关于FIN扫描编程
有没有哪位大神懂得C语言的FIN扫描编程？求思路！
[解决办法]

#include "stdio.h"
#include "Winsock2.h"
#include <ws2tcpip.h>    
#include "mstcpip.h"
#pragma comment(lib,"WS2_32.lib")
int Stop = 0;
int PortStart = 80;
int PortEnd = 81;
char *DestIpAddr = "192.168.1.3";
typedef struct IpHeader
{
    unsigned char Version_HLen;
    unsigned char TOS;
    unsigned short Length;
    unsigned short Ident;
    unsigned short Flags_Offset;
    unsigned char TTL;
    unsigned char Protocol;
    unsigned short Checksum;
    unsigned int SourceAddr;
    unsigned int DestinationAddr;
} Ip_Header;
#define URG 0x20 
#define ACK 0x10 
#define PSH 0x08 
#define RST 0x04 
#define SYN 0x02 
#define FIN 0x01 
typedef struct TcpHeader
{
    USHORT SrcPort;
    USHORT DstPort;
    unsigned int SequenceNum;
    unsigned int Acknowledgment;
    unsigned char HdrLen;
    unsigned char Flags;
    USHORT AdvertisedWindow;
    USHORT Checksum;
    USHORT UrgPtr;
} Tcp_Header;
int PacketAnalyzer(char*);
DWORD WINAPI Send_Net_Packet(LPVOID no);
int main(int argc, char **argv)
{
    HANDLE Thread;
    DWORD ThreadId;
    SOCKET RecSocket;
    int Result;
    char RecvBuf[65535] = 
    {
        0
    };
    LARGE_INTEGER nFreq;
    char Name[255];
    LARGE_INTEGER StartTime;
    LARGE_INTEGER EndTime;
    HANDLE hCon;
    WSADATA wsaData;
    DWORD dwBufferLen[10];
    DWORD dwBufferInLen = 1;
    DWORD dwBytesReturned = 0;
    struct hostent *pHostent;
    Result = WSAStartup(MAKEWORD(2, 1), &wsaData);
    if (Result == SOCKET_ERROR)
    {
        printf("WSAStartup failed with error %d\n", Result);
        return 0;
    } RecSocket = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
    if (Result == SOCKET_ERROR)
    {
        printf("socket failed with error %d\n", WSAGetLastError());
        closesocket(RecSocket); 
 
        return 0;
    }
    Result = gethostname(Name, 255);
    if (Result == SOCKET_ERROR)
    {
        printf("gethostname failed with error %d\n", WSAGetLastError());
        closesocket(RecSocket);
        return 0;
    }
    pHostent = (struct hostent*)malloc(sizeof(struct hostent));
    pHostent = gethostbyname(Name);
    SOCKADDR_IN sock;
    sock.sin_family = AF_INET;
    sock.sin_port = htons(5555);
    memcpy(&sock.sin_addr.S_un.S_addr, pHostent->h_addr_list[0], pHostent->h_length);
    Result = bind(RecSocket, (PSOCKADDR) &sock, sizeof(sock));
    if (Result == SOCKET_ERROR)
    {
        printf("bind failed with error %d\n", WSAGetLastError());
        closesocket(RecSocket);
        return 0;
    } Result = WSAIoctl(RecSocket, SIO_RCVALL, &dwBufferInLen, sizeof(dwBufferInLen), &dwBufferLen, sizeof(dwBufferLen), &dwBytesReturned, NULL, NULL);
    if (Result == SOCKET_ERROR)
    {
        printf("WSAIoctl failed with error %d\n", WSAGetLastError());
        closesocket(RecSocket);
        return 0;
    }
    Thread = CreateThread(NULL, 0, Send_Net_Packet, NULL, 0, &ThreadId);
    if (Thread == NULL)
    {
        printf("CreateThread for Send_Net_Packet Error: %d ", GetLastError());
        return 0;
    }
    hCon = GetStdHandle(STD_OUTPUT_HANDLE);
    CONSOLE_SCREEN_BUFFER_INFO bInfo;
    GetConsoleScreenBufferInfo(hCon, &bInfo);
    if (QueryPerformanceFrequency(&nFreq))
    {
        QueryPerformanceCounter(&StartTime);
        while (true)
        {
            memset(RecvBuf, 0, sizeof(RecvBuf));
            Result = recv(RecSocket, RecvBuf, sizeof(RecvBuf), 0);
            if (Result == SOCKET_ERROR)
            {
                printf("recv failed with error %d\n", WSAGetLastError());
                closesocket(RecSocket); 
 
                return 0;
            }
            Result = PacketAnalyzer(RecvBuf);
            if (Result == 0)
            {
                printf("PacketAnalyzer failed with error %d\n", Result);
                closesocket(RecSocket);
                return 0;
            }
            if (Stop == 1)
            {
                break;
            }
        }
        SetConsoleTextAttribute(hCon, 14);
        QueryPerformanceCounter(&EndTime);
    }
    double fInterval = EndTime.QuadPart - StartTime.QuadPart;
    printf("Total Time:%fms\n", fInterval *1000 / (double)nFreq.QuadPart);
    SetConsoleTextAttribute(hCon, bInfo.wAttributes);
    if (closesocket(RecSocket) == SOCKET_ERROR)
    {
        printf("closesocket failed with error %d\n", WSAGetLastError());
        return 0;
    }
    if (WSACleanup() == SOCKET_ERROR)
    {
        printf("WSACleanup failed with error %d\n", WSAGetLastError());
        return 0;
    }
    return 1;
}

USHORT checksum(USHORT *buffer, int size)
{
    unsigned long cksum = 0;
    while (size > 1)
    {
        cksum +=  *buffer++;
        size -= sizeof(USHORT);
    }
    if (size)
    {
        cksum += *(UCHAR*)buffer;
    }
    cksum = (cksum >> 16) + (cksum &0xffff);
    cksum += (cksum >> 16);
    return (USHORT)(~cksum);
}

DWORD WINAPI Send_Net_Packet(LPVOID no)
{
    typedef struct IpHeader
    {
        u_char Version_HLen;
        u_char TOS;
        short Length;
        short Ident; 
 
        short Flags_Offset;
        u_char TTL;
        u_char Protocol;
        short Checksum;
        unsigned int SourceAddr;
        unsigned int DestinationAddr;
    } Ip_Header;
    typedef struct tsd_hdr
    {
        unsigned long saddr;
        unsigned long daddr;
        char mbz;
        char ptcl;
        unsigned short tcpl;
    } PSD_Tcp_Header;
    typedef struct tcp_hdr
    {
        USHORT SrcPort;
        USHORT DstPort;
        unsigned int SequenceNum;
        unsigned int Acknowledgment;
        unsigned char HdrLen;
        unsigned char Flags;
        USHORT AdvertisedWindow;
        USHORT Checksum;
        USHORT UrgPtr;
    } Tcp_Header;
    struct in_addr localaddr;
    char HostName[255];
    struct hostent *Hostent;
    WSADATA wsaData;
    SOCKET SendSocket;
    SOCKADDR_IN addr_in;
    Ip_Header ipHeader;
    Tcp_Header tcpHeader;
    PSD_Tcp_Header psdHeader;
    char szSendBuf[100] = 
    {
        0
    };
    BOOL flag;
    int nTimeOver;
    int Result;
    Result = WSAStartup(MAKEWORD(2, 1), &wsaData);
    if (Result == SOCKET_ERROR)
    {
        printf("WSAStartup failed with error %d\n", Result);
        return 0;
    }
    if ((SendSocket = WSASocket(AF_INET, SOCK_RAW, IPPROTO_RAW, NULL, 0, WSA_FLAG_OVERLAPPED)) == INVALID_SOCKET)
    {
        printf("WSASocket failed with error %d\n\n", WSAGetLastError());
        return false;
    }
    flag = true;
    if (setsockopt(SendSocket, IPPROTO_IP, IP_HDRINCL, (char*) &flag, sizeof(flag)) == SOCKET_ERROR)
    {
        printf("setsockopt failed with error %d\n\n", WSAGetLastError()); 
 
        return false;
    }
    nTimeOver = 1000;
    if (setsockopt(SendSocket, SOL_SOCKET, SO_SNDTIMEO, (char*) &nTimeOver, sizeof(nTimeOver)) == SOCKET_ERROR)
    {
        printf("setsockopt failed with error %d\n\n", WSAGetLastError());
        return false;
    }
    addr_in.sin_family = AF_INET;
    addr_in.sin_port = htons(1000);
    addr_in.sin_addr.S_un.S_addr = inet_addr(DestIpAddr);
    Result = gethostname(HostName, 255);
    if (Result == SOCKET_ERROR)
    {
        printf("gethostname failed with error %d\n", WSAGetLastError());
        return 0;
    }
    Hostent = (struct hostent*)malloc(sizeof(struct hostent));
    Hostent = gethostbyname(HostName);
    memcpy(&localaddr, Hostent->h_addr_list[0], Hostent->h_length);
    ipHeader.Version_HLen = (4 << 4 
[解决办法]
 sizeof(ipHeader) / sizeof(unsigned long));
    ipHeader.TOS = 0;
    ipHeader.Length = htons(sizeof(ipHeader) + sizeof(tcpHeader));
    ipHeader.Ident = 1;
    ipHeader.Flags_Offset = 0;
    ipHeader.TTL = 128;
    ipHeader.Protocol = IPPROTO_TCP;
    ipHeader.Checksum = 0;
    ipHeader.SourceAddr = localaddr.S_un.S_addr;
    ipHeader.DestinationAddr = inet_addr(DestIpAddr);
    for (int p = PortStart; p <= PortEnd; p++)
    {
        tcpHeader.DstPort = htons(p);
        tcpHeader.SrcPort = htons(6666);
        tcpHeader.SequenceNum = htonl(0x12345678);
        tcpHeader.Acknowledgment = 0;
        tcpHeader.HdrLen = (sizeof(tcpHeader) / 4 << 4 
[解决办法]
 0);
        tcpHeader.Flags = 1;
        tcpHeader.AdvertisedWindow = htons(512);
        tcpHeader.UrgPtr = 0;
        tcpHeader.Checksum = 0;
        psdHeader.saddr = ipHeader.SourceAddr;
        psdHeader.daddr = ipHeader.DestinationAddr;
        psdHeader.mbz = 0;
        psdHeader.ptcl = IPPROTO_TCP;
        psdHeader.tcpl = htons(sizeof(tcpHeader)); 
 
        memcpy(szSendBuf, &psdHeader, sizeof(psdHeader));
        memcpy(szSendBuf + sizeof(psdHeader), &tcpHeader, sizeof(tcpHeader));
        tcpHeader.Checksum = checksum((USHORT*)szSendBuf, sizeof(psdHeader) + sizeof(tcpHeader));
        memcpy(szSendBuf, &ipHeader, sizeof(ipHeader));
        memcpy(szSendBuf + sizeof(ipHeader), &tcpHeader, sizeof(tcpHeader));
        memset(szSendBuf + sizeof(ipHeader) + sizeof(tcpHeader), 0, 4);
        ipHeader.Checksum = checksum((USHORT*)szSendBuf, sizeof(ipHeader) + sizeof(tcpHeader));
        memcpy(szSendBuf, &ipHeader, sizeof(ipHeader));
        Result = sendto(SendSocket, szSendBuf, sizeof(ipHeader) + sizeof(tcpHeader), 0, (struct sockaddr*) &addr_in, sizeof(addr_in));
        if (Result == SOCKET_ERROR)
        {
            printf("gethostname failed with error %d\n", WSAGetLastError());
            return 0;
        } 
    }
    if (closesocket(SendSocket) == SOCKET_ERROR)
    {
        printf("closesocket failed with error %d\n", WSAGetLastError());
        return 0;
    }
    if (WSACleanup() == SOCKET_ERROR)
    {
        printf("WSACleanup failed with error %d\n", WSAGetLastError());
        return 0;
    }
    return 1;
}