Pages

2009-09-28

Get PID of an application by its listening TCP port using Win32 API

--- PidByPort.cpp Start ---

#include <winsock2.h>
#include <malloc.h>
#include "iphlpapi_2.h"
#include <stdio.h>

long GetPIDbyPort(long port) {


    long ret = 0; PVOID pTCPTable = NULL; DWORD size = 0; DWORD result = 0; result = pGetExtendedTcpTable(NULL, &size, true, AF_INET, TCP_TABLE_OWNER_MODULE_ALL, 0); while(result == ERROR_INSUFFICIENT_BUFFER){
      if(pTCPTable != NULL){
        free(pTCPTable);
      }
      pTCPTable = malloc(size); result = pGetExtendedTcpTable(pTCPTable, &size, true, AF_INET, TCP_TABLE_OWNER_MODULE_ALL, 0); if(result != NO_ERROR){
        printf("Failed to get TCP Table %s\n", GetLastError()); free(pTCPTable); return ret;
      }
    } if(result != NO_ERROR){
      printf("Failed to get size estimation %s\n", GetLastError()); return ret;
    } for(DWORD i = 0; i < ((PMIB_TCPTABLE_OWNER_MODULE)pTCPTable)->dwNumEntries; i++){
      MIB_TCPROW_OWNER_MODULE module = ((PMIB_TCPTABLE_OWNER_MODULE)pTCPTable)->table[i]; if(port==htons((short)module.dwLocalPort)) {
        #ifdef DEBUG printf("PID = %d, ", module.dwOwningPid); printf("State = %s\n ", g_mibTCPState[module.dwState]); printf(" LocalAddress = %d.%d.%d.%d, ", (htonl(module.dwLocalAddr) >> 24) & 0xFF, (htonl(module.dwLocalAddr) >> 16) & 0xFF, (htonl(module.dwLocalAddr) >> 8)& 0xFF, (htonl(module.dwLocalAddr)) & 0xFF); printf("LocalPort = %u,\n ", htons((short)module.dwLocalPort)); if(module.dwState != MIB_TCP_STATE_LISTEN){
          printf(" RemoteAddress = %d.%d.%d.%d, ", (htonl(module.dwRemoteAddr) >> 24) & 0xFF, (htonl(module.dwRemoteAddr) >> 16) & 0xFF, (htonl(module.dwRemoteAddr) >> 8) & 0xFF, (htonl(module.dwRemoteAddr)) & 0xFF); printf("RemotePort = %u\n ", htons((short)module.dwRemotePort));
        } printf(" TimeStamp = %I64d, ", module.liCreateTimestamp); printf(" ULONGLONG = UnDocumentedMeaning\n"); printf("\n"); #endif ret=module.dwOwningPid;
      }
    } if(pTCPTable != NULL) {
      free(pTCPTable);
    } return ret;
} --- PidByPort.cpp End -- --- iphlpapi_2.h Start --- #include <Iprtrmib.h> char* g_mibTCPState[] = {
    "???", "MIB_TCP_STATE_CLOSED", "MIB_TCP_STATE_LISTEN", "MIB_TCP_STATE_SYN_SENT", "MIB_TCP_STATE_SYN_RCVD", "MIB_TCP_STATE_ESTAB", "MIB_TCP_STATE_FIN_WAIT1", "MIB_TCP_STATE_FIN_WAIT2", "MIB_TCP_STATE_CLOSE_WAIT", "MIB_TCP_STATE_CLOSING", "MIB_TCP_STATE_LAST_ACK", "MIB_TCP_STATE_TIME_WAIT", "MIB_TCP_STATE_DELETE_TCB" };
typedef enum {
    TCP_TABLE_BASIC_LISTENER, TCP_TABLE_BASIC_CONNECTIONS, TCP_TABLE_BASIC_ALL, TCP_TABLE_OWNER_PID_LISTENER, TCP_TABLE_OWNER_PID_CONNECTIONS, TCP_TABLE_OWNER_PID_ALL, TCP_TABLE_OWNER_MODULE_LISTENER, TCP_TABLE_OWNER_MODULE_CONNECTIONS, TCP_TABLE_OWNER_MODULE_ALL } TCP_TABLE_CLASS, *PTCP_TABLE_CLASS;
DWORD (WINAPI *pGetExtendedTcpTable)(
    PVOID pTcpTable, PDWORD pdwSize, BOOL bOrder, ULONG ulAf, TCP_TABLE_CLASS TableClass, ULONG Reserved );
--- iphlpapi_2.h End--- --- Compiling --- cl -c PidByPort.cpp /D"_CRT_SECURE_NO_DEPRECATE" /EHcs /DDEBUG

That's it!

No comments:

Post a Comment