c - 我如何使用c将数据保存在二进制文件中

Question

我已经实现了一个 c 程序，其中以混杂模式从网络接收原始数据包并将其存储在文本文件中。但我应该将它保存在二进制文件中。我怎样才能做到这一点？我的意思是我需要更改什么才能将其保存为二进制文件。请问有人可以指导我吗？或者给我一个链接，我可以在其中浏览二进制文件处理程序并检查解决方案:(

这是我的 data_capture_module:

int main()
{
int saddr_size , data_size;
struct sockaddr saddr;
gopromiscous();
unsigned char *buffer = (unsigned char *) malloc(1024);  

logfile=fopen("sniff_data.txt","w");
if(logfile==NULL)
  {
    printf("Unable to create sniff_data file.");
  }
printf("\n Starting..\n");

int sock_raw = socket( AF_PACKET , SOCK_RAW , htons(ETH_P_ALL)) ;
 setsockopt(sock_raw , SOL_SOCKET , SO_BINDTODEVICE , "eth0" , strlen("eth0")+ 1 );

if(sock_raw < 0)
   {
    //Print the error with proper message
    perror("Socket Error");
    return 1;
   }
int count=30; 
while(count>=0)
  { 
    count--;
    saddr_size = sizeof saddr;       
    data_size = recvfrom(sock_raw , buffer , 1024, 0 , &saddr ,(socklen_t*)&saddr_size);
    if(data_size <0 )
    {
        printf("Recvfrom error , failed to get packets\n");
        return 1;
    }
    ProcessPacket(buffer , data_size);
  }
fclose(logfile);
close(sock_raw);
printf("\n");
printf(" Finished\n\n");
return 0;
}

void ProcessPacket(unsigned char* buffer, int size)

{
//Get the IP Header part of this packet , excluding the ethernet header
struct iphdr *iph = (struct iphdr*)(buffer + sizeof(struct ethhdr));
++total;
switch (iph->protocol) //Check the Protocol and do accordingly...
  {
    case 1:  //ICMP Protocol
        ++icmp;
        print_icmp_packet( buffer , size);
        break;

    case 2:  //IGMP Protocol
        ++igmp;
        break;

    case 6:  //TCP Protocol
        ++tcp;
        print_tcp_packet(buffer , size);
        break;

    case 17: //UDP Protocol
        ++udp;
        print_udp_packet(buffer , size);
        break;

    default: //Some Other Protocol like ARP etc.
        ++others;
        break;
   }
printf(" TCP : %d   UDP : %d   ICMP : %d   IGMP : %d   Others : %d   Total : %d\r",tcp, ,    udp , icmp , igmp , others , total);
}

void print_ethernet_header(unsigned char* Buffer, int Size)
{
struct ethhdr *eth = (struct ethhdr *)Buffer;

fprintf(logfile , "\n");
fprintf(logfile , "Ethernet Header\n");
fprintf(logfile , "   |-Destination Address : %.2X-%.2X-%.2X-%.2X-%.2X-%.2X \n",       

eth->h_dest[0] , eth->h_dest[1] , eth->h_dest[2] , eth->h_dest[3] , eth->h_dest[4] ,      eth->h_dest[5] );
fprintf(logfile , "   |-Source Address      : %.2X-%.2X-%.2X-%.2X-%.2X-%.2X \n",        

eth->h_source[0] , eth->h_source[1] , eth->h_source[2] , eth->h_source[3] , 
eth->h_source[4] , eth->h_source[5] );
fprintf(logfile , "   |-Protocol            : %u \n",(unsigned short)eth->h_proto);

}

void print_ip_header(unsigned char* Buffer, int Size)
{
print_ethernet_header(Buffer , Size);

unsigned short iphdrlen;

struct iphdr *iph = (struct iphdr *)(Buffer  + sizeof(struct ethhdr) );
iphdrlen =iph->ihl*4;

memset(&source, 0, sizeof(source));
source.sin_addr.s_addr = iph->saddr;

memset(&dest, 0, sizeof(dest));
dest.sin_addr.s_addr = iph->daddr;

fprintf(logfile , "\n");
fprintf(logfile , "IP Header\n");
fprintf(logfile , "   |-IP Version        : %d\n",(unsigned int)iph->version);

fprintf(logfile , "   |-Type Of Service   : %d\n",(unsigned int)iph->tos);
fprintf(logfile , "   |-IP Total Length   : %d  Bytes(Size ofPacket)",   
                                                             ntohs(iph->tot_len));
fprintf(logfile , "   |-Identification    : %d\n",ntohs(iph->id));

fprintf(logfile , "   |-TTL      : %d\n",(unsigned int)iph->ttl);
fprintf(logfile , "   |-Protocol : %d\n",(unsigned int)iph->protocol);
fprintf(logfile , "   |-Checksum : %d\n",ntohs(iph->check));
fprintf(logfile , "   |-Source IP        : %s\n",inet_ntoa(source.sin_addr));
fprintf(logfile , "   |-Destination IP   : %s\n",inet_ntoa(dest.sin_addr));

}

void print_tcp_packet(unsigned char* Buffer, int Size)
{
unsigned short iphdrlen;
struct iphdr *iph = (struct iphdr *)( Buffer  + sizeof(struct ethhdr) );
iphdrlen = iph->ihl*4;     
struct tcphdr *tcph=(struct tcphdr*)(Buffer + iphdrlen + sizeof(struct ethhdr));

int header_size =  sizeof(struct ethhdr) + iphdrlen + tcph->doff*4;

fprintf(logfile , "\n\n***********************TCP Packet*************************\n"); 

print_ip_header(Buffer,Size);

fprintf(logfile , "\n");
fprintf(logfile , "TCP Header\n");
fprintf(logfile , "   |-Source Port      : %u\n",ntohs(tcph->source));
fprintf(logfile , "   |-Destination Port : %u\n",ntohs(tcph->dest));
fprintf(logfile , "   |-Sequence Number    : %u\n",ntohl(tcph->seq));
fprintf(logfile , "   |-Acknowledge Number : %u\n",ntohl(tcph->ack_seq));
fprintf(logfile , "   |-Header Length      : %d DWORDS or %d BYTES\n" ,(unsigned i

fprintf(logfile , "   |-Urgent Flag          : %d\n",(unsigned int)tcph->urg);
fprintf(logfile , "   |-Acknowledgement Flag : %d\n",(unsigned int)tcph->ack);
fprintf(logfile , "   |-Push Flag            : %d\n",(unsigned int)tcph->psh);
fprintf(logfile , "   |-Reset Flag           : %d\n",(unsigned int)tcph->rst);
fprintf(logfile , "   |-Synchronise Flag     : %d\n",(unsigned int)tcph->syn);
fprintf(logfile , "   |-Finish Flag          : %d\n",(unsigned int)tcph->fin);
fprintf(logfile , "   |-Window         : %d\n",ntohs(tcph->window));
fprintf(logfile , "   |-Checksum       : %d\n",ntohs(tcph->check));
fprintf(logfile , "   |-Urgent Pointer : %d\n",tcph->urg_ptr);
fprintf(logfile , "\n");
fprintf(logfile , "                        DATA Dump                         ");
fprintf(logfile , "\n");

fprintf(logfile , "IP Header\n");
PrintData(Buffer,iphdrlen);

fprintf(logfile , "TCP Header\n");
PrintData(Buffer+iphdrlen,tcph->doff*4);

fprintf(logfile , "Data Payload\n");   
PrintData(Buffer + header_size , Size - header_size );

fprintf(logfile , "\n###########################################################");

}

void print_udp_packet(unsigned char *Buffer , int Size)
{     
unsigned short iphdrlen;     
struct iphdr *iph = (struct iphdr *)(Buffer +  sizeof(struct ethhdr));
iphdrlen = iph->ihl*4;     
struct udphdr *udph = (struct udphdr*)(Buffer + iphdrlen  + sizeof(struct ethhdr));

int header_size =  sizeof(struct ethhdr) + iphdrlen + sizeof udph;

fprintf(logfile , "\n\n***********************UDP Packet*************************\n");

print_ip_header(Buffer,Size);          

fprintf(logfile , "\nUDP Header\n");
fprintf(logfile , "   |-Source Port      : %d\n" , ntohs(udph->source));
fprintf(logfile , "   |-Destination Port : %d\n" , ntohs(udph->dest));
fprintf(logfile , "   |-UDP Length       : %d\n" , ntohs(udph->len));
fprintf(logfile , "   |-UDP Checksum     : %d\n" , ntohs(udph->check));

fprintf(logfile , "\n");
fprintf(logfile , "IP Header\n");
PrintData(Buffer , iphdrlen);

fprintf(logfile , "UDP Header\n");
PrintData(Buffer+iphdrlen , sizeof udph);

fprintf(logfile , "Data Payload\n");   

//Move the pointer ahead and reduce the size of string
PrintData(Buffer + header_size , Size - header_size);

fprintf(logfile , "\n###########################################################");
}

void print_icmp_packet(unsigned char* Buffer , int Size)
{
unsigned short iphdrlen;     
struct iphdr *iph = (struct iphdr *)(Buffer  + sizeof(struct ethhdr));
iphdrlen = iph->ihl * 4;

struct icmphdr *icmph = (struct icmphdr *)(Buffer + iphdrlen  + sizeof(struct ethhdr));

int header_size =  sizeof(struct ethhdr) + iphdrlen + sizeof icmph;

fprintf(logfile , "\n\n***********************ICMP Packet*************************\n");

print_ip_header(Buffer , Size);

fprintf(logfile , "\n");

fprintf(logfile , "ICMP Header\n");
fprintf(logfile , "   |-Type : %d",(unsigned int)(icmph->type));

if((unsigned int)(icmph->type) == 11)
{
    fprintf(logfile , "  (TTL Expired)\n");
}
else if((unsigned int)(icmph->type) == ICMP_ECHOREPLY)
{
    fprintf(logfile , "  (ICMP Echo Reply)\n");
}

fprintf(logfile , "   |-Code : %d\n",(unsigned int)(icmph->code));
fprintf(logfile , "   |-Checksum : %d\n",ntohs(icmph->checksum));
//fprintf(logfile , "   |-ID       : %d\n",ntohs(icmph->id));
//fprintf(logfile , "   |-Sequence : %d\n",ntohs(icmph->sequence));
fprintf(logfile , "\n");

fprintf(logfile , "IP Header\n");
PrintData(Buffer,iphdrlen);

fprintf(logfile , "UDP Header\n");
PrintData(Buffer + iphdrlen , sizeof icmph);

fprintf(logfile , "Data Payload\n");   

//Move the pointer ahead and reduce the size of string
PrintData(Buffer + header_size , (Size - header_size) );

fprintf(logfile , "\n###########################################################");
}


int gopromiscous()
{

    int fd;
    struct ifreq eth;

    fd = socket(AF_INET, SOCK_PACKET, htons(0x800));

    strcpy(eth.ifr_name, "eth0");

    ioctl(fd, SIOCGIFFLAGS, &eth);

    eth.ifr_flags |= IFF_PROMISC;

    ioctl(fd, SIOCSIFFLAGS, &eth);
    printf("\n Entered Promiscuous Mode Successfully\n");

  }

void PrintData (unsigned char* data , int Size)
{
int i , j;
for(i=0 ; i < Size ; i++)
{
    if( i!=0 && i%16==0)   //if one line of hex printing is complete...
    {
        fprintf(logfile , "         ");
        for(j=i-16 ; j<i ; j++)
        {
            if(data[j]>=32 && data[j]<=128)
                fprintf(logfile , "%c",(unsigned char)data[j]); 
            else fprintf(logfile , "."); 
        }
        fprintf(logfile , "\n");
    }

    if(i%16==0) fprintf(logfile , "   ");
        fprintf(logfile , " %02X",(unsigned int)data[i]);

    if( i==Size-1)  //print the last spaces
    {
        for(j=0;j<15-i%16;j++)
        {
          fprintf(logfile , "   "); //extra spaces
        }

        fprintf(logfile , "         ");

        for(j=i-i%16 ; j<=i ; j++)
        {
            if(data[j]>=32 && data[j]<=128)
            {
              fprintf(logfile , "%c",(unsigned char)data[j]);
            }
            else
            {
              fprintf(logfile , ".");
            }
        }

        fprintf(logfile ,  "\n" );
    }
  }
}

Answer 1

1. 以二进制模式打开日志文件(“wb” 作为 fopen() 的模式参数)。

2. 使用fwrite()将数据写入日志文件:

   if (fwrite(buffer, data_size, 1, logfile) != 1)
       ...short write...problems...
   

3. 关闭日志文件。

请注意，在 Unix 系统上，b 标志是可选的(它没有坏处，但也没有任何好处)。在 Windows 上，b 标志很重要。对于可移植代码，使用 b 标志打开二进制文件。