win32

Crafting ARP packets to find a remote host's MAC address

Dec 12, 2019

16 min #networking · #rust · #win32 · #ffi · #arp · #ethernet · #parsing

Alright. ALRIGHT. I know, we’re all excited, but let’s think about what we’re doing again.

So we’ve managed to look at real network traffic and parse it completely. We’ve also taken some ICMP packets, parsed them, and then serialized them right back and we got the exact same result.

So I know what you’re thinking - let’s just move our way down the stack again - stuff that ICMP packet in an IP packet, then in an Ethernet frame, and then serialize the whole thing.

Binding C APIs with variable-length structs and UTF-16

Nov 05, 2019

19 min #networking · #rust · #ffi · #text-encoding · #win32

Okay, I lied.

I’m deciding - right this instant - that using wmic is cheating too. Oh, it was fair game when we were learning about Windows, but we’re past that now.

We know there’s IPv4 routing tables, and we know network interfaces have indices (yes, they do change when you disable/enable one, so ill-timed configuration changes may make our program blow up).

A simple ping library, parsing strings into IPv4 address

Oct 12, 2019

13 min #networking · #icmp · #rust · #ffi · #win32 · #api-design

We’ve just spent a lot of time abstracting over LoadLibrary, but we still have all the gory details of the Win32 ICMP API straight in our main.rs file! That won’t do.

This time will be much quicker, since we already learned about carefully designing an API, hiding the low-level bits and so on.

Let’s add an icmp module to our program. Actually, we’ve been dealing with an IPAddr all this time, it also sounds like it could use its own package:

Designing and implementing a safer API on top of LoadLibrary

Oct 04, 2019

18 min #rust · #win32 · #ffi · #api-design

It’s refactor time!

Our complete program is now about a hundred lines, counting blank lines (see the end of part 3 for a complete listing).

While this is pretty good for a zero-dependency project (save for pretty-hex), we can do better.

First off, concerns are mixed up. In the same file, we:

Expose LoadLibraryA / GetProcAddress
Expose the Win32 ICMP API

FFI-safe types in Rust, newtypes and MaybeUninit

Sep 30, 2019

12 min #networking · #icmp · #win32 · #rust · #ffi

It’s time to make sup, our own take on ping, use the Win32 APIs to send an ICMP echo. Earlier we discovered that Windows’s ping.exe used IcmpSendEcho2Ex. But for our purposes, the simpler IcmpSendEcho will do just fine.

As we mentioned earlier, it’s provided by IPHLPAPI.dll, and its C declaration is:

IPHLPAPI_DLL_LINKAGE DWORD IcmpSendEcho(
  HANDLE                 IcmpHandle,
  IPAddr                 DestinationAddress,
  LPVOID                 RequestData,
  WORD                   RequestSize,
  PIP_OPTION_INFORMATION RequestOptions,
  LPVOID                 ReplyBuffer,
  DWORD                  ReplySize,
  DWORD                  Timeout
);

Windows dynamic libraries, calling conventions, and transmute

Sep 28, 2019

18 min #networking · #icmp · #win32 · #rust · #ffi

So, how does ping.exe actually send a ping? It seems unrealistic that ping.exe itself implements all the protocols involved in sending a ping. So it must be calling some sort of library. Also, since it ends up talking to the outside world via a NIC (network interface controller), the kernel is probably involved at some point.

In reading files the hard way - part 2, we learned about dynamic libraries (like libc), and the Linux kernel, and how syscalls allowed us to ask the Linux kernel to do our bidding. For this series, we’re going to have to look at the Windows equivalents.