🚀 go-pugleaf

You don't.  The API doesn't provide for that.  You'd probably have to
replace the WinSock DLL altogether, or at least implement the debug version
of it, so you can intercept the actual requests to create sockets.  That's
what firewalls and such have to do.  I have no idea how to actually do any
of that, though, sorry.


Gambit

"Boguslaw Fries" <B.Fries@luca-online.de> wrote in message
news:3e64b9a4$1@newsgroups.borland.com...

> How could I determine the name ( + parameters )
> of the process which opened particular TCP/UDP port

Yet I know slight more,
I found something but I idnt understand . May you help me in my
investigations?

It is possible in Win 2000?


 pCreateToolhelp32Snapshot = (PVOID) GetProcAddress( GetModuleHandle(
"kernel32.dll" ),
    "CreateToolhelp32Snapshot" );


HANDLE (WINAPI * pCreateToolhelp32Snapshot ) ( DWORD dwFlags,  DWORD
th32ProcessID );


Boguslaw FRies

I could add someting because I found it


 The procedure "AllocateAndGetTcpExTableFromStack" can fill dwProcessId
field in

PMIB_TCPEXTABLE structure, but
where is this WINAPI procedure??? and which paramameters hat?

Boguslaw Fries

Boguslaw Fries wrote:
> where is this WINAPI procedure??? and which paramameters hat?

It's declared in Google.h ;)
http://www.google.net/search?q=AllocateAndGetTcpExTableFromStack

-- 
codito, ergo sum :]

That only allows you to see which processes are running on the system in
general.  Not which TCP/UDP sockets they are associated with.  You'll still
have to intercept the socket requests at the lower levels in order to know
which processes are making the requests to begin with.  Then, assuming you
can get a process ID for each request, you can use the ToolHelp API to
resolve the process IDs to filenames.


Gambit

"Boguslaw Fries" <B.Fries@luca-online.de> wrote in message
news:3e65a4b7$1@newsgroups.borland.com...

>  pCreateToolhelp32Snapshot = (PVOID) GetProcAddress( GetModuleHandle(
> "kernel32.dll" ),
>     "CreateToolhelp32Snapshot" );
>
>
> HANDLE (WINAPI * pCreateToolhelp32Snapshot ) ( DWORD dwFlags,  DWORD
> th32ProcessID );

Thanks, I tried it but

typedef DWORD ( __import WINAPI *PAllocateTcp ) ( PMIB_TCPEXTABLE, bool,
HANDLE, DWORD, DWORD );

 pAllocateAndGetTcpExTableFromStack = ( PAllocateTcp * ) GetProcAddress(
LoadLibrary( "iphlpapi.dll"),
    "AllocateAndGetTcpExTableFromStack" );

returns NULL

I have windows 2000.

Thanks, I tried it
but
it returns NULL

typedef DWORD ( __import WINAPI *PAllocateTcp ) ( PMIB_TCPEXTABLE, bool,
HANDLE, DWORD, DWORD );
PAllocateTcp  *pAllocateAndGetTcpExTableFromStack;


 pAllocateAndGetTcpExTableFromStack = ( PAllocateTcp * ) GetProcAddress(
LoadLibrary( "iphlpapi.dll"),
    "AllocateAndGetTcpExTableFromStack" );


I have Windows 2000 and Borland Builder 3.0

Boguslaw Fries

"Boguslaw Fries" <B.Fries@luca-online.de> wrote in message
news:3e66f6b1$1@newsgroups.borland.com...
> Thanks, I tried it but
<snip>
> returns NULL

Which means that either:

1) you don't have iphlpapi.dll on your system's search path

or else

2) you do have it, but AllocateAndGetTcpExTableFromStack() doesn't actually
exist in it.


Gambit

Yes :(
In my iphlpapi.dll there is no this API indeed.
Perhaps it is available starting from XP ? - I have windows 2000
Any extra idea?

Regards