?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Complete cleanup, bugfixes.
[wine.git] / relay32 / snoop.c
bloba5442c1627e4de88ff391a24b602eae79301fb2a
1 /*
2 * 386-specific Win32 dll<->dll snooping functions
3 *
4 * Copyright 1998 Marcus Meissner
5 */
6
7 #include "config.h"
8
9 #include <assert.h>
10 #include <stdio.h>
11 #include <string.h>
12 #include "winbase.h"
13 #include "wingdi.h"
14 #include "winuser.h"
15 #include "winnt.h"
16 #include "heap.h"
17 #include "builtin32.h"
18 #include "snoop.h"
19 #include "neexe.h"
20 #include "selectors.h"
21 #include "stackframe.h"
22 #include "debugtools.h"
23 #include "wine/exception.h"
24
25 DEFAULT_DEBUG_CHANNEL(snoop);
26
27 static WINE_EXCEPTION_FILTER(page_fault)
28 {
29 if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION)
30 return EXCEPTION_EXECUTE_HANDLER;
31 return EXCEPTION_CONTINUE_SEARCH;
32 }
33
34 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
35
36 #ifdef __i386__
37
38 extern void WINAPI SNOOP_Entry();
39 extern void WINAPI SNOOP_Return();
40
41 #ifdef NEED_UNDERSCORE_PREFIX
42 # define PREFIX "_"
43 #else
44 # define PREFIX
45 #endif
46
47 #include "pshpack1.h"
48
49 typedef struct tagSNOOP_FUN {
50 /* code part */
51 BYTE lcall; /* 0xe8 call snoopentry (relative) */
52 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
53 * calculation!
54 */
55 DWORD snoopentry; /* SNOOP_Entry relative */
56 /* unreached */
57 int nrofargs;
58 FARPROC origfun;
59 char *name;
60 } SNOOP_FUN;
61
62 typedef struct tagSNOOP_DLL {
63 HMODULE hmod;
64 SNOOP_FUN *funs;
65 LPCSTR name;
66 int nrofordinals;
67 struct tagSNOOP_DLL *next;
68 } SNOOP_DLL;
69 typedef struct tagSNOOP_RETURNENTRY {
70 /* code part */
71 BYTE lcall; /* 0xe8 call snoopret relative*/
72 /* NOTE: If you move snoopret OR origreturn fix the relative offset
73 * calculation!
74 */
75 DWORD snoopret; /* SNOOP_Ret relative */
76 /* unreached */
77 FARPROC origreturn;
78 SNOOP_DLL *dll;
79 DWORD ordinal;
80 DWORD origESP;
81 DWORD *args; /* saved args across a stdcall */
82 } SNOOP_RETURNENTRY;
83
84 typedef struct tagSNOOP_RETURNENTRIES {
85 SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
86 struct tagSNOOP_RETURNENTRIES *next;
87 } SNOOP_RETURNENTRIES;
88
89 #include "poppack.h"
90
91 static SNOOP_DLL *firstdll = NULL;
92 static SNOOP_RETURNENTRIES *firstrets = NULL;
93
94 /***********************************************************************
95 * SNOOP_ShowDebugmsgSnoop
96 *
97 * Simple function to decide if a particular debugging message is
98 * wanted.
99 */
100 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
101
102 if(debug_snoop_excludelist || debug_snoop_includelist) {
103 char **listitem;
104 char buf[80];
105 int len, len2, itemlen, show;
106
107 if(debug_snoop_excludelist) {
108 show = 1;
109 listitem = debug_snoop_excludelist;
110 } else {
111 show = 0;
112 listitem = debug_snoop_includelist;
113 }
114 len = strlen(dll);
115 assert(len < 64);
116 sprintf(buf, "%s.%d", dll, ord);
117 len2 = strlen(buf);
118 for(; *listitem; listitem++) {
119 itemlen = strlen(*listitem);
120 if((itemlen == len && !strncmp(*listitem, buf, len)) ||
121 (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
122 !strcmp(*listitem, fname)) {
123 show = !show;
124 break;
125 }
126 }
127 return show;
128 }
129 return 1;
130 }
131
132 void
133 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
134 SNOOP_DLL **dll = &(firstdll);
135 char *s;
136
137 if (!TRACE_ON(snoop)) return;
138 while (*dll) {
139 if ((*dll)->hmod == hmod)
140 return; /* already registered */
141 dll = &((*dll)->next);
142 }
143 *dll = (SNOOP_DLL*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
144 (*dll)->next = NULL;
145 (*dll)->hmod = hmod;
146 (*dll)->nrofordinals = nrofordinals;
147 (*dll)->name = HEAP_strdupA(GetProcessHeap(),0,name);
148 if ((s=strrchr((*dll)->name,'.')))
149 *s='\0';
150 (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
151 memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
152 if (!(*dll)->funs) {
153 HeapFree(GetProcessHeap(),0,*dll);
154 FIXME("out of memory\n");
155 return;
156 }
157 }
158
159 FARPROC
160 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
161 SNOOP_DLL *dll = firstdll;
162 SNOOP_FUN *fun;
163 int j;
164 IMAGE_SECTION_HEADER *pe_seg = PE_SECTIONS(hmod);
165
166 if (!TRACE_ON(snoop)) return origfun;
167 if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
168 return origfun;
169 for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
170 /* 0x42 is special ELF loader tag */
171 if ((pe_seg[j].VirtualAddress==0x42) ||
172 (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
173 ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
174 pe_seg[j].SizeOfRawData
175 ))
176 )
177 break;
178 /* If we looked through all sections (and didn't find one)
179 * or if the sectionname contains "data", we return the
180 * original function since it is most likely a datareference.
181 */
182 if ( (j==PE_HEADER(hmod)->FileHeader.NumberOfSections) ||
183 (strstr(pe_seg[j].Name,"data")) ||
184 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
185 )
186 return origfun;
187
188 while (dll) {
189 if (hmod == dll->hmod)
190 break;
191 dll=dll->next;
192 }
193 if (!dll) /* probably internal */
194 return origfun;
195 if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
196 return origfun;
197 assert(ordinal<dll->nrofordinals);
198 fun = dll->funs+ordinal;
199 if (!fun->name) fun->name = HEAP_strdupA(GetProcessHeap(),0,name);
200 fun->lcall = 0xe8;
201 /* NOTE: origreturn struct member MUST come directly after snoopentry */
202 fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
203 fun->origfun = origfun;
204 fun->nrofargs = -1;
205 return (FARPROC)&(fun->lcall);
206 }
207
208 static char*
209 SNOOP_PrintArg(DWORD x) {
210 static char buf[200];
211 int i,nostring;
212 char * ret=0;
213 MEMORY_BASIC_INFORMATION mbi;
214
215 if ( !HIWORD(x) ||
216 !VirtualQuery((LPVOID)x,&mbi,sizeof(mbi)) ||
217 !mbi.Type
218 ) {
219 sprintf(buf,"%08lx",x);
220 return buf;
221 }
222 __TRY{
223 LPBYTE s=(LPBYTE)x;
224 i=0;nostring=0;
225 while (i<80) {
226 if (s[i]==0) break;
227 if (s[i]<0x20) {nostring=1;break;}
228 if (s[i]>=0x80) {nostring=1;break;}
229 i++;
230 }
231 if (!nostring) {
232 if (i>5) {
233 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
234 ret=buf;
235 }
236 }
237 }
238 __EXCEPT(page_fault){}
239 __ENDTRY
240 if (ret)
241 return ret;
242 __TRY{
243 LPWSTR s=(LPWSTR)x;
244 i=0;nostring=0;
245 while (i<80) {
246 if (s[i]==0) break;
247 if (s[i]<0x20) {nostring=1;break;}
248 if (s[i]>0x100) {nostring=1;break;}
249 i++;
250 }
251 if (!nostring) {
252 if (i>5) {
253 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
254 ret=buf;
255 }
256 }
257 }
258 __EXCEPT(page_fault){}
259 __ENDTRY
260 if (ret)
261 return ret;
262 sprintf(buf,"%08lx",x);
263 return buf;
264 }
265
266 #define CALLER1REF (*(DWORD*)ESP_reg(context))
267
268 void WINAPI SNOOP_DoEntry( CONTEXT86 *context );
269 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Entry, SNOOP_DoEntry );
270 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
271 {
272 DWORD ordinal=0,entry = EIP_reg(context)-5;
273 SNOOP_DLL *dll = firstdll;
274 SNOOP_FUN *fun = NULL;
275 SNOOP_RETURNENTRIES **rets = &firstrets;
276 SNOOP_RETURNENTRY *ret;
277 int i,max;
278
279 while (dll) {
280 if ( ((char*)entry>=(char*)dll->funs) &&
281 ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
282 ) {
283 fun = (SNOOP_FUN*)entry;
284 ordinal = fun-dll->funs;
285 break;
286 }
287 dll=dll->next;
288 }
289 if (!dll) {
290 FIXME("entrypoint 0x%08lx not found\n",entry);
291 return; /* oops */
292 }
293 /* guess cdecl ... */
294 if (fun->nrofargs<0) {
295 /* Typical cdecl return frame is:
296 * add esp, xxxxxxxx
297 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
298 * (after that 81 C2 xx xx xx xx)
299 */
300 LPBYTE reteip = (LPBYTE)CALLER1REF;
301
302 if (reteip) {
303 if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
304 fun->nrofargs=reteip[2]/4;
305 }
306 }
307
308
309 while (*rets) {
310 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
311 if (!(*rets)->entry[i].origreturn)
312 break;
313 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
314 break;
315 rets = &((*rets)->next);
316 }
317 if (!*rets) {
318 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
319 memset(*rets,0,4096);
320 i = 0; /* entry 0 is free */
321 }
322 ret = &((*rets)->entry[i]);
323 ret->lcall = 0xe8;
324 /* NOTE: origreturn struct member MUST come directly after snoopret */
325 ret->snoopret = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
326 ret->origreturn = (FARPROC)CALLER1REF;
327 CALLER1REF = (DWORD)&ret->lcall;
328 ret->dll = dll;
329 ret->args = NULL;
330 ret->ordinal = ordinal;
331 ret->origESP = ESP_reg(context);
332
333 EIP_reg(context)= (DWORD)fun->origfun;
334
335 DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
336 if (fun->nrofargs>0) {
337 max = fun->nrofargs; if (max>16) max=16;
338 for (i=0;i<max;i++)
339 DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(ESP_reg(context)+4+sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
340 if (max!=fun->nrofargs)
341 DPRINTF(" ...");
342 } else if (fun->nrofargs<0) {
343 DPRINTF("<unknown, check return>");
344 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
345 memcpy(ret->args,(LPBYTE)(ESP_reg(context)+4),sizeof(DWORD)*16);
346 }
347 DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD)ret->origreturn,FS_reg(context));
348 }
349
350 void WINAPI SNOOP_DoReturn( CONTEXT86 *context );
351 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Return, SNOOP_DoReturn );
352 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
353 {
354 SNOOP_RETURNENTRY *ret = (SNOOP_RETURNENTRY*)(EIP_reg(context)-5);
355
356 /* We haven't found out the nrofargs yet. If we called a cdecl
357 * function it is too late anyway and we can just set '0' (which
358 * will be the difference between orig and current ESP
359 * If stdcall -> everything ok.
360 */
361 if (ret->dll->funs[ret->ordinal].nrofargs<0)
362 ret->dll->funs[ret->ordinal].nrofargs=(ESP_reg(context)-ret->origESP-4)/4;
363 EIP_reg(context) = (DWORD)ret->origreturn;
364 if (ret->args) {
365 int i,max;
366
367 DPRINTF("Ret %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
368 max = ret->dll->funs[ret->ordinal].nrofargs;
369 if (max>16) max=16;
370
371 for (i=0;i<max;i++)
372 DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
373 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
374 EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
375 );
376 HeapFree(GetProcessHeap(),0,ret->args);
377 ret->args = NULL;
378 } else
379 DPRINTF("Ret %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
380 ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
381 EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
382 );
383 ret->origreturn = NULL; /* mark as empty */
384 }
385 #else /* !__i386__ */
386 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
387 FIXME("snooping works only on i386 for now.\n");
388 return;
389 }
390
391 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
392 return origfun;
393 }
394 #endif /* !__i386__ */
Windows API implementation