import ctypes as C import json import socket import struct import os from pathlib import Path from datetime import datetime, timezone ROOT=Path(__file__).resolve().parent U32=C.c_uint32 DLL=C.WinDLL('iphlpapi.dll',use_last_error=True) def table(name, cls=None): fn=getattr(DLL,name);fn.restype=U32 fn.argtypes=[C.c_void_p,C.POINTER(U32),C.c_int]+([] if cls is None else [U32,U32,U32]) args=[] if cls is None else [2,cls,0] size=U32(0);assert fn(None,C.byref(size),0,*args)==122 for _ in range(3): assert 4<=size.value<=16000000 buf=C.create_string_buffer(size.value) code=fn(buf,C.byref(size),0,*args) if code!=122:break assert code==0,code stride=20 if name=='GetTcpTable' else 28 if name=='GetTcpTable2' else 24 count=U32.from_buffer(buf).value assert 4+count*stride<=len(buf) rows=[] for i in range(count): v=struct.unpack_from('<'+'I'*(stride//4),buf,4+i*stride) state,la,lp,ra,rp=v[:5] local=(socket.inet_ntoa(struct.pack('5 else None)) return dict(api=name,table_class=cls,return_code=code,rows=rows) def capture(): return [table('GetTcpTable'),table('GetTcpTable2'),table('GetExtendedTcpTable',3),table('GetExtendedTcpTable',4)] result=dict(observer_pid=os.getpid(),utc=datetime.now(timezone.utc).isoformat(),product_access=0) with socket.socket() as listener: listener.setsockopt(socket.SOL_SOCKET,socket.SO_EXCLUSIVEADDRUSE,1) listener.bind(('127.0.0.1',0));port=listener.getsockname()[1] assert port not in (8080,8090) listener.listen(1);listener.settimeout(3) result['fixture_port']=port result['actual_so_acceptconn']=listener.getsockopt(socket.SOL_SOCKET,socket.SO_ACCEPTCONN) result['before']=capture() with socket.create_connection(('127.0.0.1',port),3) as client: accepted,_=listener.accept() with accepted: result['tuple']={'client':client.getsockname(),'server':accepted.getsockname()} client.sendall(b'fictional-witness') assert accepted.recv(128)==b'fictional-witness' accepted.sendall(b'fictional-ack') assert client.recv(128)==b'fictional-ack' result['exchange_pass']=True result['during']=capture() result['all_fixture_sockets_closed']=all(s.fileno()==-1 for s in (listener,client,accepted)) result['after']=capture() with (ROOT/'evidence/fixture-native-probe.json').open('x',encoding='utf-8') as f:json.dump(result,f,indent=2) print(json.dumps({k:v for k,v in result.items() if k not in ('before','during','after')})) for stage in ('before','during','after'): print(stage,json.dumps([{'api':t['api'],'class':t['table_class'],'rows':t['rows']} for t in result[stage]]))