40 replies to this topic

[madmax69]

@NetFanTom
--------------------------------------------
!An excellent website. "
--------------------------------------------
Thank you very much.
--------------------------------------------
"May I ask you to provide an example:
Why do you need tftplaunch and ipcalc?"
----------------------------------------------
Thanks and sure

You don't really need both but I thought it might be cool to start a generic tool, especially as it would be easy to add some rudimentary IP arithmetic later on such as /AND /OR /PLUS /MINUS and pick up a previously generated numeric value from a previous call etc. I can see that it might be handy to mask off parts of a detected address and then add on an octet value or increment an address value by +1, say, via batch files

There's an example batch file in the ZIP download but basically...

ECHO Testing IPCalc 192 168 2 100 (not /net - little endian)
FOR /F "tokens=*" %%i in ('IPCalc.exe 192 168 0 100') DO SET IPVALUE=%%i
ECHO Environment variable IPVALUE was set to %IPVALUE%

ECHO Testing IPCalc 192 168 2 100 (/net - big endian)
FOR /F "tokens=*" %%i in ('IPCalc.exe 192 168 0 100 /net') DO SET IPVALUE=%%i
ECHO Environment variable IPVALUE was set to %IPVALUE%

There's a /NET switch to generate in "big-endian" (network) format as used by tftpd32 or omit this to generate in standard (x86) little-endian format. I didn't finish it till 4am and was a bit sleepy by then, so fingers crossed it's debugged properly LOL (the result can be displayed either in "C" unsigned long, signed long or HEX string format. A CRLF isn't added by default in order to ease use with ENV vars. /CRLF adds one for display purposes.

I'll add the basic math stuff when I get a moment

(*Sorry, my popup/script blocker won't let me quote stuff)

[grrrd]

Here is my script (extract);

:TFTPD32

d:

cdinstallsimages

ECHO Installing Server

copy Tftpd32.zip c: /Y

c:

cd

unzip Tftpd32.zip

cls

ECHO Server Installed Ok

PAUSE

CLS

ECHO TFTPd32 will now configure itself, please wait...

IPCONFIG |FIND "IP" > %temp%TEMPIP.txt

FOR /F "tokens=2 delims=:" %%a in (%temp%TEMPIP.txt) do set IP=%%a

del %temp%TEMPIP.txt

set IP=%IP:~1%

echo %IP% >%temp%ip.txt

echo The current IP address is "%IP%"

cd %temp%

gsar -i -s"." -r" " ip.txt -o

set /p IP= <ip.txt

d:

cdinstallsimages

start Config.bat %ip%

sleep 5

start gentftpi.bat

sleep 5

start /min c:tftpd32tftpd32.exe

cls

echo Success!

sleep2

The 'Config.bat that it calls is;

d:

cdinstallsimages

gsar -i -s"ReplaceIP" -r"%1.%2.%3.2" GenTftpi.bat -o

gsar -i -s"ReplaceGate" -r"%1.%2.%3.1" GenTftpi.bat -o

exit

From the Code that was produced by NetFranTom i replaced the hardcoded IP address for the IP pool and Gate way with (ReplaceIp and ReplaceGate)

[grrrd]

For Config.bat i always know that that IP Pool will start in a IP addy that starts .2 and the default gateway (the router in this case) is always .1

[madmax69]

The script may not work, grrrd, if you have one of the popular VMs installed which has set up a virtual network or more than 1 NIC or networked interface installed. E.g. Oracle VirtualBox, VMWare etc.
-------------------------------------------------------
ECHO TFTPd32 will now configure itself, please wait...
IPCONFIG |FIND "IP" > %temp%TEMPIP.txt
-------------------------------------------------------
You could perhaps use my util called showip.exe to stuff an IP address into the ENV as this queries the Win32 API directly
Even then you have to take a guess that this will be the 1st NIC (or pick another)
You can use /1 /2 ... /6 to pick up a given NIC

http://showip.kerys.co.uk
------------------------------------------------------------
@echo off
REM Quick demo...
REM showip.exe /? for info
REM IP test batch file

FOR /F "tokens=*" %%i in ('showip.exe /ip /q') DO SET IP_ADDRESS=%%i
if "%IP_ADDRESS%"=="0.0.0.0" goto no_ip
if "%IP_ADDRESS%"=="" goto no_ip
goto got_ip

:no_ip
ECHO No ip address was detected (or was 0.0.0.0)
goto end

:got_ip
ECHO We have a bound IP address and it is %IP_ADDRESS%
goto end

:end
pause
------------------------------------------------------------
Looking at adding math stuff to ipcalc but keep getting interupted!

[Wonko the Sane]

start gentftpi.bat

change to EITHER:

CALL gentftpi.bat

OR:

gentftpi.bat

OR:

START "" /B /WAIT gentftpi.bat

Wonko

[NetFanTom]

Hello!

Version v04 is out.

You should avoid the use of gsar.

Please use command line parameters
e.g. GenTftpi.bat 192.168.0.30 192.168.0.1
Ip = 192.168.0.30 (Pool)
Gateway = 192.168.0.1


NetFanTom

[madmax69]

IPCalc is probably of no use now for the use required in this thread, but I thought I'd add features whilst I was motivated. Have added various output conversion as well as ADD, SUB, AND, OR, NOT arithmetic on an input IP address. This means you can tweak individual octet values for say setting up DHCP subnet ranges from a single IP address and even increment/decrement IP addresses within a batch file.

Now at: http://ipcalc.kerys.co.uk

There are 2 test batch files bundled with v1.01 ZIP download. Also viewable from the web page.

http://ipcalc.kerys....n/1.01/test.bat
http://ipcalc.kerys....01/testmath.bat

The EXE is about 25kb

[NetFanTom]

Hi!

Version v05 is out.

@madmax69 and All

Regarding IP 255.255.255.0

for me is big-endian:

dec: 255 255 255 0
hex: FF FF FF 00
value: 255*256*256*256+255*256*256+255*256+0

little-endian:
dec: 0 255 255 225
hex: 00 FF FF FF
value: 0*256*256*256+255*256*256+255*256+255

tftpd32 needs little-endian, is that right?

Regards,
NetFanTom

[grrrd]

The script may not work, grrrd, if you have one of the popular VMs installed which has set up a virtual network or more than 1 NIC or networked interface installed. E.g. Oracle VirtualBox, VMWare etc.
-------------------------------------------------------
ECHO TFTPd32 will now configure itself, please wait...
IPCONFIG |FIND "IP" > %temp%TEMPIP.txt
-------------------------------------------------------
You could perhaps use my util called showip.exe to stuff an IP address into the ENV as this queries the Win32 API directly
Even then you have to take a guess that this will be the 1st NIC (or pick another)
You can use /1 /2 ... /6 to pick up a given NIC

http://showip.kerys.co.uk
------------------------------------------------------------
@echo off
REM Quick demo...
REM showip.exe /? for info
REM IP test batch file

FOR /F "tokens=*" %%i in ('showip.exe /ip /q') DO SET IP_ADDRESS=%%i
if "%IP_ADDRESS%"=="0.0.0.0" goto no_ip
if "%IP_ADDRESS%"=="" goto no_ip
goto got_ip

:no_ip
ECHO No ip address was detected (or was 0.0.0.0)
goto end

:got_ip
ECHO We have a bound IP address and it is %IP_ADDRESS%
goto end

:end
pause
------------------------------------------------------------
Looking at adding math stuff to ipcalc but keep getting interupted!

This is ok for me, for the environment that i am working on isn't Vms, but actual terminals that all have 1 NIC

Hello!

Version v04 is out.

You should avoid the use of gsar.

Please use command line parameters
e.g. GenTftpi.bat 192.168.0.30 192.168.0.1
Ip = 192.168.0.30 (Pool)
Gateway = 192.168.0.1


NetFanTom

The reason i went with Gsar is that i need to drop the last octet of the hosts IP address, to change it to .1/.2, this seemed to be the easiest/accurate way of completeing this.

Once again - A huge thank you to all involved!

[NetFanTom]

The final stumbling point i have got to now is changing the TFTpd32.ini file (or registry entry) to reflect the local network IP structure. This is key especially for VNC for i need to ensure the WinPE environment knows where the local default gateway is, so the analyst can VNC in a reimage (if needed). The server machine that will run the TFTpd32 on the local machine will have a local IP address, this allows me to write a script that can assertain variables to set the IPPool and Default gateway.

Please forgive the curiosity.

Start the PXE client under WinPE the VNC program automatically?
How does the analysis work?
And how does that reimaging work?

Regards,
NetFanTom

[madmax69]

@NetFanTom

Other way around from what I've always understood. I read a couple of articles to refresh my memory. This one is good:
http://www.cs.umass....s32/endian.html
And this defines network endian-ness as "big" - http://en.wikipedia....s_in_networking

The ordering doesn't go by (Western) human left-to-right textual ordering but in the internal byte (or bit) ordering - which is dependent on your hardware platform. x86 is "little-endian" so whatever the case, the byte pattern has to be reversed to produce "big-endian". On Motorola CPUs this is probably the reverse case (at least from my personal memory).

What you've typed in your example shows the human-readable (western) textual ordering not the internal bit pattern on x86 CPUs. TFTPD32 stores some of the values in raw, network, "big endian" format as signed 32 bit integers, so it's the reverse of what you'd expect. It caught me out when I wrote TFTPLaunch!

Bear in mind the bytes are re-ordered, not the bits (i.e. don't invert the bit patterns). And the internal byte ordering, if viewed with say a "C" long integer viewed as a horizontal "string" goes from right to left in increasing order of significance. (See Dr Bill's notes above) His article also shows a couple of algorithms for bit-reversal. I prefer to use masking and shifting

Edit: I'd also add that many programs (including IPCalc may choose to represent an IP address as a textual HEX value in Western (right to left) reading order). This does not reflect the internal x86 bit representation.

Edited by madmax69, 15 November 2011 - 02:55 PM.

[madmax69]

@grrrd
-----------------------------------------------------------------------------------------
This is ok for me, for the environment that i am working on isn't Vms
-----------------------------------------------------------------------------------------
I meant VMs (as in Virtual Machines - e.g. Oracle VirtualBox) rather than VMS

*looooong* time since I was at a VMS console LOL
(I wonder if "All In One" is still kicking around?)

Edited by madmax69, 15 November 2011 - 02:59 PM.

[madmax69]

@grrrd

------------------------------------------------------------
The reason i went with Gsar is that i need to drop the last
octet of the hosts IP address, to change it to .1/.2, this
seemed to be the easiest/accurate way of completeing this.
------------------------------------------------------------

IPCalc v1.01 can now do this. I got it working yesterday.
2 lines of batch code are required

------------------------------------------------------------
REM Assume IP_ADDRESS is passed-in as non-dotted quad format - e.g. 192 168 0 12
REM ShowIP (v1.11) Can now generate a local ip address in non-dotted format
FOR /F "tokens=*" %%i in ('IPCalc.exe %IP_ADDRESS% /and /hexval:ffffff00 /toinput /q') DO SET IP_ADDRESS=%%i
REM IP_ADDRESS now holds say 192 168 0 0

REM Now /OR in decimal .200 on the last octet - could also use /ADD
FOR /F "tokens=*" %%i in ('IPCalc.exe %IP_ADDRESS% /or /val:200 /toinput /q') DO SET IP_ADDRESS=%%i
REM IP_ADDRESS will now hold say 192 168 0 200 as a non-dotted quad
REM If you want dotted quad string format use /toip instead of /toinput
REM If you want human readable HEX format use /hex instead of /toinput
REM If you want an unsigned integer use the default and remove /toinput
REM If you want an unsigned integer in network format add /net

------------------------------------------------------------

I also modified ShowIP (v1.11) to generate the local IP address in non-dotted quad format
When I get time I'll add auto-detect and handling of dotted quads!

[panreyes]

Hi, one little question.
Why does IP_Pool show as -1778341696 in tftpd32.ini, when it should be 3232235670 (192.168.0.150)?

[madmax69]

The number appears negative because it is a long integer representation with the topmost (sign) bit set - the other value you give is an unsigned representation

Try playing with IPCalc (http://ipcalc.kerys.co.uk)

ipcalc 192.168.0.150 -> -1062731626
ipcalc 192.168.0.150 /u -> 3232235670 (unsigned)

[panreyes]

Thanks, but can't use that solution.

Mmm... Is there anyway I could do this through AutoIT instead of using bats and external programs?