Initial commit

.github/workflows/build.yaml

@@ -0,0 +1,15 @@
+name: build
+on: [push]
+
+jobs:
+  build:
+    runs-on: windows-2019
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Configure CMake
+      run: cmake -S . -B _build
+
+    - name: Build
+      run: cmake --build _build

.gitignore

@@ -0,0 +1 @@
+_build*/

CMakeLists.txt

@@ -0,0 +1,20 @@
+cmake_minimum_required(VERSION 3.16)
+
+set(NDISDUMP_VERSION "0.0.0" CACHE STRING "ndisdump version number (major.minor.patch)")
+project(ndisdump VERSION "${NDISDUMP_VERSION}")
+
+configure_file(src/ndisdump.rc.in ndisdump.rc)
+
+add_executable(ndisdump
+	src/main.cpp
+	src/cmdline.h
+	src/comptr.h
+	src/hr.h
+	src/pcapng.h
+	src/registry.h
+	src/sigint.h
+	src/utf8.h
+	"${CMAKE_CURRENT_BINARY_DIR}/ndisdump.rc"
+	)
+target_compile_features(ndisdump PUBLIC cxx_std_20)
+target_link_libraries(ndisdump PUBLIC iphlpapi.lib)

LICENSE

@@ -0,0 +1,17 @@
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,27 @@
+# ndisdump
+
+A no-dependencies network packet capture tool for Windows.
+
+## Introduction
+
+Windows systems come with a pre-installed network filter, ndiscap.sys,
+which is used by `netsh trace` command to perform network captures
+into an .etl file. The file which must then be converted to .pcapng with
+another tool.
+
+This repository contains `ndisdump`, a tool that uses ndiscap.sys
+to perform network capture directly into .pcapng file.
+
+```
+Usage: ndisdump [-s SNAPLEN] -w FILE
+
+-w FILE      The name of the output .pcapng file.
+-s SNAPLEN   Truncate packets to SNAPLEN to save disk space.
+```
+
+You can terminate the capture with Ctrl+C.
+
+## TODO
+
+The ultimate aim is for this tool to have the same command-line interface
+as `tcpdump`, including the filter language.

VERSION

@@ -0,0 +1 @@
+1.0

src/cmdline.h

@@ -0,0 +1,176 @@
+#include "utf8.h"
+
+#include <filesystem>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <system_error>
+
+#include <windows.h>
+
+struct command_line_reader
+{
+	command_line_reader()
+		: command_line_reader(::GetCommandLineW())
+	{
+	}
+
+	command_line_reader(int argc, char const * const argv[])
+		: command_line_reader(::GetCommandLineW())
+	{
+	}
+
+	explicit command_line_reader(wchar_t const * cmdline)
+	{
+		wchar_t ** argv = ::CommandLineToArgvW(cmdline, &_argc);
+		if (!argv)
+		{
+			DWORD err = ::GetLastError();
+			throw std::system_error(err, std::system_category());
+		}
+
+		_argv.reset(argv);
+
+		_arg0 = this->pop_path();
+	}
+
+	std::filesystem::path const & arg0() const noexcept
+	{
+		return _arg0;
+	}
+
+	bool next()
+	{
+		if (_forced_arg)
+			throw std::runtime_error("XXX unexpected argument");
+
+	retry:
+		if (*_short_opts)
+		{
+			_opt.resize(2);
+			_opt[0] = '-';
+			_opt[1] = (char)*_short_opts++;
+
+			if (*_short_opts == '=')
+			{
+				_forced_arg = _short_opts + 1;
+				_short_opts = L"";
+			}
+			return true;
+		}
+
+		if (_idx >= _argc)
+			return false;
+
+		wchar_t const * cur = _argv[_idx++];
+		if (_parse_opts && cur[0] == '-' && cur[1] != 0 && cur[1] != '=')
+		{
+			if (cur[1] == '-')
+			{
+				if (cur[2] == 0)
+				{
+					_parse_opts = false;
+					_opt.clear();
+					_forced_arg = cur;
+				}
+				else
+				{
+					_apply_long_arg(cur);
+				}
+			}
+			else
+			{
+				_short_opts = cur + 1;
+				goto retry;
+			}
+		}
+		else
+		{
+			_opt.clear();
+			_forced_arg = cur;
+		}
+
+		return true;
+	}
+
+	friend bool operator==(command_line_reader const & lhs, std::string_view rhs) noexcept
+	{
+		return lhs._opt == rhs;
+	}
+
+	std::string pop_string()
+	{
+		if (_forced_arg)
+			return to_utf8(std::exchange(_forced_arg, nullptr));
+
+		if (_idx >= _argc)
+			throw std::runtime_error("XXX expected an argument");
+
+		return to_utf8(_argv[_idx++]);
+	}
+
+	void pop_path(std::filesystem::path & out)
+	{
+		if (!out.empty())
+			throw std::runtime_error("XXX argument already specified");
+
+		out = this->pop_path();
+		if (out.empty())
+			throw std::runtime_error("XXX argument must be non-empty");
+	}
+
+	std::filesystem::path pop_path()
+	{
+		if (_forced_arg)
+			return std::exchange(_forced_arg, nullptr);
+
+		if (_idx >= _argc)
+			throw std::runtime_error("XXX expected an argument");
+
+		return _argv[_idx++];
+	}
+
+private:
+	void _apply_long_arg(wchar_t const * arg)
+	{
+		wchar_t const * p = arg + 2;
+		for (;;)
+		{
+			switch (*p)
+			{
+			case '=':
+				_forced_arg = p + 1;
+				[[fallthrough]];
+
+			case 0:
+				_opt = to_utf8({ arg, size_t(p - arg) });
+				return;
+
+			default:
+				++p;
+			}
+		}
+	}
+
+	struct _win32_local_deleter
+	{
+		void operator()(void const * p)
+		{
+			if (p)
+				::LocalFree((HLOCAL)p);
+		}
+	};
+
+	int _argc;
+	int _idx = 0;
+	std::unique_ptr<wchar_t const * const[], _win32_local_deleter> _argv;
+
+	bool _parse_opts = true;
+	wchar_t const * _short_opts = L"";
+	wchar_t const * _forced_arg = nullptr;
+
+	std::string _opt;
+	std::filesystem::path _arg0;
+};
+
+#pragma once

src/comptr.h

@@ -0,0 +1,83 @@
+#include "hr.h"
+#include <concepts>
+#include <unknwn.h>
+
+template <std::derived_from<IUnknown> T>
+struct comptr
+{
+	comptr() noexcept
+		: _ptr(nullptr)
+	{
+	}
+
+	explicit comptr(T * ptr) noexcept
+		: _ptr(ptr)
+	{
+	}
+
+	explicit operator bool() const noexcept
+	{
+		return _ptr != nullptr;
+	}
+
+	T * get() const noexcept
+	{
+		return _ptr;
+	}
+
+	T * operator->() const noexcept
+	{
+		return this->get();
+	}
+
+	T ** operator~() noexcept
+	{
+		this->reset();
+		return &_ptr;
+	}
+
+	template <std::derived_from<IUnknown> Q>
+	comptr<Q> query() const
+	{
+		if (!_ptr)
+			return {};
+		void * r;
+		hrtry _ptr->QueryInterface(__uuidof(Q), &r);
+		return comptr<Q>(static_cast<Q *>(r));
+	}
+
+	void reset(T * ptr = nullptr) noexcept
+	{
+		if (_ptr)
+			_ptr->Release();
+		_ptr = ptr;
+	}
+
+	~comptr()
+	{
+		this->reset();
+	}
+
+	comptr(comptr const & o) noexcept
+		: _ptr(o._ptr)
+	{
+		if (_ptr)
+			_ptr->AddRef();
+	}
+
+	comptr(comptr && o) noexcept
+		: _ptr(std::exchange(o._ptr, nullptr))
+	{
+	}
+
+	comptr & operator=(comptr o) noexcept
+	{
+		std::swap(_ptr, o._ptr);
+		return *this;
+	}
+
+private:
+	T * _ptr;
+};
+
+#pragma once

src/hr.h

@@ -0,0 +1,16 @@
+#include <system_error>
+#include <windows.h>
+
+struct _hresult_checker
+{
+	HRESULT operator%(HRESULT hr) const
+	{
+		if (FAILED(hr))
+			throw std::system_error(hr, std::system_category());
+		return hr;
+	}
+};
+
+#define hrtry ::_hresult_checker() %
+
+#pragma once