jni 调用sock_raw -- 端口扫描

为什么要写一个端口扫描的程序，Java来写不是很方便吗？
因为我也没有想到什么例子能够方便的来练习。于是想到以前找到的端口扫描的C代码，于是想用他们来练习。
扫描服务端端口的方式有许多种，最简单的就是直接去连接该端口，复杂一些的就是看SYN的应答。其他方式就不说了。
下面的portScan.c位于jni目录下：（原本可在linux下运行，修改部分代码，使之能够返回结果给Java层的调用。）
#include<stdio.h>#include<stdlib.h>#include<jni.h>#include <android/log.h>#include<sys/socket.h>#include<netdb.h>#include<string.h>#include<unistd.h>#include<netinet/in.h>#include<arpa/inet.h>#include<fcntl.h>#include<time.h>#include<sys/types.h>#define TIMEOUT 5 //由于把socket设置为非阻塞，使用select函数，观察其                //5秒后的是否连接成功，连接不成功则认为其端口没有开放#define  LOG_TAG    "System.out"#define  LOGD(...)  __android_log_print(ANDROID_LOG_DEBUG,LOG_TAG,__VA_ARGS__)struct servenet{    char * s_name;    char** s_aliases;    int    s_port;    char*  s_proto;};//可复用工具方法，其实也不用写的这么复杂，因为JNI提供了一个转换函数，你可以自己去查，但是可以了解c代码调用Java方法的过程。//返回char数组的首地址//将java的String对象类型的数据转换为C语言的char数组类型char* Jstring2Cstr(JNIEnv* env,jstring jstr){    char * rtn=NULL;    jclass clsString=(*env)->FindClass(env,"java/lang/String");    jstring strEncode=(*env)->NewStringUTF(env,"GB2312");    //下一句不知道为什么不能被保存，有冲突！！！！！！！//    jmethodID mid=(*env)->GetMethodID(env,clsString,"getBytes","(Ljava/lang/String;)[B");    //第三个参数为java中的方法的签名，可以通过java -s 加上包名.类名 查看    jbyteArray jba=(jbyteArray)(*env)->CallObjectMethod(env,jstr,mid,strEncode);    //相当于执行了String的getBytes（“GB2312”）方法    jsize len=(*env)->GetArrayLength(env,jba);    jbyte* jbt=(*env)->GetByteArrayElements(env,jba,JNI_FALSE);//获取元素    if(len > 0){        rtn=(char*)malloc(len+1);        memcpy(rtn,jbt,len);//将jbyte*复制到rtn中去        rtn[len]=0;//=='\0'    }    (*env)->ReleaseByteArrayElements(env,jba,jbt,0);    //jbyte是新开辟的空间，现在不用了所以要释放，0表示释放jba指向的全部内存空间    return rtn;}jintArray startScan(JNIEnv*,char* argv,jint start_port,jint end_port);
//下面是主函数，返回int数组jintArray Java_com_linux_portscaner_MainActivity_scan(JNIEnv*env,jobject clazz,            jstring argv,jint start_port,jint end_port){    LOGD("%s","in c before start");    char *host_argv=Jstring2Cstr(env,argv);    jintArray rtn=startScan(env,host_argv,start_port,end_port);    //return (**env).NewStringUTF(env,"hello from native c");    return rtn;}//int main(int argc,char** argv)//参数是目标机的IPjintArray startScan(JNIEnv*env,char* argv,jint start_port,jint end_port){    //int port[65535]={0};index=0;//返回开放的端口号组成的数组    //char* rtn="\n";    struct sockaddr_in server;    int ret;    int len;    int count=0;//number of ports that are open     int scanport;int end_p=(int)end_port;//将jint转换为int型    jint portsOpen[20]={0};    jintArray jArray=(*env)->NewIntArray(env,20);//int a[20]    int sockfd;    int flag;//标示是ip还是主机名    struct hostent *host;//存放主机信息    fd_set rset;    fd_set wset;        struct servenet *sp;//    if(argc<2)//    {//        fprintf(stderr,"Please enter the server's IP or hostname!\n");//        exit(1);//    }  //    if((host=gethostbyname("www.baidu.com"))==NULL)    if((host=gethostbyname(argv))==NULL)        flag=0;    else flag=1;//domain name    for(scanport=(int)start_port;scanport<=end_p;scanport++)    {        if (-1==(sockfd=socket(AF_INET,SOCK_STREAM,0)))        {        //perror("can not create socket\n");            LOGD("%s","can not create socket");            return;            //exit(1);        }        memset(&server,0,sizeof(struct sockaddr_in));        server.sin_family = AF_INET;        if(!flag){            server.sin_addr.s_addr = inet_addr(argv);        }else            server.sin_addr=*((struct in_addr*)host->h_addr);        server.sin_port = htons(scanport);        int flag2 = fcntl(sockfd, F_GETFL,0);        fcntl(sockfd,F_SETFL, flag2|O_NONBLOCK);        struct timeval tm;        tm.tv_sec = TIMEOUT;        tm.tv_usec = 0;        //connect为非阻塞，连接不成功立即返回-1        if (!connect(sockfd,(struct sockaddr*)&server,sizeof(struct sockaddr))){             sp=getservbyport(htons(scanport),"tcp");            //printf("tcp port %d is open:%s\n ",scanport,sp->s_name);             //close(sockfd);             //return (**env).NewStringUTF(env,"open:"+scanport);             LOGD("open1:%d",scanport);                          portsOpen[count++]=scanport;             //rtn=(**env).NewStringUTF(env,strcat(rtn,&scanport));                }//假如连接不成功，则运行select,直到超时        else {            FD_ZERO(&rset);            FD_ZERO(&wset);            FD_SET(sockfd, &rset);            FD_SET(sockfd, &wset);            int error; //错误代码            int len = sizeof(error);            //5秒后查看socket的状态变化            if (select(sockfd+1,&rset,&wset,NULL,&tm)>0){                getsockopt(sockfd, SOL_SOCKET, SO_ERROR,&error, &len );                if(error == 0)                    //printf("Port %d is opened\n", scanport);                    //close(sockfd);                    //return (**env).NewStringUTF(env,"open2:"+scanport);                LOGD("open2:%d",scanport);                portsOpen[count++]=scanport;                //rtn=(**env).NewStringUTF(env,strcat(rtn,&scanport));            }        }        close(sockfd);    }    //return rtn;    (*env)->SetIntArrayRegion(env,jArray, 0, 19, portsOpen);//将portsOpen中的值复制到jintArray中去，数组copy    return jArray;}//void Java_com_example_hellondk_MainActivity_scan(JNIEnv*env,jobject clazz){//    LOGD("%s","in c before start");//    startScan();//}

程序需要在有网络的条件下运行，故需在manifest中加入internet权限。

startScan函数需要两个参数：端口号的大小范围，来自用户界面的用户输入，Java 代码如下：

package com.linux.portscaner;import java.io.IOException;import android.app.Activity;import android.content.Context;import android.net.ConnectivityManager;import android.os.Bundle;import android.os.Handler;import android.os.Message;import android.view.Menu;import android.view.View;import android.widget.EditText;import android.widget.TextView;public class MainActivity extends Activity {    private static TextView tv1=null;    private EditText ipOrHost,startPort,endPort;    //本地方法    public native int[] scan(String argv,int start_port,int end_port);    static{        System.loadLibrary("portScan");    }    static Handler UIupdater=new Handler(){        @Override        public void handleMessage(Message msg) {            //String buffer=(String)msg.obj;            int []ports=(int[])msg.obj;            StringBuilder sb=new StringBuilder();            sb.append("open:");            for(int i=0;i<ports.length;i++){                if(ports[i]!=0)                    sb.append(ports[i]).append("  ");            }            tv1.setText(sb.toString());        }    };    @Override    protected void onCreate(Bundle savedInstanceState) {        super.onCreate(savedInstanceState);        setContentView(R.layout.main);        tv1=(TextView)findViewById(R.id.tv1);        ipOrHost=(EditText)findViewById(R.id.ipOrHost);        startPort=(EditText)findViewById(R.id.startPort);        endPort=(EditText)findViewById(R.id.endPort);        /*try {            Runtime.getRuntime().exec("su");        } catch (IOException e) {            // TODO Auto-generated catch block            e.printStackTrace();        }*/    }    public void scanRemote(View v){        ConnectivityManager cm = (ConnectivityManager)                   getSystemService(Context.CONNECTIVITY_SERVICE);        boolean hasNet=cm.getActiveNetworkInfo().isAvailable();        if(hasNet){            tv1.setText("正在扫描，请耐心等待。。。");            Thread t=new Thread(new Runnable() {                @Override                public void run() {                    int[] openedPort=scan(ipOrHost.getText().toString(),                            Integer.parseInt(startPort.getText().toString()),                            Integer.parseInt(endPort.getText().toString()));                    MainActivity.UIupdater.obtainMessage(0, openedPort).sendToTarget();                }            });            t.start();        }        else {            tv1.setText("请检查网络连接");            return;        }                //tv1.setText("open:"+openedPort);    }    //A/libc(4643): Fatal signal 11 (SIGSEGV) at 0x00004522 (code=1),    //thread 4685 (Thread-305)    public void scanLocal(View v){        new Thread(new Runnable() {            @Override            public void run() {                int[] openedPort=scan("10.0.0.2",                        Integer.parseInt(startPort.getText().toString()),                        Integer.parseInt(endPort.getText().toString()));//"localhost"                MainActivity.UIupdater.obtainMessage(0, openedPort).sendToTarget();            }        }).start();    }    @Override    public boolean onCreateOptionsMenu(Menu menu) {        // Inflate the menu; this adds items to the action bar if it is present.        getMenuInflater().inflate(R.menu.main, menu);        return true;    }}

布局文件就不列出来了，程序运行后可以尝试这扫描百度等，但是速度异常的慢，你可以试试扫描某网站的79～90端口。

下面贴上一个syn扫描的linux程序，但是要想让它能工作在android上比上边的要费劲。因为它用到了raw_socket需要root权限。

但是NDK的lib不能够获得root权限，只有shell能获得。你可以写一个助手程序，让你的linux程序运行在shell中，接收端口号等命令行参数，

将扫描结果存储到文件或数据库或与java端建立socket连接或助手程序创建原始套接字后建立UNIX本地套接字传递文件描述符给要进行端口扫描的NDK的Native code。

但是自己学的很肤浅，未能进一步实现。下面的代码实验证明是不成功的，直接调用su程序并不能获得root权限。另外有一点需要注意，新开了一条线程专门用来接收包，

没有加入对时间和数量的控制。join来等待线程执行结束,但是线程中有个循环。

#include<jni.h>#include <android/log.h>#include<stdio.h> //printf#include<string.h> //memset#include<stdlib.h> //for exit(0);#include<sys/socket.h>#include<errno.h> //For errno - the error number#include<pthread.h>#include<netdb.h>    //hostend#include<arpa/inet.h>#include<netinet/tcp.h>    //Provides declarations for tcp header#include<netinet/ip.h>    //Provides declarations for ip header#include <unistd.h> //fork#define  LOG_TAG    "System.out"#define  LOGD(...)  __android_log_print(ANDROID_LOG_DEBUG,LOG_TAG,__VA_ARGS__)void * receive_ack( void *ptr );int process_packet(unsigned char* , int);unsigned short csum(unsigned short * , int );char * hostname_to_ip(char * );int get_local_ip (char *);jintArray startScan(JNIEnv*env,char* argv,jint start_port,jint end_port);struct pseudo_header    //needed for checksum calculation{    unsigned int source_address;    unsigned int dest_address;    unsigned char placeholder;    unsigned char protocol;    unsigned short tcp_length;    struct tcphdr tcp;};struct in_addr dest_ip;//可复用工具方法//返回char数组的首地址//将java的String对象类型的数据转换为C语言的char数组类型char* Jstring2Cstr(JNIEnv* env,jstring jstr){    char * rtn=NULL;    jclass clsString=(*env)->FindClass(env,"java/lang/String");    jstring strEncode=(*env)->NewStringUTF(env,"GB2312");    //下一句不知道为什么不能被保存，有冲突！！！！！！！//    jmethodID mid=(*env)->GetMethodID(env,clsString,"getBytes","(Ljava/lang/String;)[B");    //第三个参数为java中的方法的签名，可以通过java -s 加上包名.类名 查看    jbyteArray jba=(jbyteArray)(*env)->CallObjectMethod(env,jstr,mid,strEncode);    //相当于执行了String的getBytes（“GB2312”）方法    jsize len=(*env)->GetArrayLength(env,jba);    jbyte* jbt=(*env)->GetByteArrayElements(env,jba,JNI_FALSE);//获取元素    if(len > 0){        rtn=(char*)malloc(len+1);        memcpy(rtn,jbt,len);//将jbyte*复制到rtn中去        rtn[len]=0;//=='\0'    }    (*env)->ReleaseByteArrayElements(env,jba,jbt,0);    //jbyte是新开辟的空间，现在不用了所以要释放，0表示释放jba指向的全部内存空间    return rtn;}jintArray Java_com_linux_portscaner_MainActivity_scan(JNIEnv*env,jobject clazz,            jstring argv,jint start_port,jint end_port){    LOGD("%s","portScan.c before start");    char *host_argv=Jstring2Cstr(env,argv);    jintArray rtn=startScan(env,host_argv,start_port,end_port);    //return (**env).NewStringUTF(env,"hello from native c");    return rtn;}//参数是目标机的IPjintArray startScan(JNIEnv*env,char* argv,jint start_port,jint end_port){    system("su");    //Create a raw socket    int s = socket (AF_INET, SOCK_RAW , IPPROTO_TCP);    if(s < 0)    {        LOGD("Error creating socket. Error number : %d . Error message : %s \n" , errno , strerror(errno));        //exit(0);        return;    }    else    {        LOGD("Socket created.\n");    }    jint portsOpen[20]={0};    jintArray jArray=(*env)->NewIntArray(env,20);//int a[20]    //Datagram to represent the packet    char datagram[4096];    //IP header    struct iphdr *iph = (struct iphdr *) datagram;    //TCP header    struct tcphdr *tcph = (struct tcphdr *) (datagram + sizeof (struct ip));    struct sockaddr_in  dest;    struct pseudo_header psh;    char *target =argv; //argv[1];//    if(argc < 2)//    {//        printf("Please specify a hostname \n");//        exit(1);//    }    if( inet_addr( target ) != -1)    {        dest_ip.s_addr = inet_addr( target );    }    else    {        char *ip = hostname_to_ip(target);        if(ip != NULL)        {            LOGD("%s resolved to %s \n" , target , ip);            //Convert domain name to IP            dest_ip.s_addr = inet_addr( hostname_to_ip(target) );        }        else        {            LOGD("Unable to resolve hostname : %s" , target);            //exit(1);            return;        }    }    int source_port = 43591;    char source_ip[20];    get_local_ip( source_ip );    LOGD("Local source IP is %s \n" , source_ip);    memset (datagram, 0, 4096);    /* zero out the buffer */    //Fill in the IP Header    iph->ihl = 5;    iph->version = 4;    iph->tos = 0;    iph->tot_len = sizeof (struct ip) + sizeof (struct tcphdr);    iph->id = htons (54321);    //Id of this packet    iph->frag_off = htons(16384);    iph->ttl = 64;    iph->protocol = IPPROTO_TCP;    iph->check = 0;        //Set to 0 before calculating checksum    iph->saddr = inet_addr ( source_ip );    //Spoof the source ip address    iph->daddr = dest_ip.s_addr;    iph->check = csum ((unsigned short *) datagram, iph->tot_len >> 1);    //TCP Header    tcph->source = htons ( source_port );    tcph->dest = htons (80);    tcph->seq = htonl(1105024978);    tcph->ack_seq = 0;    tcph->doff = sizeof(struct tcphdr) / 4;        //Size of tcp header    tcph->fin=0;    tcph->syn=1;    tcph->rst=0;    tcph->psh=0;    tcph->ack=0;    tcph->urg=0;    tcph->window = htons ( 14600 );    // maximum allowed window size    tcph->check = 0; //if you set a checksum to zero, your kernel's IP stack should fill in the correct checksum during transmission    tcph->urg_ptr = 0;    //IP_HDRINCL to tell the kernel that headers are included in the packet    int one = 1;    const int *val = &one;    if (setsockopt (s, IPPROTO_IP, IP_HDRINCL, val, sizeof (one)) < 0)    {        LOGD ("Error setting IP_HDRINCL. Error number : %d . Error message : %s \n" , errno , strerror(errno));        //exit(0);        return;    }    /*    LOGD("Starting sniffer thread...\n");    char *message1 = "Thread 1";    int  iret1;    pthread_t sniffer_thread;    if( pthread_create( &sniffer_thread , NULL ,  receive_ack , (void*) message1) < 0)    {        LOGD ("Could not create sniffer thread. Error number : %d . Error message : %s \n" , errno , strerror(errno));        //exit(0);        return;    }*/    LOGD("Starting to send syn packets\n");    int port;    dest.sin_family = AF_INET;    dest.sin_addr.s_addr = dest_ip.s_addr;    for(port = start_port ; port <= end_port ; port++)  //set the port    {        tcph->dest = htons ( port );        tcph->check = 0;    // if you set a checksum to zero, your kernel's IP stack should fill in the correct checksum during transmission        psh.source_address = inet_addr( source_ip );        psh.dest_address = dest.sin_addr.s_addr;        psh.placeholder = 0;        psh.protocol = IPPROTO_TCP;        psh.tcp_length = htons( sizeof(struct tcphdr) );        memcpy(&psh.tcp , tcph , sizeof (struct tcphdr));        tcph->check = csum( (unsigned short*) &psh , sizeof (struct pseudo_header));        //Send the packet        if ( sendto (s, datagram , sizeof(struct iphdr) + sizeof(struct tcphdr) , 0 , (struct sockaddr *) &dest, sizeof (dest)) < 0)        {            LOGD ("Error sending syn packet. Error number : %d . Error message : %s \n" , errno , strerror(errno));            //exit(0);            return;        }    }//    pthread_join( sniffer_thread , NULL);//    printf("%d" , iret1);//    pthread_kill(sniffer_thread,0);    //return 0;    pid_t pid=fork();    if(pid==-1){        LOGD("Can't fork process!");        return;    }    if(!pid){//child        start_sniffer();    }    return NULL;}/*    Method to sniff incoming packets and look for Ack replies*/void * receive_ack( void *ptr ){    //Start the sniffer thing    start_sniffer();}int start_sniffer(){    int sock_raw;    //int count=0;//count the number of open ports    int saddr_size , data_size;    struct sockaddr saddr;    unsigned char *buffer = (unsigned char *)malloc(65536); //It's Big!    LOGD("Sniffer initialising...\n");    fflush(stdout);    //Create a raw socket that shall sniff    sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_TCP);    if(sock_raw < 0)    {        LOGD("Socket Error\n");        fflush(stdout);        return 1;    }    saddr_size = sizeof saddr;    while(1)    {        //Receive a packet        data_size = recvfrom(sock_raw , buffer , 65536 , 0 , &saddr , &saddr_size);        if(data_size <0 )        {            LOGD("Recvfrom error , failed to get packets\n");            fflush(stdout);            return 1;        }        //Now process the packet        //portsOpen[count++]=        process_packet(buffer , data_size);    }    close(sock_raw);    LOGD("Sniffer finished.");    fflush(stdout);    return 0;}int process_packet(unsigned char* buffer, int size){    //Get the IP Header part of this packet    struct iphdr *iph = (struct iphdr*)buffer;    struct sockaddr_in source,dest;    unsigned short iphdrlen;    if(iph->protocol == 6)    {        struct iphdr *iph = (struct iphdr *)buffer;        iphdrlen = iph->ihl*4;        struct tcphdr *tcph=(struct tcphdr*)(buffer + iphdrlen);        memset(&source, 0, sizeof(source));        source.sin_addr.s_addr = iph->saddr;        memset(&dest, 0, sizeof(dest));        dest.sin_addr.s_addr = iph->daddr;        if(tcph->syn == 1 && tcph->ack == 1 && source.sin_addr.s_addr == dest_ip.s_addr )        {            LOGD("Port %d open\n" , ntohs(tcph->source));            //portsOpen[count++]=ntohs(tcph->source);            fflush(stdout);            return ntohs(tcph->source);        }    }}/* Checksums - IP and TCP */unsigned short csum(unsigned short *ptr,int nbytes){    register long sum;    unsigned short oddbyte;    register short answer;    sum=0;    while(nbytes>1) {        sum+=*ptr++;        nbytes-=2;    }    if(nbytes==1) {        oddbyte=0;        *((u_char*)&oddbyte)=*(u_char*)ptr;        sum+=oddbyte;    }    sum = (sum>>16)+(sum & 0xffff);    sum = sum + (sum>>16);    answer=(short)~sum;    return(answer);}/*    Get ip from domain name */char* hostname_to_ip(char * hostname){    struct hostent *he;    struct in_addr **addr_list;    int i;    if ( (he = gethostbyname( hostname ) ) == NULL)    {        // get the host info        herror("gethostbyname");        return NULL;    }    addr_list = (struct in_addr **) he->h_addr_list;    for(i = 0; addr_list[i] != NULL; i++)    {        //Return the first one;        return inet_ntoa(*addr_list[i]) ;    }    return NULL;}/* Get source IP of system , like 192.168.0.6  */int get_local_ip ( char * buffer){    int sock = socket ( AF_INET, SOCK_DGRAM, 0);    const char* kGoogleDnsIp = "8.8.8.8";    int dns_port = 53;    struct sockaddr_in serv;    memset( &serv, 0, sizeof(serv) );    serv.sin_family = AF_INET;    serv.sin_addr.s_addr = inet_addr(kGoogleDnsIp);    serv.sin_port = htons( dns_port );    int err = connect( sock , (const struct sockaddr*) &serv , sizeof(serv) );    struct sockaddr_in name;    socklen_t namelen = sizeof(name);    err = getsockname(sock, (struct sockaddr*) &name, &namelen);    const char *p = inet_ntop(AF_INET, &name.sin_addr, buffer, 100);    close(sock);}