监听网内MSN ( 积分: 100 )

这段代码我是全文检索中找到的，也有很多人都说可以成功了
但是为什么我测试了一下不行呢？？？
编译已经通过了，数据包我也确定可以监听的到了，但是具体到MSN中的时候就不行
请指教！！！
大概是在
if (ntohs(TCPHeader.SrcPort)=1863) or (ntohs(TCPHeader.DestPort)=1863) then
这一句后面都执行不到。。。为什么呀？？


unit Main;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, WinSock2, StdCtrls, Spin;

const
WM_Socket = WM_User + 1;

type
TMainForm = class(TForm)
ListBox: TListBox;
procedure FormCreate(Sender: TObject);
procedure FormDestroy(Sender: TObject);
private
{ Private declarations }
s: TSocket;
procedure WMSocket(var Msg: TMessage); message WM_Socket;
public
{ Public declarations }
end;

var
MainForm: TMainForm;

implementation

const
SIO_RCVALL = IOC_IN or IOC_VENDOR or 1;

type
PIPv4_HDR = ^TIPv4_HDR;
TIPv4_HDR = record
VerLen: Byte;
TOS: Byte;
TotalLength: Word;
ID: Word;
Offset: Word;
TTL: Byte;
Protocol: Byte;
CheckSum: Word;
SrcAddr: Cardinal;
DestAddr: Cardinal
end;

PTCP_HDR = ^TTCP_HDR;
TTCP_HDR = record
SrcPort: Word;
DestPort: Word;
SEQ: Cardinal;
ACK: Cardinal;
LenFlag: Word;
WinSize: Word;
CheckSum: Word;
URG: Word
end;

{$R *.dfm}

procedure Prepare(var s: PChar);
var
p: Integer;
begin
p:=Pos(#13#10, s);
while p>0 do
begin
Inc(s, p+1);
p:=Pos(#13#10, s)
end
end;

procedure TMainForm.FormCreate(Sender: TObject);
var
WSAData: TWSAData;
ServerAddr: TSockAddrIn;
OptVal: Integer;
OptRet: DWord;
Ret: Integer;
begin
Ret:=WSAStartup($202, WSAData);
if Ret<>0 then
begin
ShowMessage('WSAStartup failed with error '+IntToStr(Ret));
Exit
end;

s:=WSASocket(AF_INET, SOCK_RAW, IPPROTO_IP, nil, 0, WSA_FLAG_OVERLAPPED);
if s=INVALID_SOCKET then
begin
ShowMessage('WSASocket failed with error '+IntToStr(WSAGetLastError));
Exit
end;

ServerAddr.sin_family:=AF_INET;
ServerAddr.sin_port:=htons(0);
ServerAddr.sin_addr.S_addr:=inet_addr('192.168.0.208'); //换成你的IP
if bind(s, @ServerAddr, SizeOf(ServerAddr))=SOCKET_ERROR then
begin
ShowMessage('bind failed with error '+IntToStr(WSAGetLastError));
Exit
end;

OptVal:=1;
if WSAIoctl(s, SIO_RCVALL, @OptVal, SizeOf(OptVal), nil, 0, @OptRet, nil, nil)=SOCKET_ERROR then
begin
ShowMessage('WSAIoctl failed with error '+IntToStr(WSAGetLastError));
Exit
end;

if WSAAsyncSelect(s, Handle, WM_Socket, FD_READ)=SOCKET_ERROR then
ShowMessage('WSAAsyncSelect failed with error '+IntToStr(WSAGetLastError))
end;

procedure TMainForm.FormDestroy(Sender: TObject);
begin
if closesocket(s)=SOCKET_ERROR then
ShowMessage('closesocket failed with error '+IntToStr(WSAGetLastError));

if WSACleanup=SOCKET_ERROR then
ShowMessage('WSACleanup failed with error '+IntToStr(WSAGetLastError))
end;

procedure TMainForm.WMSocket(var Msg: TMessage);
const
BufSize = 65535;
var
Buf: array [0..BufSize] of Char;
IPHeader: PIPv4_HDR;
IPHeaderLen: Byte;
TCPHeader: PTCP_HDR;
TCPHeaderLen: Byte;
Data: PChar;
Ret: Integer;
begin
ZeroMemory(@Buf, BufSize);
Ret:=recv(s, Buf, BufSize, 0);
if Ret=SOCKET_ERROR then
begin
ShowMessage('recv failed with error '+IntToStr(WSAGetLastError));
Exit
end;

IPHeader:=PIPv4_HDR(@Buf[0]);
if IPHeader.Protocol=IPPROTO_TCP then
begin
IPHeaderLen:=(IPHeader.VerLen and $F)*4;
TCPHeader:=PTCP_HDR(@Buf[IPHeaderLen]);
if (ntohs(TCPHeader.SrcPort)=1863) or (ntohs(TCPHeader.DestPort)=1863) then
begin
TCPHeaderLen:=(ntohs(TCPHeader.LenFlag) shr 12)*4;
Data:=@Buf[IPHeaderLen+TCPHeaderLen];
if (Pos('MSG', Data)=1) and (Pos('text/plain', Data)>0) then
begin
Prepare(Data);
ListBox.Items.Append(UTF8ToAnsi(Data))
end
end
end
end;

end.

猜测一下是从什么继承来的可能有帮助
例如 HTMLEdit 是不能从该方法得到文本的

这种数据包很容易呀,就是邮件的源文件来的,你看看邮件体相关的东西就知道了,
倒是我对你的监控数据是怎么监控的,能谈谈吗?

我是通过拦截API得到的数据包
我知道这样的数据包是可以解开的。。。但是我想问下有没专门的脚本可以解开
自己去写代码解开的话，那么要分析很多数据包 而且处理起来也比较麻烦

用indy控件吧，编码格式已经显示在那里了，Content-Transfer-Encoding: quoted-printable，还有一个是base64编码的，indy的控件包里面有专门的解码组件。

TIdMessageDecoderMIME ？？？
是这一个吗？？

有附件
From: &quot;chenyi&quot; <chenyi.mailbox@163.com>
To: ObjPascal@163.com <ObjPascal@163.com>
CC: chenyi226901835@163.com <chenyi226901835@163.com>
Subject: =?GB2312?Q?=D6=F7=CC=E2?=
X-mailer: Foxmail 4.2 [cn]
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary=&quot;=====000_Dragon126812208655_=====&quot;
Date: Mon, 23 Apr 2007 16:41:13 +0800


This is a multi-part message in MIME format.

--=====000_Dragon126812208655_=====
Content-Type: text/plain;
charset=&quot;GB2312&quot;
Content-Transfer-Encoding: quoted-printable

ObjPascal=A3=AC=C4=FA=BA=C3=A3=A1chenyi chenyi.mailbox@163.com 2007-04-23

--=====000_Dragon126812208655_=====
Content-Type: application/octet-stream;
name=&quot;附件.txt&quot;
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename=&quot;附件.txt&quot;

--=====000_Dragon126812208655_=====


无附件
From: &quot;chenyi&quot; <chenyi.mailbox@163.com>
To: ObjPascal@163.com <ObjPascal@163.com>
CC: chenyi226901835@163.com <chenyi226901835@163.com>
Subject: =?GB2312?Q?=D6=F7=CC=E2?=
X-mailer: Foxmail 4.2 [cn]
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary=&quot;=====000_Dragon126812208655_=====&quot;
Date: Mon, 23 Apr 2007 16:41:13 +0800

ObjPascal=A3=AC=C4=FA=BA=C3=A3=A1chenyi chenyi.mailbox@163.com 2007-04-23

就是字符串处理

是啊，mime解码就是按一定规则进行字符串处理，因为根据email的收发规则，必须用ascii传送内容。所以对于邮件附件，图片，等非ascii格式的内容必须从新编码。
收到邮件后解码就是了。
邮件常用的编码方式就 quoted-printable 和base64两种。

to ufo!: 可否说的详细一点 有没有专门的函数或者库可以解开？？

DELPHi's idmessage is ok

我想知道怎么用？？

这本是标准的邮件文本的内容，你在linux下用mail看就知道了，要分析出来可以自己写个组件，或者用foxmail这类的

多人接受答案了。