Discussion concerning the GetTcpTable API. If anyone has worked with this, please hop on. DWORD GetTcpTable( PMIB_TCPTABLE pTcpTable, // buffer for the connection table PDWORD pdwSize, // size of the buffer BOOL bOrder // sort the table? ); First off, the first two params are , meaning we pass em in, and they can be changed and returned. Now, we need to know how big to make the buffer, if we send a NULL buffer, we should get the size. invoke GetTcpTable, NULL, ADDR BufSize, NULL invoke GetProcessHeap mov hHeap, eax invoke HeapAlloc, hHeap, NULL, BufSize mov pBuf, eax invoke GetTcpTable, ADDR pBuf, ADDR BufSize, SORT_ORDER ; pick the sort order This fills in the buf for us. Cool. Now let's access it. mov ecx, pBuf ; get the pointer to buffer mov eax, ; get the number of elements in the buffer mov cCount, eax ; let's save this, OK? Now, to look at each element, we can loop like this: add ecx, SIZEOF dwNumEntries ; we now point at the first element of the array .WHILE cCount >0 ; here is how to get at all the elements mov eax, (MIB_TCPROWA PTR ).dwState invoke SomeInterestingFunction, eax, cCount mov eax, (MIB_TCPROWA PTR ).dwLocalAddr invoke SomeInterestingFunction, eax, cCount mov eax, (MIB_TCPROWA PTR ).dwLocalPort invoke SomeInterestingFunction, eax, cCount mov eax, (MIB_TCPROWA PTR ).dwRemoteAddr invoke SomeInterestingFunction, eax, cCount mov eax, (MIB_TCPROWA PTR ).dwRemotePort invoke SomeInterestingFunction, eax, cCount ; get ready to look at the next elemet fo the array add ecx, SIZEOF MIB_TCPROWA dec cCount .ENDW Finally, free the buffer invoke HeapFree, hHeap, NULL, pBuf Assumes these structs and vars: BufSize DWORD ? pBuf DWORD ? hHeap DWORD ? MIB_TCPROWA STRUCT dwState DWORD ? dwLocalAddr DWORD ? dwLocalPort DWORD ? dwRemoteAddr DWORD ? dwRemotePort DWORD ? MIB_TCPROWA ENDS MIB_TCPTABLEA STRUCT dwNumEntries DWORD ? MIB_TCPROW MIB_TCPROWA { } MIB_TCPTABLEA ENDS
Posted on 2001-01-20 17:20:00 by Ernie