;
; Automated dhcp client
;
; v 1.1
;
; by the hidden player
;
DEBUG equ 1
TIMEOUT equ 60 ; in seconds
use32
org 0x0
db 'MENUET01' ; 8 byte id
dd 0x01 ; header version
dd START ; start of code
dd IM_END ; size of image
dd I_END ; memory for app
dd I_END ; esp
dd 0x0 , 0x0 ; I_Param , I_Icon
include 'macros.inc'
if DEBUG = 1
include 'debug.inc'
end if
START: ; start of execution
mov eax,40 ; Report events
mov ebx,10000000b ; Only Stack
int 0x40
mov eax,52 ; first, enable the stack
mov ebx,2
mov ecx,0x00000383
int 0x40
if DEBUG = 1
newline
dps "DHCP: Stack Initialized"
newline
end if
mov eax, 53 ; then, read in the status
mov ebx, 255
mov ecx, 6
int 0x40
cmp eax,0 ; if eax is zero, no driver was found
jne @f
if DEBUG = 1
dps "DHCP: No Card detected"
newline
end if
jmp close
@@:
if DEBUG = 1
dps "DHCP: Detected card: "
dph eax
newline
end if
; now that the stack is running, lets start the dhcp request
; First, open socket
mov eax, 53
mov ebx, 0
mov ecx, 68 ; local port dhcp client
mov edx, 67 ; remote port - dhcp server
mov esi, -1 ; broadcast
int 0x40
mov [socketNum], eax
if DEBUG = 1
dps "DHCP: Socket opened: "
dpd eax
newline
end if
; Setup the first msg we will send
mov byte [dhcpMsgType], 0x01 ; DHCP discover
mov dword [dhcpLease], esi ; esi is still -1 (-1 = forever)
;***************************************************************************
; Function
; buildRequest
;
; Description
; Creates a DHCP request packet.
;
;***************************************************************************
buildRequest:
; Clear dhcpMsg to all zeros
xor eax,eax
mov edi,dhcpMsg
mov ecx,512
cld
rep stosb
mov edx, dhcpMsg
mov [edx], byte 0x01 ; Boot request
mov [edx+1], byte 0x01 ; Ethernet
mov [edx+2], byte 0x06 ; Ethernet h/w len
mov [edx+4], dword 0x11223344 ; xid
mov [edx+10], byte 0x80 ; broadcast flag set
mov [edx+236], dword 0x63538263 ; magic number
; option DHCP msg type
mov [edx+240], word 0x0135
mov al, [dhcpMsgType]
mov [edx+240+2], al
; option Lease time = infinity
mov [edx+240+3], word 0x0433
mov eax, [dhcpLease]
mov [edx+240+5], eax
; ; option requested IP address
mov [edx+240+9], word 0x0432
; mov eax, [dhcpClientIP]
; mov [edx+240+11], eax
; option request list
mov [edx+240+15], word 0x0437
mov [edx+240+17], dword 0x0f060301
; Check which msg we are sending
cmp [dhcpMsgType], byte 0x01
jne br001
; "Discover" options
; end of options marker
mov [edx+240+21], byte 0xff
mov [dhcpMsgLen], dword 262
jmp ctr000
br001:
; "Request" options
; server IP
mov [edx+240+21], word 0x0436
mov eax, [dhcpServerIP]
mov [edx+240+23], eax
; end of options marker
mov [edx+240+27], byte 0xff
mov [dhcpMsgLen], dword 268
ctr000:
; write to socket ( send broadcast request )
mov eax, 53
mov ebx, 4
mov ecx, [socketNum]
mov edx, [dhcpMsgLen]
mov esi, dhcpMsg
int 0x40
; Setup the DHCP buffer to receive response
mov eax, dhcpMsg
mov [dhcpMsgLen], eax ; Used as a pointer to the data
; now, we wait for data from remote
wait_for_data:
mov eax,23 ; wait here for event NOTE a TIME-OUT should be placed here
mov ebx,TIMEOUT*100
int 0x40
; Any data in the UDP receive buffer?
mov eax, 53
mov ebx, 2
mov ecx, [socketNum]
int 0x40
cmp eax, 0
jne ctr002
if DEBUG = 1
dps "DHCP: Timeout!"
newline
end if
jmp close
; we have data - this will be the response
ctr002:
mov eax, 53
mov ebx, 3
mov ecx, [socketNum]
int 0x40 ; read byte - block (high byte)
; Store the data in the response buffer
mov eax, [dhcpMsgLen]
mov [eax], bl
inc dword [dhcpMsgLen]
mov eax, 53
mov ebx, 2
mov ecx, [socketNum]
int 0x40 ; any more data?
cmp eax, 0
jne ctr002 ; yes, so get it
; depending on which msg we sent, handle the response
; accordingly.
; If the response is to a dhcp discover, then:
; 1) If response is DHCP OFFER then
; 1.1) record server IP, lease time & IP address.
; 1.2) send a request packet
; 2) else exit ( display error )
; If the response is to a dhcp request, then:
; 1) If the response is DHCP ACK then
; 1.1) extract the DNS & subnet fields. Set them in the stack
; 2) else exit ( display error )
cmp [dhcpMsgType], byte 0x01 ; did we send a discover?
je discover
cmp [dhcpMsgType], byte 0x03 ; did we send a request?
je request
; should never get here - we only send discover or request
jmp close
discover:
call parseResponse
; Was the response an offer? It should be
cmp [dhcpMsgType], byte 0x02
jne close ; NO - so quit
; send request
mov [dhcpMsgType], byte 0x03 ; DHCP request
jmp buildRequest
request:
call parseResponse
; Was the response an ACK? It should be
cmp [dhcpMsgType], byte 0x05
jne close ; NO - so quit
close:
; close socket
mov eax, 53
mov ebx, 1
mov ecx, [socketNum]
int 0x40
if DEBUG = 1
dps "DHCP: Exiting"
newline
end if
mov eax,-1 ; at last, exit
int 0x40
;***************************************************************************
; Function
; parseResponse
;
; Description
; extracts the fields ( client IP address and options ) from
; a DHCP response
; The values go into
; dhcpMsgType,dhcpLease,dhcpClientIP,dhcpServerIP,
; dhcpDNSIP, dhcpSubnet
; The message is stored in dhcpMsg
;
;***************************************************************************
parseResponse:
if DEBUG = 1
dps "DHCP: Data received, parsing response"
newline
end if
mov edx, dhcpMsg
pusha
mov eax,52 ; Set Client IP
mov ebx,3
mov ecx, [edx+16]
int 0x40
if DEBUG = 1
dps "DHCP: Client: "
xor esi,esi
.loop:
pusha
movzx eax,byte[edx+esi+16]
call debug_outdec
popa
inc esi
cmp esi,4
jne .loop
newline
end if
popa
; Scan options
add edx, 240 ; Point to first option
pr001:
; Get option id
mov al, [edx]
cmp al, 0xff ; End of options?
je pr_exit
cmp al, 53 ; Msg type is a single byte option
jne pr002
mov al, [edx+2]
mov [dhcpMsgType], al
add edx, 3
jmp pr001 ; Get next option
pr002:
; All other (accepted) options are 4 bytes in length
inc edx
movzx ecx, byte [edx]
inc edx ; point to data
cmp al, 54 ; server id
jne pr0021
mov eax, [edx] ; All options are 4 bytes, so get it
mov [dhcpServerIP], eax
jmp pr003
pr0021:
cmp al, 51 ; lease
jne pr0022
if DEBUG = 1
pusha
dps "DHCP: lease: "
cmp dword[edx],-1
jne no_lease_forever
dps "forever"
jmp lease_newline
no_lease_forever:
dpd [edx]
lease_newline:
newline
popa
end if
jmp pr003
pr0022:
cmp al, 1 ; subnet mask
jne pr0023
pusha
mov eax,52
mov ebx,12
mov ecx,[edx]
int 0x40
if DEBUG = 1
dps "DHCP: Subnet: "
xor esi,esi
.loop:
pusha
movzx eax,byte[edx+esi]
call debug_outdec
popa
inc esi
cmp esi,4
jne .loop
newline
end if
popa
jmp pr003
pr0023:
cmp al, 6 ; dns ip
jne pr0024
pusha
mov eax,52
mov ebx,14
mov ecx,[edx]
int 0x40
if DEBUG = 1
dps "DHCP: DNS IP: "
xor esi,esi
.loop:
pusha
movzx eax,byte[edx+esi]
call debug_outdec
popa
inc esi
cmp esi,4
jne .loop
newline
end if
popa
pr0024:
cmp al, 3 ; gateway ip
jne pr003
pusha
mov eax,52
mov ebx,11
mov ecx,[edx]
int 0x40
if DEBUG = 1
dps "DHCP: Gateway:"
xor esi,esi
.loop:
pusha
movzx eax,byte[edx+esi]
call debug_outdec
popa
inc esi
cmp esi,4
jne .loop
newline
end if
popa
pr003:
add edx, ecx
jmp pr001
pr_exit:
if DEBUG = 1
dps "DHCP: Done"
newline
end if
jmp close
; DATA AREA
IM_END:
dhcpMsgType: db 0
dhcpLease: dd 0
;dhcpClientIP: dd 0
dhcpServerIP: dd 0
dhcpMsgLen: dd 0
socketNum: dd 0xFFFF
dhcpMsg: rb 512
I_END: