2 * KERNEL32 thunks and other undocumented stuff
4 * Copyright 1997-1998 Marcus Meissner
5 * Copyright 1998 Ulrich Weigand
17 #include "stackframe.h"
19 #include "selectors.h"
24 /***********************************************************************
26 * Win95 internal thunks *
28 ***********************************************************************/
30 /***********************************************************************
31 * Generates a FT_Prolog call.
33 * 0FB6D1 movzbl edx,cl
34 * 8B1495xxxxxxxx mov edx,[4*edx + targetTable]
35 * 68xxxxxxxx push FT_Prolog
38 static void _write_ftprolog(LPBYTE relayCode
,DWORD
*targetTable
) {
42 *x
++ = 0x0f;*x
++=0xb6;*x
++=0xd1; /* movzbl edx,cl */
43 *x
++ = 0x8B;*x
++=0x14;*x
++=0x95;*(DWORD
**)x
= targetTable
;
44 x
+=4; /* mov edx, [4*edx + targetTable] */
45 *x
++ = 0x68; *(DWORD
*)x
= (DWORD
)GetProcAddress32(GetModuleHandle32A("KERNEL32"),"FT_Prolog");
46 x
+=4; /* push FT_Prolog */
47 *x
++ = 0xC3; /* lret */
48 /* fill rest with 0xCC / int 3 */
51 /***********************************************************************
52 * _write_qtthunk (internal)
53 * Generates a QT_Thunk style call.
56 * 8A4DFC mov cl , [ebp-04]
57 * 8B148Dxxxxxxxx mov edx, [4*ecx + targetTable]
58 * B8yyyyyyyy mov eax, QT_Thunk
61 static void _write_qtthunk(
62 LPBYTE relayCode
, /* [in] start of QT_Thunk stub */
63 DWORD
*targetTable
/* [in] start of thunk (for index lookup) */
68 *x
++ = 0x33;*x
++=0xC9; /* xor ecx,ecx */
69 *x
++ = 0x8A;*x
++=0x4D;*x
++=0xFC; /* movb cl,[ebp-04] */
70 *x
++ = 0x8B;*x
++=0x14;*x
++=0x8D;*(DWORD
**)x
= targetTable
;
71 x
+=4; /* mov edx, [4*ecx + targetTable */
72 *x
++ = 0xB8; *(DWORD
*)x
= (DWORD
)GetProcAddress32(GetModuleHandle32A("KERNEL32"),"QT_Thunk");
73 x
+=4; /* mov eax , QT_Thunk */
74 *x
++ = 0xFF; *x
++ = 0xE0; /* jmp eax */
75 /* should fill the rest of the 32 bytes with 0xCC */
79 /***********************************************************************
80 * ThunkConnect data structures
83 struct ThunkDataCommon
85 char magic
[4]; /* 00 */
86 DWORD checksum
; /* 04 */
91 struct ThunkDataCommon common
; /* 00 */
92 SEGPTR targetTable
; /* 08 */
93 DWORD firstTime
; /* 0C */
98 struct ThunkDataCommon common
; /* 00 */
99 DWORD
* targetTable
; /* 08 */
100 char lateBinding
[4]; /* 0C */
101 DWORD flags
; /* 10 */
102 DWORD reserved1
; /* 14 */
103 DWORD reserved2
; /* 18 */
104 DWORD offsetQTThunk
; /* 1C */
105 DWORD offsetFTProlog
; /* 20 */
110 struct ThunkDataCommon common
; /* 00 */
111 DWORD flags1
; /* 08 */
112 DWORD reserved1
; /* 0C */
113 struct ThunkDataSL
* fpData
; /* 10 */
114 SEGPTR spData
; /* 14 */
115 DWORD reserved2
; /* 18 */
116 char lateBinding
[4]; /* 1C */
117 DWORD flags2
; /* 20 */
118 DWORD reserved3
; /* 20 */
119 SEGPTR apiDatabase
; /* 28 */
124 struct ThunkDataCommon common
; /* 00 */
125 DWORD reserved1
; /* 08 */
126 struct ThunkDataSL
* data
; /* 0C */
127 char lateBinding
[4]; /* 10 */
128 DWORD flags
; /* 14 */
129 DWORD reserved2
; /* 18 */
130 DWORD reserved3
; /* 1C */
131 DWORD offsetTargetTable
; /* 20 */
137 This structure differs from the Win95 original
,
138 but
this should
not matter since it is strictly internal to
139 the thunk handling routines in KRNL386
/ KERNEL32
.
141 For reference
, here is the Win95 layout
:
143 struct ThunkDataCommon common
; /* 00 */
144 DWORD flags1
; /* 08 */
145 SEGPTR apiDatabase
; /* 0C */
146 WORD exePtr
; /* 10 */
147 WORD segMBA
; /* 12 */
148 DWORD lenMBATotal
; /* 14 */
149 DWORD lenMBAUsed
; /* 18 */
150 DWORD flags2
; /* 1C */
151 char pszDll16
[256]; /* 20 */
152 char pszDll32
[256]; /*120 */
154 We
do it differently since all our thunk handling is done
155 by
32-bit code
. Therefore we
do not need
do provide
156 easy access to
this data
, especially the process target
157 table database
, for 16-bit code
.
160 struct ThunkDataCommon common
;
162 struct SLApiDB
* apiDB
;
163 struct SLTargetDB
* targetDB
;
171 struct SLTargetDB
* next
;
179 DWORD errorReturnValue
;
182 /***********************************************************************
183 * GetThunkStuff (KERNEL32.53)
185 LPVOID WINAPI
GetThunkStuff(LPSTR module
, LPSTR func
)
187 HMODULE32 hmod
= LoadLibrary16(module
);
188 if (hmod
<= 32) return 0;
190 return PTR_SEG_TO_LIN(WIN32_GetProcAddress16(hmod
, func
));
193 /***********************************************************************
194 * GetThunkBuff (KERNEL32.52)
195 * Returns a pointer to ThkBuf in the 16bit library SYSTHUNK.DLL.
197 LPVOID WINAPI
GetThunkBuff(void)
199 return GetThunkStuff("SYSTHUNK.DLL", "ThkBuf");
202 /***********************************************************************
203 * ThunkConnect32 (KERNEL32)
204 * Connects a 32bit and a 16bit thunkbuffer.
206 UINT32 WINAPI
ThunkConnect32(
207 struct ThunkDataCommon
*TD
, /* [in/out] thunkbuffer */
208 LPSTR thunkfun16
, /* [in] win16 thunkfunction */
209 LPSTR module16
, /* [in] name of win16 dll */
210 LPSTR module32
, /* [in] name of win32 dll */
211 HMODULE32 hmod32
, /* [in] hmodule of win32 dll */
212 DWORD dwReason
/* [in] initialisation argument */
216 if (!lstrncmp32A(TD
->magic
, "SL01", 4))
220 TRACE(thunk
, "SL01 thunk %s (%lx) <- %s (%s), Reason: %ld\n",
221 module32
, (DWORD
)TD
, module16
, thunkfun16
, dwReason
);
223 else if (!lstrncmp32A(TD
->magic
, "LS01", 4))
227 TRACE(thunk
, "LS01 thunk %s (%lx) -> %s (%s), Reason: %ld\n",
228 module32
, (DWORD
)TD
, module16
, thunkfun16
, dwReason
);
232 ERR(thunk
, "Invalid magic %c%c%c%c\n",
233 TD
->magic
[0], TD
->magic
[1], TD
->magic
[2], TD
->magic
[3]);
239 case DLL_PROCESS_ATTACH
:
241 struct ThunkDataCommon
*TD16
= GetThunkStuff(module16
, thunkfun16
);
242 if (!TD16
|| TD16
->checksum
!= TD
->checksum
243 || memcmp(TD16
->magic
, TD
->magic
, 4))
245 ERR(thunk
, "Problem loading 16-bit thunk buffer!\n");
251 struct ThunkDataSL32
*SL32
= (struct ThunkDataSL32
*)TD
;
252 struct ThunkDataSL16
*SL16
= (struct ThunkDataSL16
*)TD16
;
253 struct SLTargetDB
*tdb
;
255 if (SL16
->fpData
== NULL
)
257 ERR(thunk
, "ThunkConnect16 was not called!\n");
261 SL32
->data
= SL16
->fpData
;
263 tdb
= HeapAlloc(GetProcessHeap(), 0, sizeof(*tdb
));
264 tdb
->process
= PROCESS_Current();
265 tdb
->targetTable
= (DWORD
*)(thunkfun16
+ SL32
->offsetTargetTable
);
267 tdb
->next
= SL32
->data
->targetDB
; /* FIXME: not thread-safe! */
268 SL32
->data
->targetDB
= tdb
;
270 TRACE(thunk
, "Process %08lx allocated TargetDB entry for ThunkDataSL %08lx\n",
271 (DWORD
)PROCESS_Current(), (DWORD
)SL32
->data
);
275 struct ThunkDataLS32
*LS32
= (struct ThunkDataLS32
*)TD
;
276 struct ThunkDataLS16
*LS16
= (struct ThunkDataLS16
*)TD16
;
278 LS32
->targetTable
= PTR_SEG_TO_LIN(LS16
->targetTable
);
280 /* write QT_Thunk and FT_Prolog stubs */
281 _write_qtthunk ((LPBYTE
)TD
+ LS32
->offsetQTThunk
, LS32
->targetTable
);
282 _write_ftprolog((LPBYTE
)TD
+ LS32
->offsetFTProlog
, LS32
->targetTable
);
287 case DLL_PROCESS_DETACH
:
295 /***********************************************************************
296 * ThunkConnect16 (KERNEL.651)
297 * Connects a 32bit and a 16bit thunkbuffer.
299 UINT32 WINAPI
ThunkConnect16(
300 LPSTR module16
, /* [in] name of win16 dll */
301 LPSTR module32
, /* [in] name of win32 dll */
302 HINSTANCE16 hInst16
, /* [in] hInst of win16 dll */
303 DWORD dwReason
, /* [in] initialisation argument */
304 struct ThunkDataCommon
*TD
, /* [in/out] thunkbuffer */
305 LPSTR thunkfun32
, /* [in] win32 thunkfunction */
306 WORD CS
/* [in] CS of win16 dll */
310 if (!lstrncmp32A(TD
->magic
, "SL01", 4))
314 TRACE(thunk
, "SL01 thunk %s (%lx) -> %s (%s), Reason: %ld\n",
315 module16
, (DWORD
)TD
, module32
, thunkfun32
, dwReason
);
317 else if (!lstrncmp32A(TD
->magic
, "LS01", 4))
321 TRACE(thunk
, "LS01 thunk %s (%lx) <- %s (%s), Reason: %ld\n",
322 module16
, (DWORD
)TD
, module32
, thunkfun32
, dwReason
);
326 ERR(thunk
, "Invalid magic %c%c%c%c\n",
327 TD
->magic
[0], TD
->magic
[1], TD
->magic
[2], TD
->magic
[3]);
333 case DLL_PROCESS_ATTACH
:
336 struct ThunkDataSL16
*SL16
= (struct ThunkDataSL16
*)TD
;
337 struct ThunkDataSL
*SL
= SL16
->fpData
;
341 SL
= HeapAlloc(GetProcessHeap(), 0, sizeof(*SL
));
343 SL
->common
= SL16
->common
;
344 SL
->flags1
= SL16
->flags1
;
345 SL
->flags2
= SL16
->flags2
;
347 SL
->apiDB
= PTR_SEG_TO_LIN(SL16
->apiDatabase
);
350 lstrcpyn32A(SL
->pszDll16
, module16
, 255);
351 lstrcpyn32A(SL
->pszDll32
, module32
, 255);
353 /* We should create a SEGPTR to the ThunkDataSL,
354 but since the contents are not in the original format,
355 any access to this by 16-bit code would crash anyway. */
361 if (SL
->flags2
& 0x80000000)
363 TRACE(thunk
, "Preloading 32-bit library\n");
364 LoadLibrary32A(module32
);
373 case DLL_PROCESS_DETACH
:
382 /**********************************************************************
383 * QT_Thunk (KERNEL32)
385 * The target address is in EDX.
386 * The 16 bit arguments start at ESP+4.
387 * The number of 16bit argumentbytes is EBP-ESP-0x44 (68 Byte thunksetup).
390 VOID WINAPI
QT_Thunk(CONTEXT
*context
)
394 THDB
*thdb
= THREAD_Current();
396 memcpy(&context16
,context
,sizeof(context16
));
398 CS_reg(&context16
) = HIWORD(EDX_reg(context
));
399 IP_reg(&context16
) = LOWORD(EDX_reg(context
));
400 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
401 + (WORD
)&((STACK16FRAME
*)0)->bp
;
403 argsize
= EBP_reg(context
)-ESP_reg(context
)-0x44;
405 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
406 (LPBYTE
)ESP_reg(context
)+4, argsize
);
408 EAX_reg(context
) = Callbacks
->CallRegisterShortProc( &context16
, argsize
);
412 /**********************************************************************
413 * FT_Prolog (KERNEL32.233)
415 * The set of FT_... thunk routines is used instead of QT_Thunk,
416 * if structures have to be converted from 32-bit to 16-bit
417 * (change of member alignment, conversion of members).
419 * The thunk function (as created by the thunk compiler) calls
420 * FT_Prolog at the beginning, to set up a stack frame and
421 * allocate a 64 byte buffer on the stack.
422 * The input parameters (target address and some flags) are
423 * saved for later use by FT_Thunk.
425 * Input: EDX 16-bit target address (SEGPTR)
426 * CX bits 0..7 target number (in target table)
427 * bits 8..9 some flags (unclear???)
428 * bits 10..15 number of DWORD arguments
430 * Output: A new stackframe is created, and a 64 byte buffer
431 * allocated on the stack. The layout of the stack
432 * on return is as follows:
434 * (ebp+4) return address to caller of thunk function
436 * (ebp-4) saved EBX register of caller
437 * (ebp-8) saved ESI register of caller
438 * (ebp-12) saved EDI register of caller
439 * (ebp-16) saved ECX register, containing flags
440 * (ebp-20) bitmap containing parameters that are to be converted
441 * by FT_Thunk; it is initialized to 0 by FT_Prolog and
442 * filled in by the thunk code before calling FT_Thunk
446 * (ebp-48) saved EAX register of caller (unclear, never restored???)
447 * (ebp-52) saved EDX register, containing 16-bit thunk target
452 * ESP is EBP-68 on return.
456 #define POP_DWORD(ctx) (*((DWORD *)ESP_reg(ctx))++)
457 #define PUSH_DWORD(ctx, val) *--((DWORD *)ESP_reg(ctx)) = (val)
459 VOID WINAPI
FT_Prolog(CONTEXT
*context
)
461 /* Pop return address to thunk code */
462 EIP_reg(context
) = POP_DWORD(context
);
464 /* Build stack frame */
465 PUSH_DWORD(context
, EBP_reg(context
));
466 EBP_reg(context
) = ESP_reg(context
);
468 /* Allocate 64-byte Thunk Buffer */
469 ESP_reg(context
) -= 64;
470 memset((char *)ESP_reg(context
), '\0', 64);
472 /* Store Flags (ECX) and Target Address (EDX) */
473 /* Save other registers to be restored later */
474 *(DWORD
*)(EBP_reg(context
) - 4) = EBX_reg(context
);
475 *(DWORD
*)(EBP_reg(context
) - 8) = ESI_reg(context
);
476 *(DWORD
*)(EBP_reg(context
) - 12) = EDI_reg(context
);
477 *(DWORD
*)(EBP_reg(context
) - 16) = ECX_reg(context
);
479 *(DWORD
*)(EBP_reg(context
) - 48) = EAX_reg(context
);
480 *(DWORD
*)(EBP_reg(context
) - 52) = EDX_reg(context
);
482 /* Push return address back onto stack */
483 PUSH_DWORD(context
, EIP_reg(context
));
486 /**********************************************************************
487 * FT_Thunk (KERNEL32.234)
489 * This routine performs the actual call to 16-bit code,
490 * similar to QT_Thunk. The differences are:
491 * - The call target is taken from the buffer created by FT_Prolog
492 * - Those arguments requested by the thunk code (by setting the
493 * corresponding bit in the bitmap at EBP-20) are converted
494 * from 32-bit pointers to segmented pointers (those pointers
495 * are guaranteed to point to structures copied to the stack
496 * by the thunk code, so we always use the 16-bit stack selector
497 * for those addresses).
499 * The bit #i of EBP-20 corresponds here to the DWORD starting at
502 * FIXME: It is unclear what happens if there are more than 32 WORDs
503 * of arguments, so that the single DWORD bitmap is no longer
507 VOID WINAPI
FT_Thunk(CONTEXT
*context
)
509 DWORD mapESPrelative
= *(DWORD
*)(EBP_reg(context
) - 20);
510 DWORD callTarget
= *(DWORD
*)(EBP_reg(context
) - 52);
515 THDB
*thdb
= THREAD_Current();
517 memcpy(&context16
,context
,sizeof(context16
));
519 CS_reg(&context16
) = HIWORD(callTarget
);
520 IP_reg(&context16
) = LOWORD(callTarget
);
521 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
522 + (WORD
)&((STACK16FRAME
*)0)->bp
;
524 argsize
= EBP_reg(context
)-ESP_reg(context
)-0x44;
525 newstack
= ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
;
527 memcpy( newstack
, (LPBYTE
)ESP_reg(context
)+4, argsize
);
529 for (i
= 0; i
< 32; i
++) /* NOTE: What about > 32 arguments? */
530 if (mapESPrelative
& (1 << i
))
532 SEGPTR
*arg
= (SEGPTR
*)(newstack
+ 2*i
);
533 *arg
= PTR_SEG_OFF_TO_SEGPTR(SELECTOROF(thdb
->cur_stack
),
534 *(LPBYTE
*)arg
- newstack
);
537 EAX_reg(context
) = Callbacks
->CallRegisterShortProc( &context16
, argsize
);
540 /**********************************************************************
541 * FT_ExitNN (KERNEL32.218 - 232)
543 * One of the FT_ExitNN functions is called at the end of the thunk code.
544 * It removes the stack frame created by FT_Prolog, moves the function
545 * return from EBX to EAX (yes, FT_Thunk did use EAX for the return
546 * value, but the thunk code has moved it from EAX to EBX in the
547 * meantime ... :-), restores the caller's EBX, ESI, and EDI registers,
548 * and perform a return to the CALLER of the thunk code (while removing
549 * the given number of arguments from the caller's stack).
552 VOID WINAPI
FT_Exit(CONTEXT
*context
, int nPopArgs
)
554 /* Return value is in EBX */
555 EAX_reg(context
) = EBX_reg(context
);
557 /* Restore EBX, ESI, and EDI registers */
558 EBX_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 4);
559 ESI_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 8);
560 EDI_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 12);
562 /* Clean up stack frame */
563 ESP_reg(context
) = EBP_reg(context
);
564 EBP_reg(context
) = POP_DWORD(context
);
566 /* Pop return address to CALLER of thunk code */
567 EIP_reg(context
) = POP_DWORD(context
);
568 /* Remove arguments */
569 ESP_reg(context
) += nPopArgs
;
570 /* Push return address back onto stack */
571 PUSH_DWORD(context
, EIP_reg(context
));
574 VOID WINAPI
FT_Exit0 (CONTEXT
*context
) { FT_Exit(context
, 0); }
575 VOID WINAPI
FT_Exit4 (CONTEXT
*context
) { FT_Exit(context
, 4); }
576 VOID WINAPI
FT_Exit8 (CONTEXT
*context
) { FT_Exit(context
, 8); }
577 VOID WINAPI
FT_Exit12(CONTEXT
*context
) { FT_Exit(context
, 12); }
578 VOID WINAPI
FT_Exit16(CONTEXT
*context
) { FT_Exit(context
, 16); }
579 VOID WINAPI
FT_Exit20(CONTEXT
*context
) { FT_Exit(context
, 20); }
580 VOID WINAPI
FT_Exit24(CONTEXT
*context
) { FT_Exit(context
, 24); }
581 VOID WINAPI
FT_Exit28(CONTEXT
*context
) { FT_Exit(context
, 28); }
582 VOID WINAPI
FT_Exit32(CONTEXT
*context
) { FT_Exit(context
, 32); }
583 VOID WINAPI
FT_Exit36(CONTEXT
*context
) { FT_Exit(context
, 36); }
584 VOID WINAPI
FT_Exit40(CONTEXT
*context
) { FT_Exit(context
, 40); }
585 VOID WINAPI
FT_Exit44(CONTEXT
*context
) { FT_Exit(context
, 44); }
586 VOID WINAPI
FT_Exit48(CONTEXT
*context
) { FT_Exit(context
, 48); }
587 VOID WINAPI
FT_Exit52(CONTEXT
*context
) { FT_Exit(context
, 52); }
588 VOID WINAPI
FT_Exit56(CONTEXT
*context
) { FT_Exit(context
, 56); }
591 /**********************************************************************
592 * WOWCallback16 (KERNEL32.62)(WOW32.2)
593 * Calls a win16 function with a single DWORD argument.
597 DWORD WINAPI
WOWCallback16(
598 FARPROC16 fproc
, /* [in] win16 function to call */
599 DWORD arg
/* [in] single DWORD argument to function */
602 TRACE(thunk
,"(%p,0x%08lx)...\n",fproc
,arg
);
603 ret
= Callbacks
->CallWOWCallbackProc(fproc
,arg
);
604 TRACE(thunk
,"... returns %ld\n",ret
);
608 /**********************************************************************
609 * WOWCallback16Ex (KERNEL32.55)(WOW32.3)
610 * Calls a function in 16bit code.
614 BOOL32 WINAPI
WOWCallback16Ex(
615 FARPROC16 vpfn16
, /* [in] win16 function to call */
616 DWORD dwFlags
, /* [in] flags */
617 DWORD cbArgs
, /* [in] nr of arguments */
618 LPVOID pArgs
, /* [in] pointer to arguments (LPDWORD) */
619 LPDWORD pdwRetCode
/* [out] return value of win16 function */
621 return Callbacks
->CallWOWCallback16Ex(vpfn16
,dwFlags
,cbArgs
,pArgs
,pdwRetCode
);
624 /***********************************************************************
625 * ThunkInitLS (KERNEL32.43)
626 * A thunkbuffer link routine
627 * The thunkbuf looks like:
629 * 00: DWORD length ? don't know exactly
630 * 04: SEGPTR ptr ? where does it point to?
631 * The pointer ptr is written into the first DWORD of 'thunk'.
632 * (probably correct implemented)
635 * segmented pointer to thunk?
637 DWORD WINAPI
ThunkInitLS(
638 LPDWORD thunk
, /* [in] win32 thunk */
639 LPCSTR thkbuf
, /* [in] thkbuffer name in win16 dll */
640 DWORD len
, /* [in] thkbuffer length */
641 LPCSTR dll16
, /* [in] name of win16 dll */
642 LPCSTR dll32
/* [in] name of win32 dll (FIXME: not used?) */
648 hmod
= LoadLibrary16(dll16
);
650 WARN(thunk
,"failed to load 16bit DLL %s, error %d\n",
654 segaddr
= (DWORD
)WIN32_GetProcAddress16(hmod
,(LPSTR
)thkbuf
);
656 WARN(thunk
,"no %s exported from %s!\n",thkbuf
,dll16
);
659 addr
= (LPDWORD
)PTR_SEG_TO_LIN(segaddr
);
660 if (addr
[0] != len
) {
661 WARN(thunk
,"thkbuf length mismatch? %ld vs %ld\n",len
,addr
[0]);
666 *(DWORD
*)thunk
= addr
[1];
668 TRACE(thunk
, "loaded module %d, func %s (%d) @ %p (%p), returning %p\n",
669 hmod
, HIWORD(thkbuf
)==0 ? "<ordinal>" : thkbuf
, (int)thkbuf
,
670 (void*)segaddr
, addr
, (void*)addr
[1]);
675 /***********************************************************************
676 * Common32ThkLS (KERNEL32.45)
678 * This is another 32->16 thunk, independent of the QT_Thunk/FT_Thunk
679 * style thunks. The basic difference is that the parameter conversion
680 * is done completely on the *16-bit* side here. Thus we do not call
681 * the 16-bit target directly, but call a common entry point instead.
682 * This entry function then calls the target according to the target
683 * number passed in the DI register.
685 * Input: EAX SEGPTR to the common 16-bit entry point
686 * CX offset in thunk table (target number * 4)
687 * DX error return value if execution fails (unclear???)
688 * EDX.HI number of DWORD parameters
690 * (Note that we need to move the thunk table offset from CX to DI !)
692 * The called 16-bit stub expects its stack to look like this:
694 * (esp+40) 32-bit arguments
696 * (esp+8) 32 byte of stack space available as buffer
697 * (esp) 8 byte return address for use with 0x66 lret
699 * The called 16-bit stub uses a 0x66 lret to return to 32-bit code,
700 * and uses the EAX register to return a DWORD return value.
701 * Thus we need to use a special assembly glue routine
702 * (CallRegisterLongProc instead of CallRegisterShortProc).
704 * Finally, we return to the caller, popping the arguments off
707 * FIXME: The called function uses EBX to return the number of
708 * arguments that are to be popped off the caller's stack.
709 * This is clobbered by the assembly glue, so we simply use
710 * the original EDX.HI to get the number of arguments.
711 * (Those two values should be equal anyway ...?)
714 VOID WINAPI
Common32ThkLS(CONTEXT
*context
)
718 THDB
*thdb
= THREAD_Current();
720 memcpy(&context16
,context
,sizeof(context16
));
722 DI_reg(&context16
) = CX_reg(context
);
723 CS_reg(&context16
) = HIWORD(EAX_reg(context
));
724 IP_reg(&context16
) = LOWORD(EAX_reg(context
));
725 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
726 + (WORD
)&((STACK16FRAME
*)0)->bp
;
728 argsize
= HIWORD(EDX_reg(context
)) * 4;
730 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
731 (LPBYTE
)ESP_reg(context
)+4, argsize
);
733 EAX_reg(context
) = Callbacks
->CallRegisterLongProc(&context16
, argsize
+ 32);
735 /* Clean up caller's stack frame */
737 EIP_reg(context
) = POP_DWORD(context
);
738 ESP_reg(context
) += argsize
;
739 PUSH_DWORD(context
, EIP_reg(context
));
742 /***********************************************************************
743 * OT_32ThkLSF (KERNEL32.40)
745 * YET Another 32->16 thunk. The difference to Common32ThkLS is that
746 * argument processing is done on both the 32-bit and the 16-bit side:
747 * The 32-bit side prepares arguments, copying them onto the stack.
749 * When this routine is called, the first word on the stack is the
750 * number of argument bytes prepared by the 32-bit code, and EDX
751 * contains the 16-bit target address.
753 * The called 16-bit routine is another relaycode, doing further
754 * argument processing and then calling the real 16-bit target
755 * whose address is stored at [bp-04].
757 * The call proceeds using a normal CallRegisterShortProc.
758 * After return from the 16-bit relaycode, the arguments need
759 * to be copied *back* to the 32-bit stack, since the 32-bit
760 * relaycode processes output parameters.
762 * Note that we copy twice the number of arguments, since some of the
763 * 16-bit relaycodes in SYSTHUNK.DLL directly access the original
764 * arguments of the caller!
766 * (Note that this function seems only to be used for
767 * OLECLI32 -> OLECLI and OLESVR32 -> OLESVR thunking.)
769 VOID WINAPI
OT_32ThkLSF(CONTEXT
*context
)
773 THDB
*thdb
= THREAD_Current();
775 memcpy(&context16
,context
,sizeof(context16
));
777 CS_reg(&context16
) = HIWORD(EDX_reg(context
));
778 IP_reg(&context16
) = LOWORD(EDX_reg(context
));
779 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
780 + (WORD
)&((STACK16FRAME
*)0)->bp
;
782 argsize
= 2 * *(WORD
*)(ESP_reg(context
) + 4) + 2;
784 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
785 (LPBYTE
)ESP_reg(context
)+4, argsize
);
787 EAX_reg(context
) = Callbacks
->CallRegisterShortProc(&context16
, argsize
);
789 memcpy( (LPBYTE
)ESP_reg(context
)+4,
790 ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
, argsize
);
793 /***********************************************************************
794 * ThunkInitLSF (KERNEL32.41)
795 * A thunk setup routine.
796 * Expects a pointer to a preinitialized thunkbuffer in the first argument
798 * 00..03: unknown (pointer, check _41, _43, _46)
801 * 06..23: unknown (space for replacement code, check .90)
803 * 24:>E800000000 call offset 29
804 * 29:>58 pop eax ( target of call )
805 * 2A: 2D25000000 sub eax,0x00000025 ( now points to offset 4 )
806 * 2F: BAxxxxxxxx mov edx,xxxxxxxx
807 * 34: 68yyyyyyyy push KERNEL32.90
811 * 3E ... 59: unknown (space for replacement code?)
812 * 5A: E8xxxxxxxx call <32bitoffset xxxxxxxx>
814 * 60: 81EA25xxxxxx sub edx, 0x25xxxxxx
816 * 67: 68xxxxxxxx push xxxxxxxx
817 * 6C: 68yyyyyyyy push KERNEL32.89
820 * This function checks if the code is there, and replaces the yyyyyyyy entries
821 * by the functionpointers.
822 * The thunkbuf looks like:
824 * 00: DWORD length ? don't know exactly
825 * 04: SEGPTR ptr ? where does it point to?
826 * The segpointer ptr is written into the first DWORD of 'thunk'.
829 * unclear, pointer to win16 thkbuffer?
831 LPVOID WINAPI
ThunkInitLSF(
832 LPBYTE thunk
, /* [in] win32 thunk */
833 LPCSTR thkbuf
, /* [in] thkbuffer name in win16 dll */
834 DWORD len
, /* [in] length of thkbuffer */
835 LPCSTR dll16
, /* [in] name of win16 dll */
836 LPCSTR dll32
/* [in] name of win32 dll */
838 HMODULE32 hkrnl32
= GetModuleHandle32A("KERNEL32");
843 /* FIXME: add checks for valid code ... */
844 /* write pointers to kernel32.89 and kernel32.90 (+ordinal base of 1) */
845 *(DWORD
*)(thunk
+0x35) = (DWORD
)GetProcAddress32(hkrnl32
,(LPSTR
)90);
846 *(DWORD
*)(thunk
+0x6D) = (DWORD
)GetProcAddress32(hkrnl32
,(LPSTR
)89);
849 hmod
= LoadLibrary16(dll16
);
851 ERR(thunk
,"failed to load 16bit DLL %s, error %d\n",
855 segaddr
= (DWORD
)WIN32_GetProcAddress16(hmod
,(LPSTR
)thkbuf
);
857 ERR(thunk
,"no %s exported from %s!\n",thkbuf
,dll16
);
860 addr
= (LPDWORD
)PTR_SEG_TO_LIN(segaddr
);
861 if (addr
[0] != len
) {
862 ERR(thunk
,"thkbuf length mismatch? %ld vs %ld\n",len
,addr
[0]);
865 addr2
= PTR_SEG_TO_LIN(addr
[1]);
867 *(DWORD
*)thunk
= (DWORD
)addr2
;
869 TRACE(thunk
, "loaded module %d, func %s(%d) @ %p (%p), returning %p\n",
870 hmod
, HIWORD(thkbuf
)==0 ? "<ordinal>" : thkbuf
, (int)thkbuf
,
871 (void*)segaddr
, addr
, addr2
);
876 /***********************************************************************
877 * FT_PrologPrime (KERNEL32.89)
879 * This function is called from the relay code installed by
880 * ThunkInitLSF. It replaces the location from where it was
881 * called by a standard FT_Prolog call stub (which is 'primed'
882 * by inserting the correct target table pointer).
883 * Finally, it calls that stub.
885 * Input: ECX target number + flags (passed through to FT_Prolog)
886 * (ESP) offset of location where target table pointer
887 * is stored, relative to the start of the relay code
888 * (ESP+4) pointer to start of relay code
889 * (this is where the FT_Prolog call stub gets written to)
891 * Note: The two DWORD arguments get popped from the stack.
894 VOID WINAPI
FT_PrologPrime(CONTEXT
*context
)
896 DWORD targetTableOffset
= POP_DWORD(context
);
897 LPBYTE relayCode
= (LPBYTE
)POP_DWORD(context
);
898 DWORD
*targetTable
= *(DWORD
**)(relayCode
+targetTableOffset
);
899 DWORD targetNr
= LOBYTE(ECX_reg(context
));
901 _write_ftprolog(relayCode
, targetTable
);
903 /* We should actually call the relay code now, */
904 /* but we skip it and go directly to FT_Prolog */
905 EDX_reg(context
) = targetTable
[targetNr
];
909 /***********************************************************************
910 * QT_ThunkPrime (KERNEL32.90)
912 * This function corresponds to FT_PrologPrime, but installs a
913 * call stub for QT_Thunk instead.
915 * Input: (EBP-4) target number (passed through to QT_Thunk)
916 * EDX target table pointer location offset
917 * EAX start of relay code
920 VOID WINAPI
QT_ThunkPrime(CONTEXT
*context
)
922 DWORD targetTableOffset
= EDX_reg(context
);
923 LPBYTE relayCode
= (LPBYTE
)EAX_reg(context
);
924 DWORD
*targetTable
= *(DWORD
**)(relayCode
+targetTableOffset
);
925 DWORD targetNr
= LOBYTE(*(DWORD
*)(EBP_reg(context
) - 4));
927 _write_qtthunk(relayCode
, targetTable
);
929 /* We should actually call the relay code now, */
930 /* but we skip it and go directly to QT_Thunk */
931 EDX_reg(context
) = targetTable
[targetNr
];
935 /***********************************************************************
937 * Another thunkbuf link routine.
938 * The start of the thunkbuf looks like this:
940 * 04: SEGPTR address for thunkbuffer pointer
943 VOID WINAPI
ThunkInitSL(
944 LPBYTE thunk
, /* [in] start of thunkbuffer */
945 LPCSTR thkbuf
, /* [in] name/ordinal of thunkbuffer in win16 dll */
946 DWORD len
, /* [in] length of thunkbuffer */
947 LPCSTR dll16
, /* [in] name of win16 dll containing the thkbuf */
948 LPCSTR dll32
/* [in] win32 dll. FIXME: strange, unused */
954 hmod
= LoadLibrary16(dll16
);
956 ERR(thunk
,"couldn't load %s, error %d\n",dll16
,hmod
);
959 segaddr
= (SEGPTR
)WIN32_GetProcAddress16(hmod
,(LPSTR
)thkbuf
);
961 ERR(thunk
,"haven't found %s in %s!\n",thkbuf
,dll16
);
964 addr
= (LPDWORD
)PTR_SEG_TO_LIN(segaddr
);
965 if (addr
[0] != len
) {
966 ERR(thunk
,"length of thkbuf differs from expected length! "
967 "(%ld vs %ld)\n",addr
[0],len
);
970 *(DWORD
*)PTR_SEG_TO_LIN(addr
[1]) = (DWORD
)thunk
;
972 TRACE(thunk
, "loaded module %d, func %s(%d) @ %p (%p)\n",
973 hmod
, HIWORD(thkbuf
)==0 ? "<ordinal>" : thkbuf
,
974 (int)thkbuf
, (void*)segaddr
, addr
);
977 /**********************************************************************
978 * SSOnBigStack KERNEL32.87
979 * Check if thunking is initialized (ss selector set up etc.)
980 * We do that differently, so just return TRUE.
985 BOOL32 WINAPI
SSOnBigStack()
987 TRACE(thunk
, "Yes, thunking is initialized\n");
991 /**********************************************************************
993 * One of the real thunking functions. This one seems to be for 32<->32
994 * thunks. It should probably be capable of crossing processboundaries.
996 * And YES, I've seen nr=48 (somewhere in the Win95 32<->16 OLE coupling)
999 DWORD WINAPIV
SSCall(
1000 DWORD nr
, /* [in] number of argument bytes */
1001 DWORD flags
, /* [in] FIXME: flags ? */
1002 FARPROC32 fun
, /* [in] function to call */
1003 ... /* [in/out] arguments */
1006 DWORD
*args
= ((DWORD
*)&fun
) + 1;
1008 if(TRACE_ON(thunk
)){
1009 dbg_decl_str(thunk
, 256);
1010 for (i
=0;i
<nr
/4;i
++)
1011 dsprintf(thunk
,"0x%08lx,",args
[i
]);
1012 TRACE(thunk
,"(%ld,0x%08lx,%p,[%s])\n",
1013 nr
,flags
,fun
,dbg_str(thunk
));
1016 case 0: ret
= fun();
1018 case 4: ret
= fun(args
[0]);
1020 case 8: ret
= fun(args
[0],args
[1]);
1022 case 12: ret
= fun(args
[0],args
[1],args
[2]);
1024 case 16: ret
= fun(args
[0],args
[1],args
[2],args
[3]);
1026 case 20: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4]);
1028 case 24: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5]);
1030 case 28: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6]);
1032 case 32: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7]);
1034 case 36: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8]);
1036 case 40: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9]);
1038 case 44: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9],args
[10]);
1040 case 48: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9],args
[10],args
[11]);
1043 fprintf(stderr
,"_KERNEL32_88: unsupported nr of arguments, %ld\n",nr
);
1048 TRACE(thunk
," returning %ld ...\n",ret
);
1052 /**********************************************************************
1053 * KERNEL_619 (KERNEL)
1054 * Seems to store y and z depending on x in some internal lists...
1056 WORD WINAPI
_KERNEL_619(WORD x
,DWORD y
,DWORD z
)
1058 fprintf(stderr
,"KERNEL_619(0x%04x,0x%08lx,0x%08lx)\n",x
,y
,z
);
1062 /**********************************************************************
1063 * KERNEL_607 (KERNEL)
1065 LPVOID WINAPI
_KERNEL_607(SEGPTR target
, LPVOID relay
, DWORD dummy
)
1067 TDB
*pTask
= (TDB
*)GlobalLock16(GetCurrentTask());
1068 LPBYTE thunk
= HeapAlloc( GetProcessHeap(), 0, 22 ), x
= thunk
;
1070 *x
++=0x90; *x
++=0x68; *((DWORD
*)x
)++=(DWORD
)relay
; /* nop; pushl relay */
1071 *x
++=0x90; *x
++=0x68; *((DWORD
*)x
)++=(DWORD
)target
; /* nop; pushl target */
1072 *x
++=0x90; *x
++=0x58; /* nop; popl eax */
1073 *x
++=0xC3; /* ret */
1074 *x
++=0xCC; *x
++=0xCC;
1075 *x
++=0x01; /* type: LS */
1076 *((WORD
*)x
)++ = pTask
->hInstance
; /* owner */
1077 *((WORD
*)x
)++ = 0; /* next */
1082 /**********************************************************************
1083 * KERNEL_608 (KERNEL)
1085 SEGPTR WINAPI
_KERNEL_608(LPVOID target
, SEGPTR relay
, DWORD dummy
)
1087 TDB
*pTask
= (TDB
*)GlobalLock16(GetCurrentTask());
1088 LPBYTE thunk
= HeapAlloc( GetProcessHeap(), 0, 22 ), x
= thunk
;
1091 *x
++=0x66; *x
++=0x68; *((DWORD
*)x
)++=(DWORD
)relay
; /* pushl relay */
1092 *x
++=0x66; *x
++=0x68; *((DWORD
*)x
)++=(DWORD
)target
; /* pushl target */
1093 *x
++=0x66; *x
++=0x58; /* popl eax */
1094 *x
++=0xCB; /* ret */
1095 *x
++=0xCC; *x
++=0xCC;
1096 *x
++=0x02; /* type: SL */
1097 *((WORD
*)x
)++ = pTask
->hInstance
; /* owner */
1098 *((WORD
*)x
)++ = 0; /* next */
1100 sel
= SELECTOR_AllocBlock( thunk
, 22, SEGMENT_CODE
, FALSE
, FALSE
);
1101 return PTR_SEG_OFF_TO_SEGPTR( sel
, 0 );
1104 /**********************************************************************
1105 * KERNEL_611 (KERNEL)
1107 VOID WINAPI
_KERNEL_611(DWORD relay
, DWORD target
)
1111 /**********************************************************************
1112 * AllocSLCallback (KERNEL32)
1114 * Win95 uses some structchains for callbacks. It allocates them
1115 * in blocks of 100 entries, size 32 bytes each, layout:
1117 * 0: PTR nextblockstart
1119 * 8: WORD sel ( start points to blockstart)
1123 * 18: PDB *owning_process;
1124 * 1C: PTR blockstart
1126 * We ignore this for now. (Just a note for further developers)
1127 * FIXME: use this method, so we don't waste selectors...
1129 * Following code is then generated by AllocSLCallback. The code is 16 bit, so
1130 * the 0x66 prefix switches from word->long registers.
1133 * 6668x arg2 x pushl <arg2>
1135 * EAx arg1 x jmpf <arg1>
1137 * returns the startaddress of this thunk.
1139 * Note, that they look very similair to the ones allocates by THUNK_Alloc.
1141 * segmented pointer to the start of the thunk
1145 DWORD finalizer
, /* [in] finalizer function */
1146 DWORD callback
/* [in] callback function */
1148 LPBYTE x
,thunk
= HeapAlloc( GetProcessHeap(), 0, 32 );
1152 *x
++=0x66;*x
++=0x5a; /* popl edx */
1153 *x
++=0x66;*x
++=0x68;*(DWORD
*)x
=finalizer
;x
+=4; /* pushl finalizer */
1154 *x
++=0x66;*x
++=0x52; /* pushl edx */
1155 *x
++=0xea;*(DWORD
*)x
=callback
;x
+=4; /* jmpf callback */
1157 *(PDB32
**)(thunk
+18) = PROCESS_Current();
1159 sel
= SELECTOR_AllocBlock( thunk
, 32, SEGMENT_CODE
, FALSE
, FALSE
);
1163 /**********************************************************************
1164 * FreeSLCallback (KERNEL32.274)
1165 * Frees the specified 16->32 callback
1169 DWORD x
/* [in] 16 bit callback (segmented pointer?) */
1171 fprintf(stderr
,"FreeSLCallback(0x%08lx)\n",x
);
1175 /**********************************************************************
1176 * KERNEL_471 (KERNEL.471)
1178 * Seems to return the uncrypted current process pointer. [Not 100% sure].
1182 return PROCESS_Current();
1185 /**********************************************************************
1186 * KERNEL_472 (KERNEL.472)
1187 * something like GetCurrenthInstance.
1192 _KERNEL_472(CONTEXT
*context
) {
1193 fprintf(stderr
,"_KERNEL_472(0x%08lx),stub\n",EAX_reg(context
));
1194 if (!EAX_reg(context
)) {
1195 TDB
*pTask
= (TDB
*)GlobalLock16(GetCurrentTask());
1196 AX_reg(context
)=pTask
->hInstance
;
1199 if (!HIWORD(EAX_reg(context
)))
1200 return; /* returns the passed value */
1204 /**********************************************************************
1205 * KERNEL_431 (KERNEL.431)
1206 * IsPeFormat (W32SYS.2)
1207 * Checks the passed filename if it is a PE format executeable
1212 BOOL16 WINAPI
IsPeFormat(
1213 LPSTR fn
, /* [in] filename to executeable */
1214 HFILE16 hf16
/* [in] open file, if filename is NULL */
1216 IMAGE_DOS_HEADER mzh
;
1222 hf
= OpenFile32(fn
,&ofs
,OF_READ
);
1223 if (hf
==HFILE_ERROR32
)
1226 _llseek32(hf
,0,SEEK_SET
);
1227 if (sizeof(mzh
)!=_lread32(hf
,&mzh
,sizeof(mzh
))) {
1231 if (mzh
.e_magic
!=IMAGE_DOS_SIGNATURE
) {
1232 fprintf(stderr
,"file has not got dos signature!\n");
1236 _llseek32(hf
,mzh
.e_lfanew
,SEEK_SET
);
1237 if (sizeof(DWORD
)!=_lread32(hf
,&xmagic
,sizeof(DWORD
))) {
1242 return (xmagic
== IMAGE_NT_SIGNATURE
);
1245 /***********************************************************************
1246 * WOWHandle32 (KERNEL32.57)(WOW32.16)
1247 * Converts a win16 handle of type into the respective win32 handle.
1248 * We currently just return this handle, since most handles are the same
1249 * for win16 and win32.
1253 HANDLE32 WINAPI
WOWHandle32(
1254 WORD handle
, /* [in] win16 handle */
1255 WOW_HANDLE_TYPE type
/* [in] handle type */
1257 fprintf(stderr
,"WOWHandle32(0x%04x,%d)\n",handle
,type
);
1258 return (HANDLE32
)handle
;
1261 /***********************************************************************
1262 * C16ThkSL (KERNEL.630)
1265 void WINAPI
C16ThkSL(CONTEXT
*context
)
1267 extern void CallFrom16_t_long_(void);
1268 LPBYTE stub
= PTR_SEG_TO_LIN(EAX_reg(context
)), x
= stub
;
1273 /* We produce the following code:
1278 * mov edx, es:[ecx + $EDX]
1281 * call __FLATCS:CallFrom16_t_long_
1284 *x
++ = 0xB8; *((WORD
*)x
)++ = ds
;
1285 *x
++ = 0x8E; *x
++ = 0xC0;
1286 *x
++ = 0x60; *x
++ = 0x0F; *x
++ = 0xB7; *x
++ = 0xC9;
1287 *x
++ = 0x67; *x
++ = 0x66; *x
++ = 0x26; *x
++ = 0x8B;
1288 *x
++ = 0x91; *((DWORD
*)x
)++ = EDX_reg(context
);
1291 *x
++ = 0x66; *x
++ = 0x52;
1292 *x
++ = 0x66; *x
++ = 0x9A; *((DWORD
*)x
)++ = (DWORD
)CallFrom16_t_long_
;
1293 *((WORD
*)x
)++ = cs
;
1295 /* Jump to the stub code just created */
1296 IP_reg(context
) = LOWORD(EAX_reg(context
));
1297 CS_reg(context
) = HIWORD(EAX_reg(context
));
1299 /* Since C16ThkSL got called by a jmp, we need to leave the
1300 orginal return address on the stack */
1301 SP_reg(context
) -= 4;
1304 /***********************************************************************
1305 * C16ThkSL01 (KERNEL.631)
1308 void WINAPI
C16ThkSL01(CONTEXT
*context
)
1310 LPBYTE stub
= PTR_SEG_TO_LIN(EAX_reg(context
)), x
= stub
;
1314 struct ThunkDataSL16
*SL16
= PTR_SEG_TO_LIN(EDX_reg(context
));
1315 struct ThunkDataSL
*td
= SL16
->fpData
;
1317 extern void CallFrom16_t_long_(void);
1318 DWORD procAddress
= (DWORD
)GetProcAddress16(GetModuleHandle16("KERNEL"), 631);
1324 ERR(thunk
, "ThunkConnect16 was not called!\n");
1328 TRACE(thunk
, "Creating stub for ThunkDataSL %08lx\n", (DWORD
)td
);
1331 /* We produce the following code:
1338 * call __FLATCS:CallFrom16_t_long_
1341 *x
++ = 0x66; *x
++ = 0x33; *x
++ = 0xC0;
1342 *x
++ = 0x66; *x
++ = 0xBA; *((DWORD
*)x
)++ = (DWORD
)td
;
1343 *x
++ = 0x9A; *((DWORD
*)x
)++ = procAddress
;
1346 *x
++ = 0x66; *x
++ = 0x52;
1347 *x
++ = 0x66; *x
++ = 0x9A; *((DWORD
*)x
)++ = (DWORD
)CallFrom16_t_long_
;
1348 *((WORD
*)x
)++ = cs
;
1350 /* Jump to the stub code just created */
1351 IP_reg(context
) = LOWORD(EAX_reg(context
));
1352 CS_reg(context
) = HIWORD(EAX_reg(context
));
1354 /* Since C16ThkSL01 got called by a jmp, we need to leave the
1355 orginal return address on the stack */
1356 SP_reg(context
) -= 4;
1360 struct ThunkDataSL
*td
= (struct ThunkDataSL
*)EDX_reg(context
);
1361 DWORD targetNr
= CX_reg(context
) / 4;
1362 struct SLTargetDB
*tdb
;
1364 TRACE(thunk
, "Process %08lx calling target %ld of ThunkDataSL %08lx\n",
1365 (DWORD
)PROCESS_Current(), targetNr
, (DWORD
)td
);
1367 for (tdb
= td
->targetDB
; tdb
; tdb
= tdb
->next
)
1368 if (tdb
->process
== PROCESS_Current())
1373 TRACE(thunk
, "Loading 32-bit library %s\n", td
->pszDll32
);
1374 LoadLibrary32A(td
->pszDll32
);
1376 for (tdb
= td
->targetDB
; tdb
; tdb
= tdb
->next
)
1377 if (tdb
->process
== PROCESS_Current())
1383 EDX_reg(context
) = tdb
->targetTable
[targetNr
];
1385 TRACE(thunk
, "Call target is %08lx\n", EDX_reg(context
));
1389 WORD
*stack
= PTR_SEG_OFF_TO_LIN(SS_reg(context
), SP_reg(context
));
1390 DX_reg(context
) = HIWORD(td
->apiDB
[targetNr
].errorReturnValue
);
1391 AX_reg(context
) = LOWORD(td
->apiDB
[targetNr
].errorReturnValue
);
1392 IP_reg(context
) = stack
[2];
1393 CS_reg(context
) = stack
[3];
1394 SP_reg(context
) += td
->apiDB
[targetNr
].nrArgBytes
+ 4;
1396 /* Win95 allows delayed loading of the 32-bit DLL.
1397 We don't do that at the moment. */
1398 ERR(thunk
, "Process %08lx did not ThunkConnect32 %s to %s\n",
1399 (DWORD
)PROCESS_Current(), td
->pszDll32
, td
->pszDll16
);
1405 /***********************************************************************
1406 * K32Thk1632Prolog (KERNEL32.492)
1408 VOID WINAPI
K32Thk1632Prolog(CONTEXT
*context
)
1410 LPBYTE code
= (LPBYTE
)EIP_reg(context
) - 5;
1412 /* Arrrgh! SYSTHUNK.DLL just has to re-implement another method
1413 of 16->32 thunks instead of using one of the standard methods!
1414 This means that SYSTHUNK.DLL itself switches to a 32-bit stack,
1415 and does a far call to the 32-bit code segment of OLECLI32/OLESVR32.
1416 Unfortunately, our CallTo/CallFrom mechanism is therefore completely
1417 bypassed, which means it will crash the next time the 32-bit OLE
1418 code thunks down again to 16-bit (this *will* happen!).
1420 The following hack tries to recognize this situation.
1421 This is possible since the called stubs in OLECLI32/OLESVR32 all
1422 look exactly the same:
1423 00 E8xxxxxxxx call K32Thk1632Prolog
1424 05 FF55FC call [ebp-04]
1425 08 E8xxxxxxxx call K32Thk1632Epilog
1428 If we recognize this situation, we try to simulate the actions
1429 of our CallTo/CallFrom mechanism by copying the 16-bit stack
1430 to our 32-bit stack, creating a proper STACK16FRAME and
1431 updating thdb->cur_stack. */
1433 if ( code
[5] == 0xFF && code
[6] == 0x55 && code
[7] == 0xFC
1434 && code
[13] == 0x66 && code
[14] == 0xCB)
1436 WORD stackSel
= NtCurrentTeb()->stack_sel
;
1437 DWORD stackBase
= GetSelectorBase(stackSel
);
1439 THDB
*thdb
= THREAD_Current();
1440 DWORD argSize
= EBP_reg(context
) - ESP_reg(context
);
1441 char *stack16
= (char *)ESP_reg(context
);
1442 char *stack32
= (char *)thdb
->cur_stack
- argSize
;
1443 STACK16FRAME
*frame16
= (STACK16FRAME
*)stack16
- 1;
1445 TRACE(thunk
, "before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1446 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1448 memset(frame16
, '\0', sizeof(STACK16FRAME
));
1449 frame16
->frame32
= (STACK32FRAME
*)thdb
->cur_stack
;
1450 frame16
->ebp
= EBP_reg(context
);
1452 memcpy(stack32
, stack16
, argSize
);
1453 thdb
->cur_stack
= PTR_SEG_OFF_TO_SEGPTR(stackSel
, (DWORD
)frame16
- stackBase
);
1455 ESP_reg(context
) = (DWORD
)stack32
;
1456 EBP_reg(context
) = ESP_reg(context
) + argSize
;
1458 TRACE(thunk
, "after SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1459 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1463 /***********************************************************************
1464 * K32Thk1632Epilog (KERNEL32.491)
1466 VOID WINAPI
K32Thk1632Epilog(CONTEXT
*context
)
1468 LPBYTE code
= (LPBYTE
)EIP_reg(context
) - 13;
1470 /* We undo the SYSTHUNK hack if necessary. See K32Thk1632Prolog. */
1472 if ( code
[5] == 0xFF && code
[6] == 0x55 && code
[7] == 0xFC
1473 && code
[13] == 0x66 && code
[14] == 0xCB)
1475 THDB
*thdb
= THREAD_Current();
1476 STACK16FRAME
*frame16
= (STACK16FRAME
*)PTR_SEG_TO_LIN(thdb
->cur_stack
);
1477 char *stack16
= (char *)(frame16
+ 1);
1478 DWORD argSize
= frame16
->ebp
- (DWORD
)stack16
;
1479 char *stack32
= (char *)frame16
->frame32
- argSize
;
1481 DWORD nArgsPopped
= ESP_reg(context
) - (DWORD
)stack32
;
1483 TRACE(thunk
, "before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1484 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1486 thdb
->cur_stack
= (DWORD
)frame16
->frame32
;
1488 ESP_reg(context
) = (DWORD
)stack16
+ nArgsPopped
;
1489 EBP_reg(context
) = frame16
->ebp
;
1491 TRACE(thunk
, "after SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1492 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);