2 * 386-specific Win32 dll<->dll snooping functions
4 * Copyright 1998 Marcus Meissner
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include "wine/port.h"
30 #include "stackframe.h"
31 #include "wine/debug.h"
32 #include "wine/exception.h"
33 #include "msvcrt/excpt.h"
35 WINE_DEFAULT_DEBUG_CHANNEL(snoop
);
37 static WINE_EXCEPTION_FILTER(page_fault
)
39 if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION
||
40 GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION
)
41 return EXCEPTION_EXECUTE_HANDLER
;
42 return EXCEPTION_CONTINUE_SEARCH
;
45 extern const char **debug_snoop_excludelist
;
46 extern const char **debug_snoop_includelist
;
50 extern void WINAPI
SNOOP_Entry();
51 extern void WINAPI
SNOOP_Return();
53 #ifdef NEED_UNDERSCORE_PREFIX
61 typedef struct tagSNOOP_FUN
{
63 BYTE lcall
; /* 0xe8 call snoopentry (relative) */
64 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
67 DWORD snoopentry
; /* SNOOP_Entry relative */
74 typedef struct tagSNOOP_DLL
{
79 struct tagSNOOP_DLL
*next
;
83 typedef struct tagSNOOP_RETURNENTRY
{
85 BYTE lcall
; /* 0xe8 call snoopret relative*/
86 /* NOTE: If you move snoopret OR origreturn fix the relative offset
89 DWORD snoopret
; /* SNOOP_Ret relative */
95 DWORD
*args
; /* saved args across a stdcall */
98 typedef struct tagSNOOP_RETURNENTRIES
{
99 SNOOP_RETURNENTRY entry
[4092/sizeof(SNOOP_RETURNENTRY
)];
100 struct tagSNOOP_RETURNENTRIES
*next
;
101 } SNOOP_RETURNENTRIES
;
105 static SNOOP_DLL
*firstdll
= NULL
;
106 static SNOOP_RETURNENTRIES
*firstrets
= NULL
;
108 /***********************************************************************
109 * SNOOP_ShowDebugmsgSnoop
111 * Simple function to decide if a particular debugging message is
114 int SNOOP_ShowDebugmsgSnoop(const char *dll
, int ord
, const char *fname
) {
116 if(debug_snoop_excludelist
|| debug_snoop_includelist
) {
117 const char **listitem
;
119 int len
, len2
, itemlen
, show
;
121 if(debug_snoop_excludelist
) {
123 listitem
= debug_snoop_excludelist
;
126 listitem
= debug_snoop_includelist
;
130 sprintf(buf
, "%s.%d", dll
, ord
);
132 for(; *listitem
; listitem
++) {
133 itemlen
= strlen(*listitem
);
134 if((itemlen
== len
&& !strncasecmp(*listitem
, buf
, len
)) ||
135 (itemlen
== len2
&& !strncasecmp(*listitem
, buf
, len2
)) ||
136 !strcasecmp(*listitem
, fname
)) {
147 SNOOP_RegisterDLL(HMODULE hmod
,LPCSTR name
,DWORD ordbase
,DWORD nrofordinals
) {
148 SNOOP_DLL
**dll
= &(firstdll
);
151 TRACE("hmod=%x, name=%s, ordbase=%ld, nrofordinals=%ld\n",
152 hmod
, name
, ordbase
, nrofordinals
);
154 if (!TRACE_ON(snoop
)) return;
156 if ((*dll
)->hmod
== hmod
)
158 /* another dll, loaded at the same address */
159 VirtualFree((*dll
)->funs
, (*dll
)->nrofordinals
*sizeof(SNOOP_FUN
), MEM_RELEASE
);
162 dll
= &((*dll
)->next
);
164 *dll
= HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY
, *dll
, sizeof(SNOOP_DLL
)+strlen(name
));
166 (*dll
)->ordbase
= ordbase
;
167 (*dll
)->nrofordinals
= nrofordinals
;
168 strcpy( (*dll
)->name
, name
);
169 if ((s
=strrchr((*dll
)->name
,'.')))
171 (*dll
)->funs
= VirtualAlloc(NULL
,nrofordinals
*sizeof(SNOOP_FUN
),MEM_COMMIT
|MEM_RESERVE
,PAGE_EXECUTE_READWRITE
);
172 memset((*dll
)->funs
,0,nrofordinals
*sizeof(SNOOP_FUN
));
174 HeapFree(GetProcessHeap(),0,*dll
);
175 FIXME("out of memory\n");
181 SNOOP_GetProcAddress(HMODULE hmod
,LPCSTR name
,DWORD ordinal
,FARPROC origfun
) {
182 SNOOP_DLL
*dll
= firstdll
;
185 IMAGE_SECTION_HEADER
*pe_seg
= PE_SECTIONS(hmod
);
187 if (!TRACE_ON(snoop
)) return origfun
;
188 if (!*(LPBYTE
)origfun
) /* 0x00 is an imposs. opcode, poss. dataref. */
190 for (j
=0;j
<PE_HEADER(hmod
)->FileHeader
.NumberOfSections
;j
++)
191 /* 0x42 is special ELF loader tag */
192 if ((pe_seg
[j
].VirtualAddress
==0x42) ||
193 (((DWORD
)origfun
-hmod
>=pe_seg
[j
].VirtualAddress
)&&
194 ((DWORD
)origfun
-hmod
<pe_seg
[j
].VirtualAddress
+
195 pe_seg
[j
].SizeOfRawData
199 /* If we looked through all sections (and didn't find one)
200 * or if the sectionname contains "data", we return the
201 * original function since it is most likely a datareference.
203 if ( (j
==PE_HEADER(hmod
)->FileHeader
.NumberOfSections
) ||
204 (strstr(pe_seg
[j
].Name
,"data")) ||
205 !(pe_seg
[j
].Characteristics
& IMAGE_SCN_CNT_CODE
)
210 if (hmod
== dll
->hmod
)
214 if (!dll
) /* probably internal */
216 if (!SNOOP_ShowDebugmsgSnoop(dll
->name
,ordinal
,name
))
218 assert(ordinal
< dll
->nrofordinals
);
219 fun
= dll
->funs
+ordinal
;
222 fun
->name
= HeapAlloc(GetProcessHeap(),0,strlen(name
)+1);
223 strcpy( fun
->name
, name
);
225 /* NOTE: origreturn struct member MUST come directly after snoopentry */
226 fun
->snoopentry
= (char*)SNOOP_Entry
-((char*)(&fun
->nrofargs
));
227 fun
->origfun
= origfun
;
230 return (FARPROC
)&(fun
->lcall
);
233 static void SNOOP_PrintArg(DWORD x
)
238 if ( !HIWORD(x
) ) return; /* trivial reject to avoid faults */
245 if (s
[i
]<0x20) {nostring
=1;break;}
246 if (s
[i
]>=0x80) {nostring
=1;break;}
249 if (!nostring
&& i
> 5)
250 DPRINTF(" %s",debugstr_an((LPSTR
)x
,i
));
251 else /* try unicode */
257 if (s
[i
]<0x20) {nostring
=1;break;}
258 if (s
[i
]>0x100) {nostring
=1;break;}
261 if (!nostring
&& i
> 5) DPRINTF(" %s",debugstr_wn((LPWSTR
)x
,i
));
270 #define CALLER1REF (*(DWORD*)context->Esp)
272 void WINAPI
SNOOP_DoEntry( CONTEXT86
*context
)
274 DWORD ordinal
=0,entry
= context
->Eip
- 5;
275 SNOOP_DLL
*dll
= firstdll
;
276 SNOOP_FUN
*fun
= NULL
;
277 SNOOP_RETURNENTRIES
**rets
= &firstrets
;
278 SNOOP_RETURNENTRY
*ret
;
282 if ( ((char*)entry
>=(char*)dll
->funs
) &&
283 ((char*)entry
<=(char*)(dll
->funs
+dll
->nrofordinals
))
285 fun
= (SNOOP_FUN
*)entry
;
286 ordinal
= fun
-dll
->funs
;
292 FIXME("entrypoint 0x%08lx not found\n",entry
);
295 /* guess cdecl ... */
296 if (fun
->nrofargs
<0) {
297 /* Typical cdecl return frame is:
299 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
300 * (after that 81 C2 xx xx xx xx)
302 LPBYTE reteip
= (LPBYTE
)CALLER1REF
;
305 if ((reteip
[0]==0x83)&&(reteip
[1]==0xc4))
306 fun
->nrofargs
=reteip
[2]/4;
312 for (i
=0;i
<sizeof((*rets
)->entry
)/sizeof((*rets
)->entry
[0]);i
++)
313 if (!(*rets
)->entry
[i
].origreturn
)
315 if (i
!=sizeof((*rets
)->entry
)/sizeof((*rets
)->entry
[0]))
317 rets
= &((*rets
)->next
);
320 *rets
= VirtualAlloc(NULL
,4096,MEM_COMMIT
|MEM_RESERVE
,PAGE_EXECUTE_READWRITE
);
321 memset(*rets
,0,4096);
322 i
= 0; /* entry 0 is free */
324 ret
= &((*rets
)->entry
[i
]);
326 /* NOTE: origreturn struct member MUST come directly after snoopret */
327 ret
->snoopret
= ((char*)SNOOP_Return
)-(char*)(&ret
->origreturn
);
328 ret
->origreturn
= (FARPROC
)CALLER1REF
;
329 CALLER1REF
= (DWORD
)&ret
->lcall
;
332 ret
->ordinal
= ordinal
;
333 ret
->origESP
= context
->Esp
;
335 context
->Eip
= (DWORD
)fun
->origfun
;
337 DPRINTF("%08lx:CALL %s.%ld: %s(",GetCurrentThreadId(),dll
->name
,dll
->ordbase
+ordinal
,fun
->name
);
338 if (fun
->nrofargs
>0) {
339 max
= fun
->nrofargs
; if (max
>16) max
=16;
342 SNOOP_PrintArg(*(DWORD
*)(context
->Esp
+ 4 + sizeof(DWORD
)*i
));
343 if (i
<fun
->nrofargs
-1) DPRINTF(",");
345 if (max
!=fun
->nrofargs
)
347 } else if (fun
->nrofargs
<0) {
348 DPRINTF("<unknown, check return>");
349 ret
->args
= HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD
));
350 memcpy(ret
->args
,(LPBYTE
)(context
->Esp
+ 4),sizeof(DWORD
)*16);
352 DPRINTF(") ret=%08lx\n",(DWORD
)ret
->origreturn
);
356 void WINAPI
SNOOP_DoReturn( CONTEXT86
*context
)
358 SNOOP_RETURNENTRY
*ret
= (SNOOP_RETURNENTRY
*)(context
->Eip
- 5);
360 /* We haven't found out the nrofargs yet. If we called a cdecl
361 * function it is too late anyway and we can just set '0' (which
362 * will be the difference between orig and current ESP
363 * If stdcall -> everything ok.
365 if (ret
->dll
->funs
[ret
->ordinal
].nrofargs
<0)
366 ret
->dll
->funs
[ret
->ordinal
].nrofargs
=(context
->Esp
- ret
->origESP
-4)/4;
367 context
->Eip
= (DWORD
)ret
->origreturn
;
371 DPRINTF("%08lx:RET %s.%ld: %s(",
372 GetCurrentThreadId(),
373 ret
->dll
->name
,ret
->dll
->ordbase
+ret
->ordinal
,ret
->dll
->funs
[ret
->ordinal
].name
);
374 max
= ret
->dll
->funs
[ret
->ordinal
].nrofargs
;
379 SNOOP_PrintArg(ret
->args
[i
]);
380 if (i
<max
-1) DPRINTF(",");
382 DPRINTF(") retval = %08lx ret=%08lx\n",
383 context
->Eax
,(DWORD
)ret
->origreturn
);
384 HeapFree(GetProcessHeap(),0,ret
->args
);
387 DPRINTF("%08lx:RET %s.%ld: %s() retval = %08lx ret=%08lx\n",
388 GetCurrentThreadId(),
389 ret
->dll
->name
,ret
->dll
->ordbase
+ret
->ordinal
,ret
->dll
->funs
[ret
->ordinal
].name
,
390 context
->Eax
, (DWORD
)ret
->origreturn
);
391 ret
->origreturn
= NULL
; /* mark as empty */
394 /* assembly wrappers that save the context */
395 __ASM_GLOBAL_FUNC( SNOOP_Entry
,
396 "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
397 ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
398 __ASM_GLOBAL_FUNC( SNOOP_Return
,
399 "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
400 ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
402 #else /* !__i386__ */
403 void SNOOP_RegisterDLL(HMODULE hmod
,LPCSTR name
,DWORD nrofordinals
, DWORD dw
) {
404 if (!TRACE_ON(snoop
)) return;
405 FIXME("snooping works only on i386 for now.\n");
408 FARPROC
SNOOP_GetProcAddress(HMODULE hmod
,LPCSTR name
,DWORD ordinal
,FARPROC origfun
) {
411 #endif /* !__i386__ */