Networking

Raw socket ICMP sniffing in x64 Assembly without libc: SOCK_RAW+IPPROTO_ICMP instructs the kernel to deliver only ICMP frames, filtering TCP/UDP at the socket layer. sys_recvfrom delivers the full frame including IP header — lea rsi,[sniffed_data+28] skips the 20-byte IPv4 header and 8-byte ICMP header to reach payload. IP address conversion: fetch each octet from sockaddr_in, repeatedly divide by 10 via div instruction, add 0x30 for ASCII, write digits backward into 16-byte buffer, insert 0x2E dot separators via conditional jump. Full source on GitHub.

Network packet IP addresses arrive in Big-Endian byte order inside sockaddr_in. x86/x64 Little-Endian architecture reverses the bytes on load — naive printing yields 5.1.168.192 instead of 192.168.1.5. The standard two-pass approach (convert forward, then reverse string) wastes memory cycles. Single-pass backward-build: start reading from the last IP octet (offset 7), write ASCII digits to the end of the output buffer, work backward simultaneously — the string forms correctly in one pass. Each octet uses div bl to extract decimal digits, add 0x30 to convert to ASCII, dot separator skipped on last octet via cmp rcx,4.