一个端口到进程的关联，救命；(100分)

蛮牛野蛮牛 · 2002-11-12

//提升进程hToken特权 function RaisePrivileges(hToken:THandle; pPriv: Pchar):Boolean; var   tkp       : TOKEN_PRIVILEGES;   rl        : Cardinal;   iRet      : Integer; begin if ( not LookupPrivilegeValue( nil, pPriv, tkp.Privileges[0].Luid ) ) then begin Writeln( 'LookupPrivilegeValue Error: '+ IntToStr(GetLastError) ); Result := false;     Exit; end;   rl := 0;   tkp.PrivilegeCount := 1; tkp.Privileges[0].Attributes := tkp.Privileges[0].Attributes or SE_PRIVILEGE_ENABLED;   Result := AdjustTokenPrivileges( hToken, false, tkp, rl, PTokenPrivileges(nil), rl ); if ( not Result ) then //AdjustTokenPrivileges函数调用失败 begin Writeln( 'AdjustTokenPrivileges Error:%d/n", GetLastError() ');     Exit; end else //AdjustTokenPrivileges调用成功 begin //使用GetLastError()获得返回值 iRet := GetLastError(); case ( iRet ) of ERROR_NOT_ALL_ASSIGNED://未指派所有的特权       begin writeln( 'AdjustTokenPrivileges ERROR_NOT_ALL_ASSIGNED' ); result := false;       end; ERROR_SUCCESS: //成功地指派了所有的特权       begin result := true;         writeln('ERROR_SUCCESS');       end; else       begin //不知名的错误 writeln( 'AdjustTokenPrivileges Unknow Error:%d/n", iRet '); result := false;       end; end end end;//end of RaisePrivleges //调整目标进程DACL procedure AdjustDACL(ProHandle:THandle); var   pSD             : PPSECURITY_DESCRIPTOR;   pNewDacl,pDacl  : PACL;   ea              : EXPLICIT_ACCESS; begin   pSD:=nil;   pDacl:=nil;   pNewDacl:=nil;   GetSecurityInfo(ProHandle,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,                   nil,nil,pDacl,nil,pSD);   ZeroMemory(@ea, sizeof(EXPLICIT_ACCESS));   ea.grfAccessPermissions:=STANDARD_RIGHTS_ALL or  SPECIFIC_RIGHTS_ALL;   ea.grfAccessMode:=SET_ACCESS;   ea.grfInheritance:=NO_INHERITANCE;   ea.Trustee.pMultipleTrustee:=nil;   ea.Trustee.MultipleTrusteeOperation:=NO_MULTIPLE_TRUSTEE;   ea.Trustee.TrusteeForm:=TRUSTEE_IS_SID;   ea.Trustee.TrusteeType:=TRUSTEE_IS_USER;   ea.Trustee.ptstrName:='CURRENT_USER';   SetEntriesInAcl(1,@ea,pDacl,pNewDacl);   SetSecurityInfo(ProHandle,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,nil,nil,pNewDacl,nil); end; var   NtQuerySystemInformation: function (infoClass: DWORD;     buffer: Pointer;     bufSize: DWORD;     returnSize: TPDword): DWORD; stdcall = nil; procedure NTXPPort2Proc(ListView1:TListView); //type //   TNTQuerySystemInformation = function(Nmb: integer; Ptr: Pointer; Size1, Size2: integer): DWORD; stdcall; var     //NTQuerySystemInfomation     :    TNTQuerySystemInformation;     DllHandle,hToken,CurrProcHandle,ProcHandle,MyHandle :THandle;     dwNumBytes,dwNumBytesRet,dwNumEntries,i : DWORD;     namelen,optlen,sockType: integer;     dwHandleList: PDWORD;     s           : TSocket;     GInitData   : TWSADATA;     PhInfo      : PHandleInfo;     name        : TSockAddrIn;     PortPath    : array [0..MAX_PATH] of Char;     temp : DWORD; begin   //ListView1.Clear;   MyHandle:=0;   WSAStartup($101, GInitData);   CurrProcHandle:=GetCurrentProcess;   if not OpenProcessToken(CurrProcHandle, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken) then     writeln('OpenProcessToken Error')   else     if not RaisePrivileges(hToken,'SeSecurityPrivilege') then       writeln('SeSecurityPrivilege Error ');   if hToken<>0 then     CloseHandle(HToken);   DllHandle := LoadLibrary('ntdll.dll');   if(DllHandle<>0) then   begin     if @NtQuerySystemInformation = nil then       NTQuerySystemInformation:=GetProcAddress(DllHandle,'NtQuerySystemInformation');     dwNumbytesRet:=0;     NTQuerySystemInformation(NT_HANDLE_LIST, @temp, 0, @dwNumBytes);     dwNumBytes:=MAX_HANDLE_LIST_BUF;//本来想通过上面取需要的内存长度，结果为零；     dwNumbytesRet:=0;     //分配内存     dwHandleList := AllocMem(dwNumBytes);     //GetMem(dwHandleList,dwNumBytes);     //成功调用将返回0值     NTQuerySystemInformation(NT_HANDLE_LIST,dwHandleList,dwNumBytes,@dwNumbytesRet);   end;   dwNumEntries:=dwHandleList^;   inc(dwHandleList);   Phinfo:=@dwHandleList;   for i:=0 to dwNumEntries - 1 do   begin     //★★需要判断操作系统类型 XP 和 NT或WIN2000     try  //***出现问题的代码；//不知道为什么内存访问出错；       if (PhInf

bjType=$1A) and (PhInfo.dwPid<>0) then       begin         ProcHandle:=OpenProcess(WRITE_DAC,FALSE,PhInfo.dwPid);         //showmessage('rr:'+IntToStr(ProcHandle));         if ProcHandle>0 then         begin           AdjustDACL(ProcHandle);           CloseHandle(ProcHandle);         end;         ProcHandle:=OpenProcess(PROCESS_DUP_HANDLE,TRUE,PhInfo.dwPid);         if ProcHandle>0 then         begin           DuplicateHandle(ProcHandle,Cardinal(PhInfo.HndlOffset),CurrProcHandle,              @MYHandle,STANDARD_RIGHTS_REQUIRED,FALSE,0);           CloseHandle(ProcHandle);         end;         if MyHandle>0 then         begin           name.sin_family:=AF_INET;           namelen:=sizeof(TSockAddrIn);           s:=TSocket(MyHandle);           if GetSockName(s,name,namelen)<>SOCKET_ERROR then           begin             sockType:=0;             optlen:=4;             getsockopt(s,SOL_SOCKET,SO_TYPE,PChar(sockType),optlen);             ProcHandle:=OpenProcess(PROCESS_ALL_ACCESS,FALSE,PhInfo.dwPid);             GetModuleFileNameEx(ProcHandle,0,PortPath,sizeof(PortPath));             CloseHandle(ProcHandle);             //输出信息             {with ListView1.Items.Add do             begin               //协议类型               Caption:='TCP';               //本机端口               SubItems.Add(Format('%6d',[ntohs(name.sin_port)]));               //远程主机IP               SubItems.Add('');               //远程主机端口               SubItems.Add('');               //进程路径               SubItems.Add(PortPath);             end;             }             Writeln(PortPath);           end;         end;       end;       //★★     except       Break;     end;     inc(PhInfo);   end;   //释放内存   FreeMem(dwHandleList);   //showmessage('kkk');   FreeAndNil(PhInfo);   FreeAndNil(dwHandleList);   if CurrProcHandle>0 then CloseHandle(CurrProcHandle);   FreeLibrary(DllHandle);   WSACleanup; end;

蛮牛野蛮牛 · 2002-11-12

[

][

] 代码是我从一个网站找到的。现在不知道来自什么地方了。但是为什么不能用了。还有一 个奇怪的问题就是我写一个数据的操作，在的的计算机上出问题，而在其他计算机上成功 执行，我用了别名。在两个数据库上操作。 上面代码有很多C写的都可以成功执行，我现在越来越对PAS保持距离了。这是C代码的地址 http://vip.6to23.com/NowCan1/tech/fport.htm

张无忌 · 2002-11-12

我想用DELPHI一定可以搞定，！！！ 只是我现在没时间做呀[

]

蛮牛野蛮牛 · 2002-11-12

不需要怎么做的，代码都全部帖出来了，大侠给调试一下三。

kcahcn · 2002-11-12

这是我与SaD jAckAl(CIONO2)写的代码的一段。 // NTXPPort2Proc  PhInfo,HandleInfo      : PHandleInfo;  iRet

WORD; ......   dwNumBytes:=sizeof(THANDLEINFO);    Try      //first call try to determin buffer size we'll need      iRet := NtQuerySystemInformation(NT_HANDLE_LIST, PhInfo,        dwNumBytes, @dwNumBytesRet);       //call NtQuery we get STATUS_INFO_LENGTH_MISMATCH      While iRet = STATUS_INFO_LENGTH_MISMATCH Do      Begin         inc(dwNumBytes,dwNumBytes);         ReallocMem(hinfo, dwNumBytes);         iRet  := NtQuerySystemInformation(NT_HANDLE_LIST, hInfo, dwNumBytes, @dwNumBytesRet);      End;      //if we still can't get STATUS_SUCCESS      If iRet <> STATUS_SUCCESS Then       Begin ....           exit;       End      Else       Begin         HandleInfo:=hInfo;         HandleInfo:=PHANDLEINFO(ULONG(HandleInfo)+4); //why+4 ?See what Nebbett said in his book or ask C.I.O member         dwNumEntries := dwNumBytesRet; ...         //in for sentence         For  i := 0 To ((dwNumEntries-4) div 16) Do           // why ((dwNumEntries-4) div 16)?  ;-)  ask C.I.O. member to know the answer

begin              // here you do your job ...                ...              HandleInfo:= PHANDLEINFO(ULONG(HandleInfo)+sizeof(THANDLEINFO));           end; //for       end; // else    finally       If HandleInfo <> nil then FreeMem(HandleInfo);   .....    end; .... //---------- 晚上我再看看代码。 CIONO1 [ C.I.O creator] .

蛮牛野蛮牛 · 2002-11-12

HandleInfo:=hInfo;         HandleInfo:=PHANDLEINFO(ULONG(HandleInfo)+4); //why+4 ?See what Nebbett said in his book or ask C.I.O member         dwNumEntries := dwNumBytesRet; ...         //in for sentence         For  i := 0 To ((dwNumEntries-4) div 16) Do to kcahcn: 非常重要的一段代码，谢谢，如果多测试几次没有问题，我就发分。

蛮牛野蛮牛 · 2002-11-12

PhInfo,HandleInfo      : PHandleInfo;  iRet

WORD; ......   dwNumBytes:=sizeof(THANDLEINFO);    Try      //first call try to determin buffer size we'll need      iRet := NtQuerySystemInformation(NT_HANDLE_LIST, PhInfo,        dwNumBytes, @dwNumBytesRet);       //call NtQuery we get STATUS_INFO_LENGTH_MISMATCH      While iRet = STATUS_INFO_LENGTH_MISMATCH Do      Begin         inc(dwNumBytes,dwNumBytes);         ReallocMem(hinfo, dwNumBytes);         iRet  := NtQuerySystemInformation(NT_HANDLE_LIST, hInfo, dwNumBytes, @dwNumBytesRet);      End; to kcahcn: 还是要出地址错误，能把上面这段代码给全吗？谢谢。

kcahcn · 2002-11-12

你先试试这段代码： const   NT_HANDLE_LIST     = 16;   MAX_HANDLE_LIST_BUF = $200;   STATUS_INFO_LENGTH_MISMATCH = $C0000004; // fail   STATUS_SUCCESS = $00000000;//  call to NTQueary successed   SE_DEBUG_NAME      = 'SeDebugPrivilege';   SID_REVISION = (1); // Current revision level   SECURITY_WORLD_SID_AUTHORITY: TSidIdentifierAuthority = (Value: (0, 0, 0, 0, 0, 1)); ... //-------------------------------------------------------------- type   u_short = Word; // compatibility   PHANDLEINFO = ^tHandleInfo; // handle info recordd   tHandleInfo = Packed Record     dwPid:ULONG;     ObjType:UCHAR;     Flags:UCHAR;     HndlOffset:U_SHORT;     _Object

ointer;     GrantedAccess: Ulong;   End;   PSid = ^SID; // Security Ident used with ACL   SID  = Record     Revision: Byte;     SubAuthorityCount: Byte;     IdentifierAuthority: SID_IDENTIFIER_AUTHORITY;     SubAuthority: Array [0..0] Of DWORD;   End;   PPSID = ^PSID;   TSid  = SID;   //for more info refer to Platform SDK/Security //--------------------------------------------------------------- function RaisePrivileges(hToken:THandle; pPriv: Pchar):Boolean; var   tkp ,tpko      : TOKEN_PRIVILEGES;   rl        : Cardinal;   iRet      : Integer; begin   if ( not Windows.LookupPrivilegeValue( nil, pPriv, tkp.Privileges[0].Luid ) ) then     begin       ShowMessage( 'LookupPrivilegeValue Error: '+ IntToStr(GetLastError) );       Result := false;       Exit;     end;   rl := 0;   tkp.PrivilegeCount := 1;   tkp.Privileges[0].Attributes := tkp.Privileges[0].Attributes or SE_PRIVILEGE_ENABLED;   Result := Windows.AdjustTokenPrivileges(                         hToken,                         false,                         tkp,                         sizeof(tkp),                         tpko,//PTokenPrivileges(nil),                         rl );   if ( not Result ) then //AdjustTokenPrivileges函数调用失败         begin       ShowMessage( 'AdjustTokenPrivileges Error:%d/n", GetLastError() ');       Exit;     end   else    //AdjustTokenPrivileges调用成功     begin   //使用GetLastError()获得返回值             iRet := GetLastError();       case ( iRet ) of            ERROR_NOT_ALL_ASSIGNED:://未指派所有的特权              begin                ShowMessage( 'AdjustTokenPrivileges ERROR_NOT_ALL_ASSIGNED' );                result := false;              end;            ERROR_SUCCESS: //成功地指派了所有的特              begin                result := true;                ShowMessage('ERROR_SUCCESS');              end;        else          begin //不知名的错误            ShowMessage( 'AdjustTokenPrivileges Unknow Error:%d/n", iRet ');            result := false;          end;        end; //case     end; //else end;//end of RaisePrivleges //--------------------------------------------------------- Procedure AdjustDacl(hProcess: tHANDLE); Var   ea: PEXPLICIT_ACCESS_;   ACL: PACL;   world: PSID; Begin   ea := AllocMem(SizeOf(EXPLICIT_ACCESS));   world          := AllocMem(SizeOf(SID));   world.Revision := SID_REVISION;   world.SubAuthorityCount := 1;   world.IdentifierAuthority := SECURITY_WORLD_SID_AUTHORITY;   ZeroMemory(@world.SubAuthority, sizeof(world.SubAuthority));   //evryone has access   //can Write/Read/Execute ?   ea.grfAccessPermissions := STANDARD_RIGHTS_ALL Or SPECIFIC_RIGHTS_ALL;   ea.grfAccessMode        := SET_ACCESS;   ea.grfInheritance       := NO_INHERITANCE; //no previlige inheritence for child objects   ea.Trustee.pMultipleTrustee := Nil;   ea.Trustee.MultipleTrusteeOperation := NO_MULTIPLE_TRUSTEE;   ea.Trustee.TrusteeForm  := TRUSTEE_IS_SID;   ea.Trustee.TrusteeType  := TRUSTEE_IS_USER;   ea.Trustee.ptstrName    := @world;   If SetEntriesInAcl(1, ea, Nil, ACL) <> ERROR_SUCCESS Then     ;//(Format('SetEntriesInAcl Error: %d', [GetLastError]));   If SetSecurityInfo(hProcess, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION,     Nil, Nil, ACL, Nil) <> ERROR_SUCCESS Then     ;// ('SetSecurityInfo Error: ', GetLastError);   LocalFree(INTEGER(ACL)); End; var   NtQuerySystemInformation: function (infoClass: DWORD;     buffer: Pointer;     bufSize: DWORD;     returnSize: PDword): DWORD; stdcall = nil; procedure NTXPPort2Proc(ListView1:TListView); var     DllHandle,hToken,CurrProcHandle,ProcHandle,MyHandle :THandle;     dwNumBytes,dwNumBytesRet,dwNumEntries,i : DWORD;     namelen,optlen,sockType: integer;     dwHandleList: PDWORD;     s           : TSocket;     GInitData   : TWSADATA;     name        : TSockAddrIn;     PortPath    : array [0..MAX_PATH] of Char;     iRet: DWORD;     PhInfo,handleinfo : PHandleInfo; begin   ListView1.Clear;   MyHandle:=0;   WSAStartup($101, GInitData);   CurrProcHandle:=GetCurrentProcess;   if not OpenProcessToken(CurrProcHandle, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken) then     writeln('OpenProcessToken Error')   else     if not RaisePrivileges(hToken,SE_DEBUG_NAME) then       writeln('SeSecurityPrivilege Error ');   if hToken<>0 then     CloseHandle(HToken);   DllHandle := LoadLibrary('ntdll.dll');   if(DllHandle<>0) then   begin     if @NtQuerySystemInformation = nil then       NTQuerySystemInformation:=GetProcAddress(DllHandle,'NtQuerySystemInformation')     else       exit;     dwNumBytes:=MAX_HANDLE_LIST_BUF;     Phinfo         := AllocMem(dwNumBytes);     dwNumBytes:=sizeof(THANDLEINFO);     dwNumbytesRet:=0;     try       iRet:=NTQuerySystemInformation(NT_HANDLE_LIST, @PhInfo, dwNumBytes, @dwNumBytesRet);       //call NtQuery we get STATUS_INFO_LENGTH_MISMATCH       While iRet = STATUS_INFO_LENGTH_MISMATCH Do         Begin           inc(dwNumBytes,dwNumBytes);           ReallocMem(Phinfo, dwNumBytes);           iRet  := NtQuerySystemInFORMation(NT_HANDLE_LIST, PhInfo, dwNumBytes, @dwNumBytesRet);         End; //while       if iRet <> STATUS_SUCCESS Then         Begin           //Writeln('NtQuerySystemInFORMation return Error: ', dwNumBytesRet, GetLastError);           //ReadLn;           exit;         End  //if       Else         Begin           HandleInfo:=PhInfo;           HandleInfo:=PHANDLEINFO(ULONG(HandleInfo)+4);                     dwNumEntries := dwNumBytesRet;           For  i := 0 To ((dwNumEntries-4) div 16) Do            Begin                       try;               If (PhInf

bjType = $1A) And (PhInfo.dwPid = 0)                         And (PhInfo.dwPid = GetCurrentProcessId ) Then                 Begin                   ;                   //ShowMessage('Error On OBJECT_TYPE_SOCKET');                 End               else                 begin                   ProcHandle:=OpenProcess(WRITE_DAC,FALSE,HandleInfo.dwPid);                   //showmessage('rr:'+IntToStr(ProcHandle));                   if ProcHandle>0 then                     begin                       AdjustDACL(ProcHandle);                       CloseHandle(ProcHandle);                     end; //if                   ProcHandle:=OpenProcess(PROCESS_DUP_HANDLE,TRUE,HandleInfo.dwPid);                   if ProcHandle>0 then                     begin                       DuplicateHandle(ProcHandle,Cardinal(HandleInfo.HndlOffset),CurrProcHandle,                       @MYHandle,STANDARD_RIGHTS_REQUIRED,FALSE,0);                       CloseHandle(ProcHandle);                     end;                   if MyHandle>0 then                     begin                       name.sin_family:=AF_INET;                         namelen:=sizeof(TSockAddrIn);                         s:=TSocket(MyHandle);                         if GetSockName(s,name,namelen)<>SOCKET_ERROR then                           begin                             sockType:=0;                             optlen:=4;                             getsockopt(s,SOL_SOCKET,SO_TYPE,PChar(sockType),optlen);                             ProcHandle:=OpenProcess(PROCESS_ALL_ACCESS,FALSE,HandleInfo.dwPid);                             GetModuleFileNameEx(ProcHandle,0,PortPath,sizeof(PortPath));                             CloseHandle(ProcHandle);                             with ListView1.Items.Add do                               begin                                 Caption:='TCP';                                 SubItems.Add(Format('%6d',[ntohs(name.sin_port)]));                                 SubItems.Add('');                                 SubItems.Add('');                                 SubItems.Add(PortPath);                               end;                                 //Writeln(PortPath);                           end; //if                       end;//if                 end;//if             except               Break;             end;   //try..except             HandleInfo:= PHANDLEINFO(ULONG(HandleInfo)+sizeof(THANDLEINFO));           end;//for         end;//else       finally         FreeMem(PhInfo);        if CurrProcHandle>0 then CloseHandle(CurrProcHandle);        FreeLibrary(DllHandle);       end;   end;   WSACleanup; end; //----------------- 我以后再把全代码给你。（我先问我的朋友SAD。还有一些问题要讨论，比如程序会关闭某些程序如 OICQ,导致MSN Messenger不能正常使用..） CIONO1

kcahcn · 2002-11-12

注释： HandleInfo:=PHANDLEINFO(ULONG(HandleInfo)+4); 为何 +4？ Gary Nebbet在（Windows NT/2000 本机API）说了这样的一段话： 返回到SystemInformation 缓冲区的数据是一个ULONG类型的句柄数，后面紧接着是 SYYTEM_HANDLE_INFORMATON 的一个数组。 知道为什么加4吧？就是那个（ULONG类型的句柄数），这样HandleInfo就指向SYYTEM_HANDLE_INFORMATON 的手地址。 //----- dwNumEntries := dwNumBytesRet; For  i := 0 To ((dwNumEntries-4) div 16) Do 为何用((dwNumEntries-4) div 16)？ dwNumEntries接收实际返回到SystemInformation （就是你定义为buffer）的字节数。 注意是字节数 我们先减4 就是前面说的"ULONG类型的句柄数"。 16就是tHandleInfo 的size。清楚吧？ //----- CIONO1

蛮牛野蛮牛 · 2002-11-13

我在测试了程序后没有发现死机的现象。oicq和msn使用都正常。 还想问一个问题，现在怎么判断他是TCP连接还是UDP连接呢？

蛮牛野蛮牛 · 2002-11-13

接受答案了.

kcahcn · 2002-11-14

这么快就放弃讨论这个问题，还有很多问题要解决。 看看这个： //-------------------------------------------------------- // 作者：SaDjAckAl(CIONO2) 。 // kcahcn(CIONO1) 解决调用NtQuerySystemInformation的内存问题，MyPIDToName函数。。。 // 用一个ListView,一个Button。 uses winsock,AclAPI,AccCtrl{,tlhelp32}; //如果想用PIDToName要用tlhelp32 CONST   NT_HANDLE_LIST     = 16; // pass to Ntqueary for obtain process list   OBJECT_TYPE_SOCKET = $1c;// 在winxp   // we want to get socket objects that associated with process handle   SE_DEBUG_NAME      = 'SeDebugPrivilege'; // debug previlige has highst previlige like admin   SE_SYSTEMTIME_NAME = 'SeSystemtimePrivilege';   SECURITY_WORLD_SID_AUTHORITY: TSidIdentifierAuthority = (Value: (0, 0, 0, 0, 0, 1));   SID_REVISION = (1); // Current revision level   STATUS_INFO_LENGTH_MISMATCH = $C0000004; // fail   STATUS_SUCCESS = $00000000;//  call to NTQueary successed   err_noOS = 'The OS version could not be determined. Quitting.'; //-------------------------------- TYPE   PPort=^Tport;   TPort = RECORD     name: string;     Port : Dword;     PID: DWORD;     Socket_type : String;     err : String;   END;   Tports = ARRAY OF Tport;   u_short = Word; // compatibility   PHANDLEINFO = ^tHandleInfo; // handle info recordd   tHandleInfo = Packed Record     dwPid: U_SHORT;     CreatorBackTraceIndex: U_short;     ObjType: Byte;     HandleAttributes: Byte;     HndlOffset: U_short;     dwKeObject: DWORD;     GrantedAccess: Ulong;     {PId:ULONG;     ObjTypeName:UCHAR;     Flags:UCHAR;     Handle:U_SHORT;     _Object

ointer;     GrantedAccess: Ulong; }   End;   PDebug_Buffer=^TDebug_Buffer;   TDebug_Buffer=packed record         sectionHandle:THandle;         SectionBase

ointer;         RemoteSectionBase

ointer;         SectionBaseDelta:ULONG;         EventPairHandle:THandle;         Unknown1:ULONG;         Unknown2:ULONG;         RemoteThreadHandle:THandle;         InfoClassMask:ULONG;         SizeOfInfo:ULONG;         AllocatedSize:ULONG;         SectionSize:ULONG;         ModuleInformation

ointer;         BackTraceInformation

ointer;         HeapInformation

ointer;         LockInformation

ointer;         Reserved:array [0..7]of Pointer;   end;   PDebug_Module_Information=^TDebug_Module_Information;   TDebug_Module_Information=Packed record         Reserved:array[0..1]of ULONG;         Base:ULONG;         Size:ULONG;         Flags:ULONG;         Index:U_SHORT;         Unknown:U_SHORT;         LoadCount:U_SHORT;         ModuleNameOffset:U_SHORT;         ImageName:array [0..255]of char;   end;   PSid = ^SID; // Security Ident used with ACL   SID  = Record     Revision: Byte;     SubAuthorityCount: Byte;     IdentifierAuthority: SID_IDENTIFIER_AUTHORITY;     SubAuthority: Array [0..0] Of DWORD;   End;   PPSID = ^PSID;   TSid  = SID;   //for more info refer to Platform SDK/Security VAR   runonNT: boolean = false;   remote_enabled: boolean = FALSE;   fixedfont: DWORD;   hdlg: DWORD = 0;   //compname: string = '';   cbuffer: array[0..16] of char;   hNtdll: HMODULE;   NtQuerySystemInformation: function (infoClass: DWORD;                                       buffer: Pointer;                                       bufSize: DWORD;                             returnSize: PuLong): DWORD;Stdcall = nil;   RtlCreateQueryDebugBuffer:function(         Size:ULONG;         Eventpair:BOOL         )

Debug_Buffer;stdcall=nil;   RtlQueryProcessDebugInformation:function(                 ProcessId:ULONG;                 DebugInfoClassMask:ULONG;                 DebugBuffer

ointer                 )

WORD;stdcall=nil;    HandleInfo, hinfo: PHANDLEINFO;    // socket object type    szSockType: array[1..6] of string = ('NULL',                                      'TCP',                                      'UPD',                                      'RAW',                                      'RDM',                                      'SEQ'); //----------------------------------------------- //adjust privelge Function RaisePrivleges(hToken: Thandle; pPriv: PChar): Boolean; Var   tkp, tpko: TOKEN_PRIVILEGES;   iret: Integer;   buffer: Dword; Begin   If Not Windows.LookupPrivilegevalue(Nil,     pPriv,     tkp.Privileges[0].Luid) Then   Begin     ShowMessage(Format('LookupPrivilegevalue Error : %d', [GetLastError]));     result:=false;     exit;   End;   tkp.PrivilegeCount := 1;   tkp.Privileges[0].Attributes := tkp.Privileges[0].Attributes Or SE_PRIVILEGE_ENABLED;   buffer := 0;   If Not Windows.AdjustTokenPrivileges(hToken,     False, tkp, sizeof(tkp), tpko, buffer) Then   //AdjustTokenPrivileges function transfer defeat   Begin     ShowMessage(Format('AdjustTokenPrivileges Error: %d', [GetLastError]));     Result := False;     exit;   End   Else  //AdjustTokenPrivileges transfers successfully   Begin // uses GetLastError () obtains returns the value     iRet := GetLastError;     Case iRet Of       ERROR_NOT_ALL_ASSIGNED:// not appoints all privileges         Begin           //AdjustTokenPrivileges ERROR_NOT_ALL_ASSIGNED;           Result := False;         End;       ERROR_SUCCESS: // successfully appointed all privileges         //set result then leave the function         Result := True;       Else         Begin // not well-known mistake           //AdjustTokenPrivileges Unknow Error           Result := False;         End;     End;   End; End; // AdjustDacl uses for to adjust the goal advancement DACL Procedure AdjustDacl(hProcess: tHANDLE); Var   ea: PEXPLICIT_ACCESS_;   ACL: PACL;   world: PSID; Begin   ea := AllocMem(SizeOf(EXPLICIT_ACCESS));   world          := AllocMem(SizeOf(SID));   world.Revision := SID_REVISION;   world.SubAuthorityCount := 1;   world.IdentifierAuthority := SECURITY_WORLD_SID_AUTHORITY;   ZeroMemory(@world.SubAuthority, sizeof(world.SubAuthority));   //evryone has access   //can Write/Read/Execute ?   ea.grfAccessPermissions := STANDARD_RIGHTS_ALL Or SPECIFIC_RIGHTS_ALL;   ea.grfAccessMode        := SET_ACCESS;   ea.grfInheritance       := NO_INHERITANCE; //no previlige inheritence for child objects   ea.Trustee.pMultipleTrustee := Nil;   ea.Trustee.MultipleTrusteeOperation := NO_MULTIPLE_TRUSTEE;   ea.Trustee.TrusteeForm  := TRUSTEE_IS_SID;   ea.Trustee.TrusteeType  := TRUSTEE_IS_USER;   ea.Trustee.ptstrName    := @world;   {   If SetEntriesInAcl(1, ea, Nil, ACL) <> ERROR_SUCCESS Then     ;//WriteLn('SetEntriesInAcl Error: ', GetLastError);   If SetSecurityInfo(hProcess, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION,     Nil, Nil, ACL, Nil) <> ERROR_SUCCESS Then    ;// WriteLn('SetSecurityInfo Error: ', GetLastError);   }   LocalFree(INTEGER(ACL)); End; //------------------------------------------------ { function PIDToName(ProcessSnap: THandle; PID: dword): string; var ProcessEntry: TProcessEntry32;     ModuleEntry : TModuleEntry32;     SnapProcHandle : THANDLE; begin  ProcessEntry.dwSize := sizeof(TProcessEntry32);  if (not Process32First(ProcessSnap, ProcessEntry)) then     Result := '????'   else begin     while PID <> ProcessEntry.th32ProcessID do       Process32Next(ProcessSnap, ProcessEntry);   end;   SnapProcHandle := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessEntry.th32ProcessID);   ModuleEntry.dwSize:=Sizeof(TModuleEntry32);   if (not Module32First(SnapProcHandle, ModuleEntry)) then     Result := '????'   else begin     while ProcessEntry.th32ProcessID <> ModuleEntry.th32ProcessID do       Module32Next(SnapProcHandle, ModuleEntry);     Result := ModuleEntry.szExePath;   end;   CloseHandle(SnapProcHandle); end; } //-------------------------------------------------------------- function MyPIDToName( PID: dword):string ;// I prefer this function var PDBuf

Debug_Buffer; ModuleInfo

Debug_Module_Information; begin   @RtlCreateQueryDebugBuffer := GetProCaddress(hNtdll, 'RtlCreateQueryDebugBuffer');   @RtlQueryProcessDebugInformation := GetProCaddress(hNtdll, 'RtlQueryProcessDebugInformation');   If @RtlCreateQueryDebugBuffer = nil then     Begin       ShowMessage(Format('GetProcess (RtlCreateQueryDebugBuffer) Error: %d',[GetLastError]));       exit;     End;   if @RtlQueryProcessDebugInformation=nil then     Begin       ShowMessage(Format('GetProcess (RtlQueryProcessDebugInformation) Error: %d',[GetLastError]));       exit;     End;   PDBuf:=RtlCreateQueryDebugBuffer(0,false);   RtlQueryProcessDebugInformation(PID,1,PDBuf);   ModuleInfo:=ptr(integer(PDBuf.ModuleInformation)+4);   result:=strpas(ModuleInfo.ImageName); end; //----------------------------------------------------------------- Function MyAcl :TList; Var   iRet: Cardinal;   iiRet: Integer;   hCurrentProc, hToken: Thandle;   dwNumBytes: Cardinal;   dwNumBytesRet: Ulong;   dwNumEntries: Dword;   hMyHandle, hProc: THANDLE;   i: Dword;   Namee: Tsockaddr;   namelen: Integer;   S: Tsocket;   optlen, sockType: Integer;   //psnap :Thandle;   APort

Port; Begin   result:= TList.Create;   @NtQuerySystemInformation := GetProCaddress(hNtdll, 'NtQuerySystemInformation');   If @NtQuerySystemInformation = Nil Then     Begin       ShowMessage(Format('GetProcess (NtQuerySystemInFORMation) Error: %d',[GetLastError]));       exit;     End;   hCurrentProc := GetCurrentProcess;   If Not Windows.OpenProcessToken(hCurrentProc, TOKEN_ADJUST_PRIVILEGES Or TOKEN_QUERY,     hToken) Then     begin       ShowMessage(Format('OpenProcessToken Error: %d ', [GetLastError]));       exit;     end   Else     Begin       If Not RaisePrivleges(hToken, SE_DEBUG_NAME) Then         Begin           ShowMessage(Format('SetPrivleges SE_DEBUG_NAME Error: %d',[GetLastError]));           exit;         End;     End;   If hToken <> 0 Then CloseHandle(hToken);   dwNumBytes    := sizeof(THANDLEINFO);   hinfo         := AllocMem(dwNumBytes);   dwNumBytesRet := 0;   Try     //first call try to determin buffer size we'll need     iRet := NtQuerySystemInformation(NT_HANDLE_LIST, hInfo,dwNumBytes, @dwNumBytesRet);     //call NtQuery we get STATUS_INFO_LENGTH_MISMATCH     While iRet = STATUS_INFO_LENGTH_MISMATCH Do       Begin         inc(dwNumBytes,dwNumBytes);         ReallocMem(hinfo, dwNumBytes);         iRet  := NtQuerySystemInformation(NT_HANDLE_LIST, hInfo, dwNumBytes, @dwNumBytesRet);       End;     //if we still can't get STATUS_SUCCESS     If iRet <> STATUS_SUCCESS Then       Begin         ShowMessage(Format('NtQuerySystemInFORMation return Error: %d',[GetLastError]));         exit;       End     Else       Begin         HandleInfo:=hInfo;         HandleInfo:=PHANDLEINFO(ULONG(HandleInfo)+4);         dwNumEntries := dwNumBytesRet;         For  i := 0 To ((dwNumEntries-4) div 16) Do           Begin             If (HandleInf

bjType = OBJECT_TYPE_SOCKET)and                (HandleInfo.dwPid <> 0)and                (HandleInfo.dwPid <> GetCurrentProcessId ) Then               Begin                 hProc := OpenProcess(WRITE_DAC, False, HandleInfo.dwPid);                 If hProc <> 0 Then                   Begin                     AdjustDacl(hProc);                     CloseHandle(hProc);                   End;                 hMyHandle := 0;                 hProc     := OpenProcess(PROCESS_DUP_HANDLE, True, HandleInfo.dwPid);                 If hProc <> 0 Then                   Begin                      DuplicateHandle(hProc, HandleInfo.HndlOffset, hCurrentProc,                                 @hMyHandle, STANDARD_RIGHTS_REQUIRED, True, 0);                      CloseHandle(hProc);                   End;                 If hMyHandle <> 0 Then                   Begin                     Namee.sin_family := AF_INET;                     namelen := sizeof(Tsockaddrin);                     s:= Tsocket(hMyHandle);                     iiRet := getsockname(s, Namee, namelen);                     If iiRet <> SOCKET_ERROR Then                       Begin                         sockType := 0;                         optlen   := 4;                         getsockopt(s, SOL_SOCKET, SO_TYPE, @sockType, optlen);                         new(APort);                         //psnap := CreateToolHelp32SnapShot(TH32CS_SNAPPROCESS,0);                         //APort^.name:=PIDToName(psnap,HandleInfo.dwPid);                         APort^.name:=MyPIDToName(HandleInfo.dwPid);                         APort^.Port:=ntohs(Namee.sin_port);                         APort^.Socket_type:=szSockType[sockType];                         Aport^.PID:= HandleInfo.dwPid;                         result.Add(Aport);                       End;                   End;               End; //if             HandleInfo:= PHANDLEINFO(ULONG(HandleInfo)+sizeof(THANDLEINFO));           End; //for      End; //else    Finally     If hinfo <> Nil Then FreeMem(hinfo);     If hCurrentProc <> 0 Then CloseHandle(hCurrentProc);    End; //end of try End; //--------------------------------------- procedure TForm1.Button1Click(Sender: TObject); var   osinfo: TOSVERSIONinfo;   size: Cardinal;   WSAData : TWSAData;   PortList:TList;   CIO_Port

Port;   ListItem: TListItem;   i:integer; begin   WSAStartup($0202, WSAData);   hNtdll := LoadLibrary('NTDLL.DLL');   If hNtdll = 0 then   begin     ShowMessage(Format('LoadLibrary (NTDLL.DLL) Error: %d', [GetLastError]));     exit;   end;   osinfo.dwOSVersionInfoSize := sizeof(TOSVERSIONinfo);   if not BOOL(GetVersionEx(osinfo)) then     begin       messagebox(0, err_noOS, 'Error', MB_OK);       exit;//halt($FF);     end   else runonNT := osinfo.dwPlatformId = VER_PLATFORM_WIN32_NT;   size := SizeOf(cbuffer);  try   PortList:=TList.Create;   PortList:=MyAcl;   with ListView1 do   begin   clear;   for i:=0 to PortList.Count -1 do   begin     ListItem := Items.Add;     CIO_Port:=PortList;     ListItem.Caption :=IntToStr(CIO_Port.PID);     Listitem.SubItems.Add(CIO_Port.name);     Listitem.SubItems.Add(CIO_Port.Socket_type);     Listitem.SubItems.Add(IntToStr(CIO_Port.Port));   end;   end;   for i := 0 to (PortList.Count - 1) do    begin        CIO_Port := PortList.Items;      Dispose(CIO_Port);    end;   finally     PortList.Free;   end; end; //------------------------------------- 我在XP测试过，会导致MSN Messneger不能正常使用、关闭QQ.. WIN2K好像没问题。 //----- CIONO1

蛮牛野蛮牛 · 2002-11-14

在winxp上使用这个函数就可以了，不用这样复杂的。 pAllocateAndGetTcpExTableFromStack   PMIB_TCPEXROW=^MIB_TCPEXROW   MIB_TCPEXROW=record   dwState : DWORD;        // state of the connection   dwLocalAddr : DWORD;    // address on local computer   dwLocalPort : DWORD;    // port number on local computer   dwRemoteAddr : DWORD;   // address on remote computer   dwRemotePort : DWORD;   // port number on remote computer   dwProcessId : DWORD;   end;  PMIB_TCPEXTABLE = ^MIB_TCPEXTABLE  MIB_TCPEXTABLE=record   dwNumEntries : DWORD;   table : array [0..0] of MIB_TCPEXROW;   end;  function pAllocateAndGetTcpExTableFromStack)(   pTcpTable : PMIB_TCPEXTABLE,  // buffer for the connection table   bOrder : BOOL ,               // sort the table?   heap : HANDLE ,   zero : DWORD,   flags

WORD )

WORD 而且据说在winxp上这个地方应该是(PhInf

bjType = $1C)

蛮牛野蛮牛 · 2002-11-14

在winxp(PhInf

bjType = $1A)下应该为(PhInf

bjType = $1C) 而且在XP下不使用这样发方法，而是用这个API。 PTMibTCPRow = ^TMibTCPRow;   TMibTCPRow = packed record     dwState: DWORD;     dwLocalAddr: DWORD;     dwLocalPort: DWORD;     dwRemoteAddr: DWORD;     dwRemotePort: DWORD;     dwProcessId: DWORD;   end;   //   PTMibTCPTable = ^TMibTCPTable;   TMibTCPTable = packed record     dwNumEntries: DWORD;     Table: array[0..ANY_SIZE - 1] of TMibTCPRow;   end; function GetTcpTable( pTCPTable: PTMibTCPTable;   bOrder : BOOL,                 heap : HANDLE,   zero : DWORD,   flags : DWORD): DWORD; stdcall; external 'IPHLPAPI.DLL';

一个过客 · 2002-11-14

kcahcn提供的最后那个例程什么也得不到，前面那个倒是可以，不过速度太慢了。

kcahcn · 2002-11-14

我这儿可以得到结果。我再看看代码。 速度太慢这我也知道，因为没用线程。我留给别人做。别人给你做所有的工作没意思吧。 你应该动动手吧。 to蛮牛野蛮牛：你说的那个函数我知道，不只是一个函数。 Mark Russinovich的TCPVIEW就用那些函数。 delphi源代码我有(CIONO4写的)。你的问题没提到那些函数所以我没提供那个方法。 你只讨论了native api的方法。不能怪我[

] 如果你要那个代码我可以发。 //------------------ 忘了说：要在listview建立四个column还要把viewstyle设置为vsReport（谁都应该知道这个吧）   从代码可以看出这点：    ListItem := Items.Add;     CIO_Port:=PortList;     ListItem.Caption :=IntToStr(CIO_Port.PID);     Listitem.SubItems.Add(CIO_Port.name);     Listitem.SubItems.Add(CIO_Port.Socket_type);     Listitem.SubItems.Add(IntToStr(CIO_Port.Port)); //---------------- 如果还不现实结果就告诉你用什么windows，编译通过吗？，遇到哪些问题。。。 //----- Regrads CIONO1 CIONO1

一个过客 · 2002-11-14

我说速度慢可没有别的意思，只是说说而已，因为网上那个fport.exe速度非常快， 不知道是不是工作原理的不同。 另外，关于第二个例程，我跟踪了一下，总是在这里：       iiRet := getsockname(s, Namee, namelen);                     If iiRet <> SOCKET_ERROR Then 返回值总是SOCKET_ERROR 至于第三个例程，用到了iphelper，其实在win2000下就有了，的确很简单，可惜 98不支持。你的前面的例程支持98/95吗？

kcahcn · 2002-11-14

FPort它调用了ZwQuerySystemInformation 还调用了AllocateAndGetUdpExTableFromStack，AllocateAndGetTcpExTableFromStack （在xp）跟踪FPort发现它使用了AllocateAndGetUdpExTableFromStack，AllocateAndGetTcpExTableFromStack 而没有用ZwQuerySystemInformation（在win2k我还没跟踪FPort）。 这些方法在WIN9x不可行的。 //--------------------- 下面的代码用实现AllocateAndGetUdpExTableFromStack，AllocateAndGetTcpExTableFromStack 实现“一个端口到进程的关联”。 （Delphi6.0 7.0 ,WINXP下） ////////////////////////////////////////////////////// // //               OpenPorts //             CopyRight for CIO //           Computer Idiot Organization //           fsl(CIONO5) // ////////////////////////////////////////////////////// //TODO: lots of stuff ;p unit Unit1; interface uses   Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,   Dialogs, ActnList, ComCtrls, StdCtrls, winsock,tlhelp32, ExtCtrls; type   TForm1 = class(TForm)     Button1: TButton;  //onclick -> acRefreshExecute , Action->acRefresh     ListView1: TListView;     ActionList1: TActionList;     acRefresh: TAction;     procedure acRefreshExecute(Sender: TObject);   private     { Private declarations }     function GetIP(ipAddr: cardinal):string;     function GetPort(port: cardinal):string;     function PIDToName(ProcessSnap: THandle; PID:dword):string;   public     { Public declarations }   end; var   Form1: TForm1;   TcpState: array[0..12] of String= ('???',                           'CLOSED',                           'LISTENING',                           'SYN_SENT',                           'SYN_RCVD',                           'ESTABLISHED',                           'FIN_WAIT1',                           'FIN_WAIT2',                           'CLOSE_WAIT',                           'CLOSING',                           'LAST_ACK',                           'TIME_WAIT',                           'DELETE_TCB' ); implementation {$R *.dfm} type   MIB_TCPEXRow = record      dwState

WORD;      dwLocalAddr

WORD;      dwLocalPort

WORD;      dwRemoteAddr

WORD;      dwRemotePort

WORD;      dwProcessId

WORD;   end;   PMIB_TCPExRow = ^MIB_TCPExRow;   MIB_TCPExTable = record      dwNumEntries

WORD;      table        :array[0..50] of MIB_TCPExRow; // 50 ? .. ANY_SIZE !   end;   PMIB_TCPExTable= ^MIB_TCPExTable;   MIB_UDPExRow = record      dwLocalAddr

WORD;      dwLocalPort

WORD;      dwProcessID

WORD;   end;   PMIB_UDPExRow = ^MIB_UDPExRow;   MIB_UDPExTable = record      dwNumEntries

WORD;      table        :array[0..50] of MIB_UDPExRow;   end;   PMIB_UDPExTable = ^MIB_UDPExTable; function AllocateAndGetTcpExTableFromStack(TCPExTable: PMIB_TCPExTable;                                            order: boolean;                                            AllocHeap: THandle;                                            AlloFlags: integer;                                            ProtocolVer: integer): integer;          stdcall; external 'iphlpapi.dll' name 'AllocateAndGetTcpExTableFromStack'; function AllocateAndGetUdpExTableFromStack(UDPExTable: PMIB_UDPExTable;                                            order: boolean;                                            AllocHeap: THandle;                                            AlloFlags: integer;                                            ProtocolVer: integer): integer;          stdcall; external 'iphlpapi.dll' name 'AllocateAndGetUdpExTableFromStack'; function TForm1.GetIP(ipAddr: cardinal): string; var nIpAddr: cardinal; begin   nIpAddr := htonl(ipAddr);   Result := IntToStr(HIByte(HIWord(nIpAddr)))+'.'+             IntToStr(LOByte(HIWord(nIpAddr)))+'.'+             IntToStr(HIByte(LOWord(nIpAddr)))+'.'+             IntToStr(LOByte(LOWord(nIpAddr))); end; function TForm1.GetPort(port: cardinal): string; begin   Result := inttostr(htons(word(port))); end; function TForm1.PIDToName(ProcessSnap: THandle; PID: dword): string; var ProcessEntry: TProcessEntry32; begin   if (not Process32First(ProcessSnap, ProcessEntry)) then     Result := '????'   else begin     while PID <> ProcessEntry.th32ProcessID do       Process32Next(ProcessSnap, ProcessEntry);     Result := ProcessEntry.szExeFile   end end; procedure TForm1.acRefreshExecute(Sender: TObject); var   i: integer;   tcp: PMIB_TCPExTable;   udp: PMIB_UDPExTable;   item: TListItem;   psnap: THandle; begin   i := AllocateAndGetTCPExTableFromStack(@tcp, true, GetProcessHeap(), 2, 2);   if i <> 0 then exit;   i := AllocateAndGetUDPExTableFromStack(@udp, true, GetProcessHeap(), 2, 2);   if i <> 0 then exit;   psnap := CreateToolHelp32SnapShot(2,0);   if psnap = INVALID_HANDLE_VALUE then exit;   ListView1.Items.Clear;   for i := 0 to tcp.dwNumEntries -1 do begin     item := nil;     item := ListView1.Items.Add();     item.Caption := GetIP(tcp.table.dwLocalAddr);  //local IP     item.SubItems.Add(GetPort(tcp.table.dwLocalPort)); //Local Port     item.SubItems.Add(GetIP(tcp.table.dwRemoteAddr));  // Remote IP     item.SubItems.Add(GetPort(tcp.table.dwRemotePort)); // Remote Port     item.SubItems.Add(PIDToName(psnap,tcp.table.dwProcessId)); // Process     item.SubItems.Add(IntToStr(tcp.table.dwProcessId)); // PId     item.SubItems.Add(TCPState[tcp.table.dwState]);  //Status     item.SubItems.Add('TCP'); //Protocol     //todo : add path     end;   for i := 0 to udp.dwNumEntries -1 do begin     item := nil;     item := ListView1.Items.Add();     item.Caption := GetIP(udp.table.dwLocalAddr);     item.SubItems.Add(GetPort(udp.table.dwLocalPort));     item.SubItems.Add('');     item.SubItems.Add('');     item.SubItems.Add(PIDToName(psnap,udp.table.dwProcessId));     item.SubItems.Add(IntToStr(udp.table.dwProcessId));     item.SubItems.Add('');     item.SubItems.Add('UDP')   end;   CloseHandle(psnap); end; end. //----- CIONO1

一个过客 · 2002-11-14

你的方法适用于9x吗？

kcahcn · 2002-11-14

前面已经说了“这些方法在WIN9x不可行的。”。 NativeAPI只能在winnt/2k/xp用。（这你应该知道吧。）。 在win9x要用驱动程序。 //----- CIONO1

一个端口到进程的关联，救命；(100分)

蛮牛野蛮牛

Unregistered / Unconfirmed

蛮牛野蛮牛

Unregistered / Unconfirmed

张无忌

Unregistered / Unconfirmed

蛮牛野蛮牛

Unregistered / Unconfirmed

kcahcn

Unregistered / Unconfirmed

蛮牛野蛮牛

Unregistered / Unconfirmed

蛮牛野蛮牛

Unregistered / Unconfirmed

kcahcn

Unregistered / Unconfirmed

kcahcn

Unregistered / Unconfirmed

蛮牛野蛮牛

Unregistered / Unconfirmed

蛮牛野蛮牛

Unregistered / Unconfirmed

kcahcn

Unregistered / Unconfirmed

蛮牛野蛮牛

Unregistered / Unconfirmed

蛮牛野蛮牛

Unregistered / Unconfirmed

一个过客

Unregistered / Unconfirmed

kcahcn

Unregistered / Unconfirmed

一个过客

Unregistered / Unconfirmed

kcahcn

Unregistered / Unconfirmed

一个过客

Unregistered / Unconfirmed

kcahcn

Unregistered / Unconfirmed

Similar threads