August 12, 2004

Updated nmap patch for XP SP2

Thanks to everyone for the kind words about the patch. I have received tonnes of mail today, and I appreciate the thanks. However, I am just a small cog here and the real thanks should be going to Fyodor for making such a kick-ass tool in the first place.

One criticism I have gotten in a bunch of the emails was to so aggressively STOP raw socket support. You are right, this patch stops raw socket on all Windows systems. I wanted to get a quick fix out, and wasn't expecting people to put it into their main master sources for nmap.

Alas, not one to leave loose ends, I have updated the patch to do a version check against XP and which service pack it is. Quite simple really:

--- winip.c 2004-08-12 10:18:46.000000000 -0700
+++ winip.c 2004-08-12 16:04:56.000000000 -0700
@@ -379,6 +379,13 @@
rawsock_avail = 0;
}

+ // Disable rawsock support if its XP SP2
+ if( ver.dwMajorVersion >= 5 && ver.dwMinorVersion == 1 && ver.wServicePackMajor == 2 )
+ {
+ winbug = 1;
+ rawsock_avail = 0;
+ }
+
if(pcap_avail)
{
if(wo.trace) printf("***WinIP*** reading winpcap interface list\n");

You can download the updated patch here.

Posted by SilverStr at August 12, 2004 04:15 PM | TrackBack
Comments

I think we can safely assume that future service packs and major OS versions will have the same limitation, so here's a tweak:

+ if( (ver.dwMajorVersion == 5 && ver.dwMinorVersion == 1 && ver.wServicePackMajor >= 2) || (ver.dwMajorVersion>5) )

I didn't account for other minor versions of 5.x, but IIRC none is expected.

Posted by: Richard Tallent at August 12, 2004 10:52 PM

WHY didn't you just compile and distribute the updated file? I don't have access to a compiler ATM... this is freakin' Win32 port :)

"Your comment could not be submitted due to questionable content: h0tmail.com"

I got this when I tried to use my H0tmail (primary) adress. Why?

Posted by: Kimmo Alm at August 14, 2004 03:10 PM

Kimmo,

You can download the latest nmap which has my patches applied at: http://www.insecure.org/nmap/dist/nmap-3.55-SP2-win32.zip

I never distributed a compiled patch as I am not the maintainer of nmap. I submitted the patch (actually you can read about an even better patch I finished at: http://silverstr.ufies.org/blog/archives/000669.html) and allowed Fyodor to decide what he wanted to do.

As to your hotmail issue, due to recent comment spam I removed access for posted by hotmail accounts. It has significantly reduced the spam I was receiving. My apologies if it inconviences you.

Posted by: SilverStr at August 14, 2004 03:38 PM