C / C++ / MFC

char*               szSendBuf                       = "STX";
    char                recvbuf[DEFAULT_BUFLEN];
    int                 iResult;
    int                 recvbuflen                      = DEFAULT_BUFLEN;

    // Initialize Winsock
    iResult = WSAStartup(MAKEWORD(2,2), &wsaData);
    if (iResult != 0) {
        printf("WSAStartup failed with error: %d\n", iResult);
        return 1;
    }

    ZeroMemory( &hints, sizeof(hints) );
    hints.ai_family = AF_INET;
    hints.ai_socktype = SOCK_DGRAM;
    hints.ai_protocol = IPPROTO_UDP;

    // Resolve the server address and port
    iResult = getaddrinfo(
        "255.255.255.255",
        "ms-sql-m",
        &hints,
        &result
    );

    if ( iResult != 0 ) {
        printf("getaddrinfo failed with error: %d\n", iResult);
        WSACleanup();
        //return 1;
    }

    // Attempt to connect to an address until one succeeds
    for(ptr=result; ptr != NULL ;ptr=ptr->ai_next) {

        // Create a SOCKET for connecting to server
        ConnectSocket = socket(ptr->ai_family, ptr->ai_socktype, ptr->ai_protocol);

        if (ConnectSocket == INVALID_SOCKET) {
            printf("socket failed with error: %ld\n", WSAGetLastError());
            WSACleanup();
            return 1;
        }

        // Connect to server.
        iResult = connect( ConnectSocket, ptr->ai_addr, (int)ptr->ai_addrlen);
        if (iResult == SOCKET_ERROR) {
            closesocket(ConnectSocket);
            ConnectSocket = INVALID_SOCKET;
            continue;
        }
        break;
    }

    freeaddrinfo(result);

    if (ConnectSocket == INVALID_SOCKET) {
        printf("Unable to connect to server!\n");
        WSACleanup();
        return 1;
    }

    // Send an initial buffer
    iResult = send(
        ConnectSocket,
        szSendBuf,
        (int)strlen(szSendBuf),
        0
    );

//Only define data here not the UDP header info
const char RequestBuffer[] = {0xff,0xff,...,0x02} //pseudo-code, enter all numbers one byte at a time
//Remember char type is one byte... and one byte is two hex digits

BOOL CA_SQLServer_Scan::_socket_Broadcast_SQLServers( void ) 
{
	#define DEFAULT_BUFLEN 512
	#define DEFAULT_PORT 1434

    int iResult;
    WSADATA wsaData;

    SOCKET ConnectSocket = INVALID_SOCKET;
    struct sockaddr_in clientService; 

    int recvbuflen = DEFAULT_BUFLEN;	
    char recvbuf[DEFAULT_BUFLEN] = "";

	char mac[5];
	char sendbuf[1];

	memset(sendbuf, 0x00, sizeof(sendbuf)); // I added this to package the data, 
	strcpy(sendbuf, "");
	sprintf(sendbuf+strlen(sendbuf), "", strlen(sendbuf), sendbuf);
	memcpy(sendbuf+strlen(sendbuf), mac, 5); // 
	    
    iResult = WSAStartup(MAKEWORD(2,2), &wsaData);
    if (iResult != NO_ERROR) {
        wprintf(L"WSAStartup failed with error: %d\n", iResult);
        return 1;
    }

    ConnectSocket = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
    if (ConnectSocket == INVALID_SOCKET) {
        wprintf(L"socket failed with error: %ld\n", WSAGetLastError());
        WSACleanup();
        return 1;
    }
   
    clientService.sin_family = AF_INET;
    clientService.sin_addr.s_addr = inet_addr( "255.255.255.255" );
	clientService.sin_port = htons( DEFAULT_PORT );

    iResult = connect( ConnectSocket, (SOCKADDR*) &clientService, sizeof(clientService) );
    if (iResult == SOCKET_ERROR) {
        wprintf(L"connect failed with error: %d\n", WSAGetLastError() );
        closesocket(ConnectSocket);
        WSACleanup();
        return 1;
  }

    iResult = send( ConnectSocket, sendbuf, 1, 0 ); // I altered it to 1 
    if (iResult == SOCKET_ERROR) {
        wprintf(L"send failed with error: %d\n", WSAGetLastError());
        closesocket(ConnectSocket);
        WSACleanup();
        return 1;
    }

    printf("Bytes Sent: %d\n", iResult);
	    
    iResult = shutdown(ConnectSocket, SD_SEND);
    if (iResult == SOCKET_ERROR) {
        wprintf(L"shutdown failed with error: %d\n", WSAGetLastError());
        closesocket(ConnectSocket);
        WSACleanup();
        return 1;
    }

    do {

        iResult = recv(ConnectSocket, recvbuf, recvbuflen, 0);
        if ( iResult > 0 )
            wprintf(L"Bytes received: %d\n", iResult);
        else if ( iResult == 0 )
            wprintf(L"Connection closed\n");
        else
            wprintf(L"recv failed with error: %d\n", WSAGetLastError());

    } while( iResult > 0 );


    // close the socket
    iResult = closesocket(ConnectSocket);
    if (iResult == SOCKET_ERROR) {
        wprintf(L"close failed with error: %d\n", WSAGetLastError());
        WSACleanup();
        return 1;
    }

    WSACleanup();
	
	return TRUE;
}

char sendbuf[] = {0x02};

jkirkerx wrote:

or transfer data to the receive buffer.

(("cmap"[0] << 24) | ("cmap"[1] << 16) | ("cmap"[2] << 8) | ("cmap"[3]))

const tag_cmap = _makeTag(cmap);

#define tag_cmap

ahmed zahmed wrote:

You're accessing a memory location.

DWORD d = 'cmap';

WalderMort wrote:

Any suggestions?

A--->proxy --------proxy<---B
                |
                S

Send SYN with TTL of i=1
Wait for ICMP TTL Exceeded message
i = i + 1, loop
Loop until "ICMP TTL Exceeded" messages are no longer received. 
The own NAT host has been traversed. 
The LOW TTL Value = i + 1.
If the NAT host supports "ICMP TTL Exceeded" messages to internal hosts, then the RST reply from buddy can be inspected. 
The LOW TTL Value = i - 1.