dlls/krnl386.exe16/snoop.c

   1 /*
   2  * 386-specific Win16 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20
  21 #include <assert.h>
  22 #include <string.h>
  23 #include <stdarg.h>
  24 #include <stdio.h>
  25 #include "windef.h"
  26 #include "winbase.h"
  27 #include "winnt.h"
  28 #include "wine/winbase16.h"
  29 #include "winternl.h"
  30 #include "kernel16_private.h"
  31 #include "wine/debug.h"
  32
  33 WINE_DEFAULT_DEBUG_CHANNEL(snoop);
  34
  35 #include "pshpack1.h"
  36
  37 static void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT *context);
  38 static void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT *context);
  39
  40 typedef struct tagSNOOP16_FUN {
  41         /* code part */
  42         BYTE            lcall;          /* 0x9a call absolute with segment */
  43         DWORD           snr;
  44         /* unreached */
  45         int             nrofargs;
  46         FARPROC16       origfun;
  47         char            *name;
  48 } SNOOP16_FUN;
  49
  50 typedef struct tagSNOOP16_DLL {
  51         HMODULE16       hmod;
  52         HANDLE16        funhandle;
  53         SNOOP16_FUN     *funs;
  54         struct tagSNOOP16_DLL   *next;
  55         char name[1];
  56 } SNOOP16_DLL;
  57
  58 typedef struct tagSNOOP16_RETURNENTRY {
  59         /* code part */
  60         BYTE            lcall;          /* 0x9a call absolute with segment */
  61         DWORD           snr;
  62         /* unreached */
  63         FARPROC16       origreturn;
  64         SNOOP16_DLL     *dll;
  65         DWORD           ordinal;
  66         WORD            origSP;
  67         WORD            *args;          /* saved args across a stdcall */
  68 } SNOOP16_RETURNENTRY;
  69
  70 typedef struct tagSNOOP16_RETURNENTRIES {
  71         SNOOP16_RETURNENTRY entry[65500/sizeof(SNOOP16_RETURNENTRY)];
  72         HANDLE16        rethandle;
  73         struct tagSNOOP16_RETURNENTRIES *next;
  74 } SNOOP16_RETURNENTRIES;
  75
  76 typedef struct tagSNOOP16_RELAY {
  77         WORD            pushbp;         /* 0x5566 */
  78         BYTE            pusheax;        /* 0x50 */
  79         WORD            pushax;         /* 0x5066 */
  80         BYTE            pushl;          /* 0x68 */
  81         DWORD           realfun;        /* SNOOP16_Return */
  82         BYTE            lcall;          /* 0x9a call absolute with segment */
  83         DWORD           callfromregs;
  84         WORD            seg;
  85         WORD            lret;           /* 0xcb66 */
  86 } SNOOP16_RELAY;
  87
  88 #include "poppack.h"
  89
  90 static  SNOOP16_DLL             *firstdll = NULL;
  91 static  SNOOP16_RETURNENTRIES   *firstrets = NULL;
  92 static  SNOOP16_RELAY           *snr;
  93 static  HANDLE16                xsnr = 0;
  94
  95 void
  96 SNOOP16_RegisterDLL(HMODULE16 hModule,LPCSTR name) {
  97         SNOOP16_DLL     **dll = &(firstdll);
  98         const char      *p;
  99         char            *q;
 100
 101         if (!TRACE_ON(snoop)) return;
 102
 103         TRACE("hmod=%x, name=%s\n", hModule, name);
 104
 105         if (!snr) {
 106                 xsnr=GLOBAL_Alloc(GMEM_ZEROINIT,2*sizeof(*snr),0,LDT_FLAGS_CODE | LDT_FLAGS_32BIT);
 107                 snr = GlobalLock16(xsnr);
 108                 snr[0].pushbp   = 0x5566;
 109                 snr[0].pusheax  = 0x50;
 110                 snr[0].pushax   = 0x5066;
 111                 snr[0].pushl    = 0x68;
 112                 snr[0].realfun  = (DWORD)SNOOP16_Entry;
 113                 snr[0].lcall    = 0x9a;
 114                 snr[0].callfromregs = (DWORD)__wine_call_from_16_regs;
 115                 snr[0].seg      = get_cs();
 116                 snr[0].lret     = 0xcb66;
 117
 118                 snr[1].pushbp   = 0x5566;
 119                 snr[1].pusheax  = 0x50;
 120                 snr[1].pushax   = 0x5066;
 121                 snr[1].pushl    = 0x68;
 122                 snr[1].realfun  = (DWORD)SNOOP16_Return;
 123                 snr[1].lcall    = 0x9a;
 124                 snr[1].callfromregs = (DWORD)__wine_call_from_16_regs;
 125                 snr[1].seg      = get_cs();
 126                 snr[1].lret     = 0xcb66;
 127         }
 128         while (*dll) {
 129                 if ((*dll)->hmod == hModule)
 130                 {
 131                     /* another dll, loaded at the same address */
 132                     GlobalUnlock16((*dll)->funhandle);
 133                     GlobalFree16((*dll)->funhandle);
 134                     break;
 135                 }
 136                 dll = &((*dll)->next);
 137         }
 138
 139         if (*dll)
 140                 *dll = HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, *dll, sizeof(SNOOP16_DLL)+strlen(name));
 141         else
 142                 *dll = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(SNOOP16_DLL)+strlen(name));
 143
 144         (*dll)->next    = NULL;
 145         (*dll)->hmod    = hModule;
 146         if ((p=strrchr(name,'\\')))
 147                 name = p+1;
 148         strcpy( (*dll)->name, name );
 149         if ((q=strrchr((*dll)->name,'.')))
 150                 *q='\0';
 151         (*dll)->funhandle = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,LDT_FLAGS_CODE));
 152         (*dll)->funs = GlobalLock16((*dll)->funhandle);
 153         if (!(*dll)->funs) {
 154                 HeapFree(GetProcessHeap(),0,*dll);
 155                 FIXME("out of memory\n");
 156                 return;
 157         }
 158 }
 159
 160 FARPROC16
 161 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
 162         SNOOP16_DLL                     *dll = firstdll;
 163         SNOOP16_FUN                     *fun;
 164         NE_MODULE                       *pModule = NE_GetPtr(hmod);
 165         unsigned char                   *cpnt;
 166         char                            name[200];
 167
 168         if (!TRACE_ON(snoop) || !pModule || !HIWORD(origfun))
 169                 return origfun;
 170         if (!*(LPBYTE)MapSL((SEGPTR)origfun)) /* 0x00 is an impossible opcode, possible dataref. */
 171                 return origfun;
 172         while (dll) {
 173                 if (hmod == dll->hmod)
 174                         break;
 175                 dll=dll->next;
 176         }
 177         if (!dll)       /* probably internal */
 178                 return origfun;
 179         if (ordinal>65535/sizeof(SNOOP16_FUN))
 180                 return origfun;
 181         fun = dll->funs+ordinal;
 182         /* already done? */
 183         fun->lcall      = 0x9a;
 184         fun->snr        = MAKELONG(0,xsnr);
 185         fun->origfun    = origfun;
 186         if (fun->name)
 187                 return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
 188         cpnt = (unsigned char *)pModule + pModule->ne_restab;
 189         while (*cpnt) {
 190                 cpnt += *cpnt + 1 + sizeof(WORD);
 191                 if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
 192                         sprintf(name,"%.*s",*cpnt,cpnt+1);
 193                         break;
 194                 }
 195         }
 196         /* Now search the non-resident names table */
 197
 198         if (!*cpnt && pModule->nrname_handle) {
 199                 cpnt = GlobalLock16( pModule->nrname_handle );
 200                 while (*cpnt) {
 201                         cpnt += *cpnt + 1 + sizeof(WORD);
 202                         if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
 203                                     sprintf(name,"%.*s",*cpnt,cpnt+1);
 204                                     break;
 205                         }
 206                 }
 207         }
 208         if (*cpnt)
 209         {
 210             fun->name = HeapAlloc(GetProcessHeap(),0,strlen(name)+1);
 211             strcpy( fun->name, name );
 212         }
 213         else
 214             fun->name = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,1); /* empty string */
 215
 216         if (!SNOOP16_ShowDebugmsgSnoop(dll->name, ordinal, fun->name))
 217                 return origfun;
 218
 219         /* more magic. do not try to snoop thunk data entries (MMSYSTEM) */
 220         if (strchr(fun->name,'_')) {
 221                 char *s=strchr(fun->name,'_');
 222
 223                 if (!_strnicmp(s,"_thunkdata",10)) {
 224                         HeapFree(GetProcessHeap(),0,fun->name);
 225                         fun->name = NULL;
 226                         return origfun;
 227                 }
 228         }
 229         fun->lcall      = 0x9a;
 230         fun->snr        = MAKELONG(0,xsnr);
 231         fun->origfun    = origfun;
 232         fun->nrofargs   = -1;
 233         return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
 234 }
 235
 236 #define CALLER1REF (*(DWORD*)(MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)+4))))
 237 static void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT *context) {
 238         DWORD           ordinal=0;
 239         DWORD           entry=(DWORD)MapSL( MAKESEGPTR(context->SegCs,LOWORD(context->Eip)) )-5;
 240         WORD            xcs = context->SegCs;
 241         SNOOP16_DLL     *dll = firstdll;
 242         SNOOP16_FUN     *fun = NULL;
 243         SNOOP16_RETURNENTRIES   **rets = &firstrets;
 244         SNOOP16_RETURNENTRY     *ret;
 245         unsigned        i=0;
 246         int             max;
 247
 248         while (dll) {
 249                 if (xcs == dll->funhandle) {
 250                         fun = (SNOOP16_FUN*)entry;
 251                         ordinal = fun-dll->funs;
 252                         break;
 253                 }
 254                 dll=dll->next;
 255         }
 256         if (!dll) {
 257                 FIXME("entrypoint 0x%08x not found\n",entry);
 258                 return; /* oops */
 259         }
 260         while (*rets) {
 261                 for (i=0;i<ARRAY_SIZE((*rets)->entry);i++)
 262                         if (!(*rets)->entry[i].origreturn)
 263                                 break;
 264                 if (i!=ARRAY_SIZE((*rets)->entry))
 265                         break;
 266                 rets = &((*rets)->next);
 267         }
 268         if (!*rets) {
 269                 HANDLE16 hand = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,LDT_FLAGS_CODE));
 270                 *rets = GlobalLock16(hand);
 271                 (*rets)->rethandle = hand;
 272                 i = 0;  /* entry 0 is free */
 273         }
 274         ret = &((*rets)->entry[i]);
 275         ret->lcall      = 0x9a;
 276         ret->snr        = MAKELONG(sizeof(SNOOP16_RELAY),xsnr);
 277         ret->origreturn = (FARPROC16)CALLER1REF;
 278         CALLER1REF      = MAKELONG((char*)&(ret->lcall)-(char*)((*rets)->entry),(*rets)->rethandle);
 279         ret->dll        = dll;
 280         ret->args       = NULL;
 281         ret->ordinal    = ordinal;
 282         ret->origSP     = LOWORD(context->Esp);
 283
 284         context->Eip= LOWORD(fun->origfun);
 285         context->SegCs = HIWORD(fun->origfun);
 286
 287
 288         TRACE("\1CALL %s.%d: %s(", dll->name, ordinal, fun->name);
 289         if (fun->nrofargs>0) {
 290                 max = fun->nrofargs;
 291                 if (max>16) max=16;
 292                 for (i=max;i--;)
 293                         TRACE("%04x%s",*(WORD*)((char *) MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)) )+8+sizeof(WORD)*i),i?",":"");
 294                 if (max!=fun->nrofargs)
 295                         TRACE(" ...");
 296         } else if (fun->nrofargs<0) {
 297                 TRACE("<unknown, check return>");
 298                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(WORD));
 299                 memcpy(ret->args,(LPBYTE)((char *) MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)) )+8),sizeof(WORD)*16);
 300         }
 301         TRACE(") ret=%04x:%04x\n",HIWORD(ret->origreturn),LOWORD(ret->origreturn));
 302 }
 303
 304 static void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT *context) {
 305         SNOOP16_RETURNENTRY     *ret = (SNOOP16_RETURNENTRY*)((char *) MapSL( MAKESEGPTR(context->SegCs,LOWORD(context->Eip)) )-5);
 306
 307         /* We haven't found out the nrofargs yet. If we called a cdecl
 308          * function it is too late anyway and we can just set '0' (which
 309          * will be the difference between orig and current SP
 310          * If pascal -> everything ok.
 311          */
 312         if (ret->dll->funs[ret->ordinal].nrofargs<0) {
 313                 ret->dll->funs[ret->ordinal].nrofargs=(LOWORD(context->Esp)-ret->origSP-4)/2;
 314         }
 315         context->Eip = LOWORD(ret->origreturn);
 316         context->SegCs  = HIWORD(ret->origreturn);
 317         TRACE("\1RET  %s.%d: %s(", ret->dll->name, ret->ordinal, ret->dll->funs[ret->ordinal].name);
 318         if (ret->args) {
 319                 int     i,max;
 320
 321                 max = ret->dll->funs[ret->ordinal].nrofargs;
 322                 if (max>16)
 323                         max=16;
 324                 if (max<0)
 325                         max=0;
 326
 327                 for (i=max;i--;)
 328                         TRACE("%04x%s",ret->args[i],i?",":"");
 329                 if (max!=ret->dll->funs[ret->ordinal].nrofargs)
 330                         TRACE(" ...");
 331                 HeapFree(GetProcessHeap(),0,ret->args);
 332                 ret->args = NULL;
 333         }
 334         TRACE(") retval = %04x:%04x ret=%04x:%04x\n",
 335               (WORD)context->Edx,(WORD)context->Eax,
 336               HIWORD(ret->origreturn),LOWORD(ret->origreturn));
 337         ret->origreturn = NULL; /* mark as empty */
 338 }