#ifndef __AS_SCAN_H__
#define __AS_SCAN_H__

// 網段內主機信息雙向鏈表
typedef struct _LAN_HOST_INFO {
	char IpAddr[4 * 4]; /* 主機IP地址 */
	char HostName[25]; /* 主機名 */
	unsigned char ucMacAddr[4]; /* 主機網卡地址 */
	BOOL bIsOnline; /* 是否在線 */
	struct _LAN_HOST_INFO *prev; /* 上一個主機的指針 */
	struct _LAN_HOST_INFO *next; /* 下一個主機的指針 */
}LAN_HOST_INFO, *PLAN_HOST_INFO;

PLAN_HOST_INFO pLanHostInfo, pNextHostInfo; // 永遠指向鏈表接尾部

void EnumLanHost(char IpAddr[], char SubMask[]);

void scan_lan(LPVOID lparam)
{
	char IpAddr[16];
	u_char ucMacAddr[6];
	PLAN_HOST_INFO pInfo;
	unsigned long nRemoteAddr;
	struct hostent *pHostent; 
	memset(IpAddr, 0, sizeof(IpAddr));
	memset(ucMacAddr, 0xff, sizeof(ucMacAddr));

	// 拷貝參數
	pInfo = (PLAN_HOST_INFO) lparam;
	memcpy(IpAddr, pInfo->IpAddr, sizeof(IpAddr));

	if (GetMac(IpAddr, ucMacAddr))
	{
		// 存活主機信息保存至鏈表
		pInfo->bIsOnline = TRUE;
		memcpy(pInfo->ucMacAddr, ucMacAddr, sizeof(ucMacAddr));

		// 得到主機名
		nRemoteAddr = inet_addr(IpAddr);
		pHostent = (struct hostent*) malloc(sizeof(struct hostent));
		memset(pHostent, 0, sizeof(struct hostent));
		pHostent = gethostbyaddr((char*)&nRemoteAddr, 4, AF_INET);
		if (pHostent)
			memcpy(pInfo->HostName, pHostent->h_name, strlen(pHostent->h_name));
	}
	else
		pInfo->bIsOnline = FALSE;
}
//////////////////////////////////////////////////////////////////////////
// 得到網段內所有主機的信息
// 入口參數: 自身IP地址、子網掩碼
//////////////////////////////////////////////////////////////////////////
void EnumLanHost(char IpAddr[], char SubMask[])
{
	unsigned int uHostByte; // 主機位
	int i, uHostNum;

	ULONG uMacLength = 6;

	// 兩個臨時變量
	char TempIpAddr[4 * 4];

	HANDLE *hThread; // 線程數組指針
	DWORD dwThreadID; // 線程ID
	WSADATA wsaData;

	WSAStartup(MAKEWORD(2,1), &wsaData);
	printf("[+] Start scan lan ......\n");

	// 由IP地址得到主機位
	uHostByte = htonl(inet_addr(IpAddr)) & 0xffffff00;

	// 由子網掩碼得到網段內的主機數量
	// 子網主機個數 = ~ MASK - 1
	uHostNum = ~ htonl(inet_addr(SubMask)) - 1;

	// 初始化線程句柄數組
	hThread = (HANDLE *)malloc(sizeof(HANDLE) * uHostNum);
	
	// 初始化鏈表
	pLanHostInfo = (PLAN_HOST_INFO) malloc(sizeof(LAN_HOST_INFO));
	memset(pLanHostInfo, 0, sizeof(LAN_HOST_INFO));
	pLanHostInfo->prev = NULL;

	
	printf("[+] Scan for adresses from %d.%d.%d.1-%d\n\n",
		(uHostByte & 0xff000000) >> 0x18,
		(uHostByte & 0x00ff0000) >> 0x10,
		(uHostByte & 0x0000ff00) >> 0x08, uHostNum);

	// 開始進行多線程ARP掃描,創建uHostNum個線程掃描
	// Scan Range: 1 ~ uHostNum
	for (i = 0, uHostByte ++; i < uHostNum; i ++, uHostByte ++)
	{
		// 構造IP地址
		memset(TempIpAddr, 0, strlen(TempIpAddr));
		sprintf(TempIpAddr, "%d.%d.%d.%d", 
			(uHostByte & 0xff000000) >> 0x18,
			(uHostByte & 0x00ff0000) >> 0x10,
			(uHostByte & 0x0000ff00) >> 0x08,
			(uHostByte & 0x000000ff));
		// 構造鏈表
		pNextHostInfo = (PLAN_HOST_INFO) malloc(sizeof(LAN_HOST_INFO));
		memset(pNextHostInfo, 0, sizeof(LAN_HOST_INFO));
		memcpy(pLanHostInfo->IpAddr, TempIpAddr, sizeof(TempIpAddr));
		pLanHostInfo->next = pNextHostInfo;
		pNextHostInfo->prev = pLanHostInfo;
		pNextHostInfo->next = NULL;

		if ((hThread[i]=CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE) scan_lan, 
			pLanHostInfo, 0, &dwThreadID))==NULL)
		{
			printf("[!] Create thread error! IP is %s\n",TempIpAddr);
		}
		pLanHostInfo = pLanHostInfo->next;

		Sleep(2); // 等待參數傳遞完畢，再重新賦值
	}
	
	// 等待線程返回,退出函數
	WaitForMultipleObjects(uHostNum,hThread,TRUE,-1);

	// 顯示存活主機信息
	printf("IP address        MAC address        NetBIOS Name\n");
	printf("------------------------------------------------------------------------------\n");

	for (i=0; pLanHostInfo->prev != NULL; )
	{
		pLanHostInfo = pLanHostInfo->prev;
		if (pLanHostInfo->bIsOnline)
		{
			printf("%-16s  %.2X-%.2X-%.2X-%.2X-%.2X-%.2X  %s\n", 
				pLanHostInfo->IpAddr,
				pLanHostInfo->ucMacAddr[0], pLanHostInfo->ucMacAddr[1],
				pLanHostInfo->ucMacAddr[2], pLanHostInfo->ucMacAddr[3], 
				pLanHostInfo->ucMacAddr[4], pLanHostInfo->ucMacAddr[5],
				strlen(pLanHostInfo->HostName) > 0 ? pLanHostInfo->HostName : "N/A");
			i++;
		}
	}
	printf("------------------------------------------------------------------------------\n");
	printf("\n[*] Tatol %d host alive, scan finished\n", i);
	WSACleanup();
}

#endif