table of Contents
0x01 download and install Npcap and related components
SDK and environment support in Npcap under the official website
Npcap: Windows Packet Capture Library & Driver
There are four files here
- Npcap 0.9997 installer for Windows 7/2008R2, 8/2012, 8.1/2012R2, 10/2016, 2019 (x86 and x64).
- Npcap SDK 1.05 (ZIP).
- Npcap 0.9997 debug symbols (ZIP).
- Npcap 0.9997 source code (ZIP).
- The first is the installation environment, the necessary environment is installed, if not, the driver will be missing. The program will inject the necessary static link libraries into the system, which are necessary programs that the program asks to call;
- SDK is a software development kit, which contains the necessary header files and dynamic link libraries for Npcap network programming
- The third is the debugging symbol package, which provides a set of symbols for debugging
- The fourth one provides the source code developed by Npcap. Developers can read it to understand the underlying principle or optimize it.
Download these four files here
Unzip and install
The personal installation method is introduced here. The principle is to create a folder unchanged , and the following operations are performed under this folder
WinNetworkProgram
- Run and
npcap-0.9997.exe
install Npcap, fool-proof installation, no introduction; - Unzip the content of the SDK and place
SDK
it in the folder; - Unzip the source code file to the
Source-code
folder; - Unzip the symbol set to the
DebugSymbols
folder - Create a
Project
folder, our project is expanded in this folder - Based on
Project
the establishment of foldersrc
andbin
file folders,src
store your source code,bin
store your resulting executable program
0x02 vscode configuration
vscode basic environment configuration for C and C++ compilation and operation
- This is part of a lot of information on the network, not to repeat, you can download the plug, the proposed installation
C/C++ Extension Pack
can be
vscode configuration of Npcap programming
- The
Project
folder vscode open, (open folders) - Generally,
C/C++
this plugin will automatically create a configuration for you to edit. If not, create a.vscode
folder, create ac_cpp_properties.json
file in it , and fill in the following code:
{
"configurations": [
{
"name": "Win32",
"includePath": [
"${workspaceFolder}/..//SDK/Include/**",
"${workspaceFolder}/../SDK/Include",
"${workspaceFolder}/src/**",
"${workspaceFolder}/src"
],
"defines": [
"_DEBUG",
"UNICODE",
"_UNICODE"
],
"compilerPath": "D:\\etc\\MinGW\\bin\\gcc.exe",
"cStandard": "gnu18",
"cppStandard": "gnu++14",
"intelliSenseMode": "gcc-x64",
"compilerArgs": [
"-L${workspaceFolder}/../SDK/Lib",
"-lwpcap",
"-lPacket"
]
}
],
"version": 4
}
Save and exit.
Write test files
test.c
Write the following code in the file:
#include "pcap.h"
#include <stdio.h>
int main()
{
char errbuf[PCAP_ERRBUF_SIZE];//存放错误信息的缓冲
pcap_if_t *it;
int r;
r=pcap_findalldevs(&it,errbuf);
if(r==-1)
{
printf("err:%s\n",errbuf);
exit(-1);
}
while(it)
{
printf(":%s\n",it->name);
it=it->next;
}
}
- The program prints out a list of all network cards of the machine
test
- Press F5to debug the code, the first debugging will generate
launch.json
andtask.json
file, pay attention to check whether the parameter content insidec_cpp_properties.json
is the same as the previous configuration , that is, this part
"compilerArgs": [
"-L${workspaceFolder}/../SDK/Lib/",
"-lwpcap",
"-lPacket"
]
Generally speaking, this file is c_cpp_properties.json
generated based on it, and there will be no major problems.
- After generating the file, press again F5to debug and run. Note that you need to debug and run to call the dynamic link library
- There is the following information in the console
Microsoft Windows [版本 10.0.19041.508]
(c) 2020 Microsoft Corporation. 保留所有权利。
D:\home\xxxx\WinNetworkProgram> cmd /C "c:\Users\xxx\.vscode\extensions\ms-vscode.cpptools-1.0.1\debugAdapters\bin\WindowsDebugLauncher.exe --stdin=Microsoft-MIEngine-In-340uippl.fhl --stdout=Microsoft-MIEngine-Out-ekoupmwk.30e --stderr=Microsoft-MIEngine-Error-jpdvtcwn.bxf --pid=Microsoft-MIEngine-Pid-xdcenvcj.2rm --dbgExe=D:\etc\MinGW\bin\gdb.exe --interpreter=mi "
:\Device\NPF_{
456C0DB7-9C02-48CE-BF9C-D0201D93A39B}
:\Device\NPF_{
65EB5D2F-C7FD-4DAB-B591-042BF9295C9B}
:\Device\NPF_{
D235884A-3C87-4777-9B9C-9AF186C3BADF}
Success
Code-Runner run configuration
- Go to Settings-Work Area-Extension-Run Code Configuration,
settings.json
and editExecutor Map
items in. - In
settings.json
editing,c
andcpp
corresponding to the following items:
"c": "cd $dir && gcc $fileName -o $workspaceRoot\\bin\\$fileNameWithoutExt -L$workspaceRoot\\..\\SDK\\Lib -lwpcap -lPacket && cd $workspaceRoot\\bin\\ && $fileNameWithoutExt",
"cpp": "cd $dir && g++ $fileName -o $workspaceRoot\\bin\\$fileNameWithoutExt -L$workspaceRoot\\..\\SDK\\Lib -lwpcap -lPacket && cd $workspaceRoot\\bin\\ && $fileNameWithoutExt",
- In this way, you can directly use the Code Runner plug-in to run the code directly. In order not to affect the compilation process of other project programs, the configuration is modified in the workspace
- Here is the
$workspaceRoot
one in the previous configuration${workspaceFloder}
- The developed file structure is as follows:
WinNetworkProgram
-
Project
- .vscode
- c_cpp_properties.json
- launch.json
- settings.json
- tasks.json
- src
- test.c
- bin
- test.exe
- .vscode
-
SDK
-
DebugSymbols
-
Source-code