You want to integrate amap functionality into your programs? Thats easy. WAY 1 ===== If you just want to use amap-lib like amap, just do a: include "amap-inc.h" #include "amap.h" #include "amap-lib.h" int main(int argc, char *argv[]) { amap_struct_options *opt; opt = amap_main_init(); // change opt->OPTION_VARABLE if you want to, e.g. via getopt() return amap_main(opt, argc, argv); } This results in the standard amap output to stdout/stderr. You can control the funcionality via the "opt" structure. Only two functions are necessary: amap_main_init() - returns a pointer to (amap_struct_options), which is the options structure, see amap.h This is required prior amap_main()! amap_main(opt, argc, argv) - opt contains the options, argc the number of variables in argv, and argv is a standard *argv[] structure, argv[0] may be NULL if opt->file_nmap is used, otherwise argv[0] has to be a hostname or ip address, and argv[1+] the ports, either single ports or ranges ("1-65535"). WAY 2 ===== Most people however may only want to include the identification part of amap into their tools. This is performed by these simple C lines: #include "amap-inc.h" #include "amap.h" #include "amap-lib.h" #define STR "HTTP/1.1 200 OK\r\nServer: Apache/1.3.25\r\n" void main() { amap_struct_responses *amap_resp; char **results; int i = 0; amap_resp = amap_lib_init(NULL); results = amap_lib_identify(STR, strlen(STR), 0, amap_resp); while (results[i] != NULL) printf("Results: %s\n", results[i++]); } Again, only two functions are necessary: amap_lib_init() - returns a pointer to (amap_struct_responses), which is the fingerprint database. You can change the default name of appdef.resp, by using "foo" instead of NULL, amap-lib looks then for "foo.resp". This is required prior amap_lib_identify()! amap_lib_identify(data, datalen, protocol, amap_struct_responses) - you hand over the data, it's length, and the protocol ('T' for TCP, 'U' for UDP or 0 for both) and the amap_struct_responses pointer from amap_lib_init(). You get a *result[] structure back which is NULL terminated. As a response can match several fingerprints, a single string response makes no sense. Questions? Need other interface options/features? Contact me! -> vh@thc.org