help on the Forums.
    Here is the list of TAGs you can use to format your posts
    Here are VB6 Help Files online


    {Alpha Image Control} {Memory Leak FAQ} {Unicode Open/Save Dialog} {Resource Image Viewer/Extractor}
    {VB and DPI Tutorial} {Manifest Creator} {UserControl Button Template} {stdPicture Render Usage}

  14. #14

    Thread Starter
    Lively Member
    Join Date
    Mar 2019
    Posts
    64

    Re: Calling winPcap from vb6

    Thank you very much. I will continue and if I get a working example will post it in code bank.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Featured


Click Here to Expand Forum to Full Width