2 * KERNEL32 thunks and other undocumented stuff
4 * Copyright 1997-1998 Marcus Meissner
5 * Copyright 1998 Ulrich Weigand
10 #include <sys/types.h>
15 #include "wine/winbase16.h"
22 #include "stackframe.h"
23 #include "selectors.h"
25 #include "debugtools.h"
26 #include "flatthunk.h"
30 DEFAULT_DEBUG_CHANNEL(thunk
);
31 DECLARE_DEBUG_CHANNEL(win32
);
34 /***********************************************************************
36 * Win95 internal thunks *
38 ***********************************************************************/
40 /***********************************************************************
41 * LogApiThk (KERNEL.423)
43 void WINAPI
LogApiThk( LPSTR func
)
45 TRACE( "%s\n", debugstr_a(func
) );
48 /***********************************************************************
49 * LogApiThkLSF (KERNEL32.42)
51 * NOTE: needs to preserve all registers!
53 void WINAPI
LogApiThkLSF( LPSTR func
, CONTEXT86
*context
)
55 TRACE( "%s\n", debugstr_a(func
) );
58 /***********************************************************************
59 * LogApiThkSL (KERNEL32.44)
61 * NOTE: needs to preserve all registers!
63 void WINAPI
LogApiThkSL( LPSTR func
, CONTEXT86
*context
)
65 TRACE( "%s\n", debugstr_a(func
) );
68 /***********************************************************************
69 * LogCBThkSL (KERNEL32.47)
71 * NOTE: needs to preserve all registers!
73 void WINAPI
LogCBThkSL( LPSTR func
, CONTEXT86
*context
)
75 TRACE( "%s\n", debugstr_a(func
) );
78 /***********************************************************************
79 * Generates a FT_Prolog call.
81 * 0FB6D1 movzbl edx,cl
82 * 8B1495xxxxxxxx mov edx,[4*edx + targetTable]
83 * 68xxxxxxxx push FT_Prolog
86 static void _write_ftprolog(LPBYTE relayCode
,DWORD
*targetTable
) {
90 *x
++ = 0x0f;*x
++=0xb6;*x
++=0xd1; /* movzbl edx,cl */
91 *x
++ = 0x8B;*x
++=0x14;*x
++=0x95;*(DWORD
**)x
= targetTable
;
92 x
+=4; /* mov edx, [4*edx + targetTable] */
93 *x
++ = 0x68; *(DWORD
*)x
= (DWORD
)GetProcAddress(GetModuleHandleA("KERNEL32"),"FT_Prolog");
94 x
+=4; /* push FT_Prolog */
95 *x
++ = 0xC3; /* lret */
96 /* fill rest with 0xCC / int 3 */
99 /***********************************************************************
100 * _write_qtthunk (internal)
101 * Generates a QT_Thunk style call.
104 * 8A4DFC mov cl , [ebp-04]
105 * 8B148Dxxxxxxxx mov edx, [4*ecx + targetTable]
106 * B8yyyyyyyy mov eax, QT_Thunk
109 static void _write_qtthunk(
110 LPBYTE relayCode
, /* [in] start of QT_Thunk stub */
111 DWORD
*targetTable
/* [in] start of thunk (for index lookup) */
116 *x
++ = 0x33;*x
++=0xC9; /* xor ecx,ecx */
117 *x
++ = 0x8A;*x
++=0x4D;*x
++=0xFC; /* movb cl,[ebp-04] */
118 *x
++ = 0x8B;*x
++=0x14;*x
++=0x8D;*(DWORD
**)x
= targetTable
;
119 x
+=4; /* mov edx, [4*ecx + targetTable */
120 *x
++ = 0xB8; *(DWORD
*)x
= (DWORD
)GetProcAddress(GetModuleHandleA("KERNEL32"),"QT_Thunk");
121 x
+=4; /* mov eax , QT_Thunk */
122 *x
++ = 0xFF; *x
++ = 0xE0; /* jmp eax */
123 /* should fill the rest of the 32 bytes with 0xCC */
126 /***********************************************************************
129 static LPVOID
_loadthunk(LPCSTR module
, LPCSTR func
, LPCSTR module32
,
130 struct ThunkDataCommon
*TD32
, DWORD checksum
)
132 struct ThunkDataCommon
*TD16
;
136 if ((hmod
= LoadLibrary16(module
)) <= 32)
138 ERR("(%s, %s, %s): Unable to load '%s', error %d\n",
139 module
, func
, module32
, module
, hmod
);
143 if ( !(ordinal
= NE_GetOrdinal(hmod
, func
))
144 || !(TD16
= PTR_SEG_TO_LIN(NE_GetEntryPointEx(hmod
, ordinal
, FALSE
))))
146 ERR("Unable to find thunk data '%s' in %s, required by %s (conflicting/incorrect DLL versions !?).\n",
147 func
, module
, module32
);
151 if (TD32
&& memcmp(TD16
->magic
, TD32
->magic
, 4))
153 ERR("(%s, %s, %s): Bad magic %c%c%c%c (should be %c%c%c%c)\n",
154 module
, func
, module32
,
155 TD16
->magic
[0], TD16
->magic
[1], TD16
->magic
[2], TD16
->magic
[3],
156 TD32
->magic
[0], TD32
->magic
[1], TD32
->magic
[2], TD32
->magic
[3]);
160 if (TD32
&& TD16
->checksum
!= TD32
->checksum
)
162 ERR("(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
163 module
, func
, module32
, TD16
->checksum
, TD32
->checksum
);
167 if (!TD32
&& checksum
&& checksum
!= *(LPDWORD
)TD16
)
169 ERR("(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
170 module
, func
, module32
, *(LPDWORD
)TD16
, checksum
);
177 /***********************************************************************
178 * GetThunkStuff (KERNEL32.53)
180 LPVOID WINAPI
GetThunkStuff(LPSTR module
, LPSTR func
)
182 return _loadthunk(module
, func
, "<kernel>", NULL
, 0L);
185 /***********************************************************************
186 * GetThunkBuff (KERNEL32.52)
187 * Returns a pointer to ThkBuf in the 16bit library SYSTHUNK.DLL.
189 LPVOID WINAPI
GetThunkBuff(void)
191 return GetThunkStuff("SYSTHUNK.DLL", "ThkBuf");
194 /***********************************************************************
195 * ThunkConnect32 (KERNEL32)
196 * Connects a 32bit and a 16bit thunkbuffer.
198 UINT WINAPI
ThunkConnect32(
199 struct ThunkDataCommon
*TD
, /* [in/out] thunkbuffer */
200 LPSTR thunkfun16
, /* [in] win16 thunkfunction */
201 LPSTR module16
, /* [in] name of win16 dll */
202 LPSTR module32
, /* [in] name of win32 dll */
203 HMODULE hmod32
, /* [in] hmodule of win32 dll */
204 DWORD dwReason
/* [in] initialisation argument */
208 if (!strncmp(TD
->magic
, "SL01", 4))
212 TRACE("SL01 thunk %s (%lx) <- %s (%s), Reason: %ld\n",
213 module32
, (DWORD
)TD
, module16
, thunkfun16
, dwReason
);
215 else if (!strncmp(TD
->magic
, "LS01", 4))
219 TRACE("LS01 thunk %s (%lx) -> %s (%s), Reason: %ld\n",
220 module32
, (DWORD
)TD
, module16
, thunkfun16
, dwReason
);
224 ERR("Invalid magic %c%c%c%c\n",
225 TD
->magic
[0], TD
->magic
[1], TD
->magic
[2], TD
->magic
[3]);
231 case DLL_PROCESS_ATTACH
:
233 struct ThunkDataCommon
*TD16
;
234 if (!(TD16
= _loadthunk(module16
, thunkfun16
, module32
, TD
, 0L)))
239 struct ThunkDataSL32
*SL32
= (struct ThunkDataSL32
*)TD
;
240 struct ThunkDataSL16
*SL16
= (struct ThunkDataSL16
*)TD16
;
241 struct SLTargetDB
*tdb
;
243 if (SL16
->fpData
== NULL
)
245 ERR("ThunkConnect16 was not called!\n");
249 SL32
->data
= SL16
->fpData
;
251 tdb
= HeapAlloc(GetProcessHeap(), 0, sizeof(*tdb
));
252 tdb
->process
= PROCESS_Current();
253 tdb
->targetTable
= (DWORD
*)(thunkfun16
+ SL32
->offsetTargetTable
);
255 tdb
->next
= SL32
->data
->targetDB
; /* FIXME: not thread-safe! */
256 SL32
->data
->targetDB
= tdb
;
258 TRACE("Process %08lx allocated TargetDB entry for ThunkDataSL %08lx\n",
259 (DWORD
)PROCESS_Current(), (DWORD
)SL32
->data
);
263 struct ThunkDataLS32
*LS32
= (struct ThunkDataLS32
*)TD
;
264 struct ThunkDataLS16
*LS16
= (struct ThunkDataLS16
*)TD16
;
266 LS32
->targetTable
= PTR_SEG_TO_LIN(LS16
->targetTable
);
268 /* write QT_Thunk and FT_Prolog stubs */
269 _write_qtthunk ((LPBYTE
)TD
+ LS32
->offsetQTThunk
, LS32
->targetTable
);
270 _write_ftprolog((LPBYTE
)TD
+ LS32
->offsetFTProlog
, LS32
->targetTable
);
275 case DLL_PROCESS_DETACH
:
283 /**********************************************************************
284 * QT_Thunk (KERNEL32)
286 * The target address is in EDX.
287 * The 16 bit arguments start at ESP.
288 * The number of 16bit argument bytes is EBP-ESP-0x40 (64 Byte thunksetup).
291 void WINAPI
QT_Thunk( CONTEXT86
*context
)
296 memcpy(&context16
,context
,sizeof(context16
));
298 CS_reg(&context16
) = HIWORD(EDX_reg(context
));
299 EIP_reg(&context16
) = LOWORD(EDX_reg(context
));
300 EBP_reg(&context16
) = OFFSETOF( NtCurrentTeb()->cur_stack
)
301 + (WORD
)&((STACK16FRAME
*)0)->bp
;
303 argsize
= EBP_reg(context
)-ESP_reg(context
)-0x40;
305 memcpy( (LPBYTE
)CURRENT_STACK16
- argsize
,
306 (LPBYTE
)ESP_reg(context
), argsize
);
308 EAX_reg(context
) = Callbacks
->CallRegisterShortProc( &context16
, argsize
);
309 EDX_reg(context
) = HIWORD(EAX_reg(context
));
310 EAX_reg(context
) = LOWORD(EAX_reg(context
));
314 /**********************************************************************
315 * FT_Prolog (KERNEL32.233)
317 * The set of FT_... thunk routines is used instead of QT_Thunk,
318 * if structures have to be converted from 32-bit to 16-bit
319 * (change of member alignment, conversion of members).
321 * The thunk function (as created by the thunk compiler) calls
322 * FT_Prolog at the beginning, to set up a stack frame and
323 * allocate a 64 byte buffer on the stack.
324 * The input parameters (target address and some flags) are
325 * saved for later use by FT_Thunk.
327 * Input: EDX 16-bit target address (SEGPTR)
328 * CX bits 0..7 target number (in target table)
329 * bits 8..9 some flags (unclear???)
330 * bits 10..15 number of DWORD arguments
332 * Output: A new stackframe is created, and a 64 byte buffer
333 * allocated on the stack. The layout of the stack
334 * on return is as follows:
336 * (ebp+4) return address to caller of thunk function
338 * (ebp-4) saved EBX register of caller
339 * (ebp-8) saved ESI register of caller
340 * (ebp-12) saved EDI register of caller
341 * (ebp-16) saved ECX register, containing flags
342 * (ebp-20) bitmap containing parameters that are to be converted
343 * by FT_Thunk; it is initialized to 0 by FT_Prolog and
344 * filled in by the thunk code before calling FT_Thunk
348 * (ebp-48) saved EAX register of caller (unclear, never restored???)
349 * (ebp-52) saved EDX register, containing 16-bit thunk target
354 * ESP is EBP-64 after return.
358 void WINAPI
FT_Prolog( CONTEXT86
*context
)
360 /* Build stack frame */
361 stack32_push(context
, EBP_reg(context
));
362 EBP_reg(context
) = ESP_reg(context
);
364 /* Allocate 64-byte Thunk Buffer */
365 ESP_reg(context
) -= 64;
366 memset((char *)ESP_reg(context
), '\0', 64);
368 /* Store Flags (ECX) and Target Address (EDX) */
369 /* Save other registers to be restored later */
370 *(DWORD
*)(EBP_reg(context
) - 4) = EBX_reg(context
);
371 *(DWORD
*)(EBP_reg(context
) - 8) = ESI_reg(context
);
372 *(DWORD
*)(EBP_reg(context
) - 12) = EDI_reg(context
);
373 *(DWORD
*)(EBP_reg(context
) - 16) = ECX_reg(context
);
375 *(DWORD
*)(EBP_reg(context
) - 48) = EAX_reg(context
);
376 *(DWORD
*)(EBP_reg(context
) - 52) = EDX_reg(context
);
379 /**********************************************************************
380 * FT_Thunk (KERNEL32.234)
382 * This routine performs the actual call to 16-bit code,
383 * similar to QT_Thunk. The differences are:
384 * - The call target is taken from the buffer created by FT_Prolog
385 * - Those arguments requested by the thunk code (by setting the
386 * corresponding bit in the bitmap at EBP-20) are converted
387 * from 32-bit pointers to segmented pointers (those pointers
388 * are guaranteed to point to structures copied to the stack
389 * by the thunk code, so we always use the 16-bit stack selector
390 * for those addresses).
392 * The bit #i of EBP-20 corresponds here to the DWORD starting at
395 * FIXME: It is unclear what happens if there are more than 32 WORDs
396 * of arguments, so that the single DWORD bitmap is no longer
400 void WINAPI
FT_Thunk( CONTEXT86
*context
)
402 DWORD mapESPrelative
= *(DWORD
*)(EBP_reg(context
) - 20);
403 DWORD callTarget
= *(DWORD
*)(EBP_reg(context
) - 52);
407 LPBYTE newstack
, oldstack
;
409 memcpy(&context16
,context
,sizeof(context16
));
411 CS_reg(&context16
) = HIWORD(callTarget
);
412 EIP_reg(&context16
) = LOWORD(callTarget
);
413 EBP_reg(&context16
) = OFFSETOF( NtCurrentTeb()->cur_stack
)
414 + (WORD
)&((STACK16FRAME
*)0)->bp
;
416 argsize
= EBP_reg(context
)-ESP_reg(context
)-0x40;
417 newstack
= (LPBYTE
)CURRENT_STACK16
- argsize
;
418 oldstack
= (LPBYTE
)ESP_reg(context
);
420 memcpy( newstack
, oldstack
, argsize
);
422 for (i
= 0; i
< 32; i
++) /* NOTE: What about > 32 arguments? */
423 if (mapESPrelative
& (1 << i
))
425 SEGPTR
*arg
= (SEGPTR
*)(newstack
+ 2*i
);
426 *arg
= PTR_SEG_OFF_TO_SEGPTR(SELECTOROF(NtCurrentTeb()->cur_stack
),
427 OFFSETOF(NtCurrentTeb()->cur_stack
) - argsize
428 + (*(LPBYTE
*)arg
- oldstack
));
431 EAX_reg(context
) = Callbacks
->CallRegisterShortProc( &context16
, argsize
);
432 EDX_reg(context
) = HIWORD(EAX_reg(context
));
433 EAX_reg(context
) = LOWORD(EAX_reg(context
));
435 /* Copy modified buffers back to 32-bit stack */
436 memcpy( oldstack
, newstack
, argsize
);
439 /**********************************************************************
440 * FT_ExitNN (KERNEL32.218 - 232)
442 * One of the FT_ExitNN functions is called at the end of the thunk code.
443 * It removes the stack frame created by FT_Prolog, moves the function
444 * return from EBX to EAX (yes, FT_Thunk did use EAX for the return
445 * value, but the thunk code has moved it from EAX to EBX in the
446 * meantime ... :-), restores the caller's EBX, ESI, and EDI registers,
447 * and perform a return to the CALLER of the thunk code (while removing
448 * the given number of arguments from the caller's stack).
451 static void FT_Exit(CONTEXT86
*context
, int nPopArgs
)
453 /* Return value is in EBX */
454 EAX_reg(context
) = EBX_reg(context
);
456 /* Restore EBX, ESI, and EDI registers */
457 EBX_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 4);
458 ESI_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 8);
459 EDI_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 12);
461 /* Clean up stack frame */
462 ESP_reg(context
) = EBP_reg(context
);
463 EBP_reg(context
) = stack32_pop(context
);
465 /* Pop return address to CALLER of thunk code */
466 EIP_reg(context
) = stack32_pop(context
);
467 /* Remove arguments */
468 ESP_reg(context
) += nPopArgs
;
471 /***********************************************************************
472 * FT_Exit0 (KERNEL32.218)
474 void WINAPI
FT_Exit0 (CONTEXT86
*context
) { FT_Exit(context
, 0); }
476 /***********************************************************************
477 * FT_Exit4 (KERNEL32.219)
479 void WINAPI
FT_Exit4 (CONTEXT86
*context
) { FT_Exit(context
, 4); }
481 /***********************************************************************
482 * FT_Exit8 (KERNEL32.220)
484 void WINAPI
FT_Exit8 (CONTEXT86
*context
) { FT_Exit(context
, 8); }
486 /***********************************************************************
487 * FT_Exit12 (KERNEL32.221)
489 void WINAPI
FT_Exit12(CONTEXT86
*context
) { FT_Exit(context
, 12); }
491 /***********************************************************************
492 * FT_Exit16 (KERNEL32.222)
494 void WINAPI
FT_Exit16(CONTEXT86
*context
) { FT_Exit(context
, 16); }
496 /***********************************************************************
497 * FT_Exit20 (KERNEL32.223)
499 void WINAPI
FT_Exit20(CONTEXT86
*context
) { FT_Exit(context
, 20); }
501 /***********************************************************************
502 * FT_Exit24 (KERNEL32.224)
504 void WINAPI
FT_Exit24(CONTEXT86
*context
) { FT_Exit(context
, 24); }
506 /***********************************************************************
507 * FT_Exit28 (KERNEL32.225)
509 void WINAPI
FT_Exit28(CONTEXT86
*context
) { FT_Exit(context
, 28); }
511 /***********************************************************************
512 * FT_Exit32 (KERNEL32.226)
514 void WINAPI
FT_Exit32(CONTEXT86
*context
) { FT_Exit(context
, 32); }
516 /***********************************************************************
517 * FT_Exit36 (KERNEL32.227)
519 void WINAPI
FT_Exit36(CONTEXT86
*context
) { FT_Exit(context
, 36); }
521 /***********************************************************************
522 * FT_Exit40 (KERNEL32.228)
524 void WINAPI
FT_Exit40(CONTEXT86
*context
) { FT_Exit(context
, 40); }
526 /***********************************************************************
527 * FT_Exit44 (KERNEL32.229)
529 void WINAPI
FT_Exit44(CONTEXT86
*context
) { FT_Exit(context
, 44); }
531 /***********************************************************************
532 * FT_Exit48 (KERNEL32.230)
534 void WINAPI
FT_Exit48(CONTEXT86
*context
) { FT_Exit(context
, 48); }
536 /***********************************************************************
537 * FT_Exit52 (KERNEL32.231)
539 void WINAPI
FT_Exit52(CONTEXT86
*context
) { FT_Exit(context
, 52); }
541 /***********************************************************************
542 * FT_Exit56 (KERNEL32.232)
544 void WINAPI
FT_Exit56(CONTEXT86
*context
) { FT_Exit(context
, 56); }
546 /***********************************************************************
547 * ThunkInitLS (KERNEL32.43)
548 * A thunkbuffer link routine
549 * The thunkbuf looks like:
551 * 00: DWORD length ? don't know exactly
552 * 04: SEGPTR ptr ? where does it point to?
553 * The pointer ptr is written into the first DWORD of 'thunk'.
554 * (probably correctly implemented)
557 * segmented pointer to thunk?
559 DWORD WINAPI
ThunkInitLS(
560 LPDWORD thunk
, /* [in] win32 thunk */
561 LPCSTR thkbuf
, /* [in] thkbuffer name in win16 dll */
562 DWORD len
, /* [in] thkbuffer length */
563 LPCSTR dll16
, /* [in] name of win16 dll */
564 LPCSTR dll32
/* [in] name of win32 dll (FIXME: not used?) */
568 if (!(addr
= _loadthunk( dll16
, thkbuf
, dll32
, NULL
, len
)))
573 *(DWORD
*)thunk
= addr
[1];
578 /***********************************************************************
579 * Common32ThkLS (KERNEL32.45)
581 * This is another 32->16 thunk, independent of the QT_Thunk/FT_Thunk
582 * style thunks. The basic difference is that the parameter conversion
583 * is done completely on the *16-bit* side here. Thus we do not call
584 * the 16-bit target directly, but call a common entry point instead.
585 * This entry function then calls the target according to the target
586 * number passed in the DI register.
588 * Input: EAX SEGPTR to the common 16-bit entry point
589 * CX offset in thunk table (target number * 4)
590 * DX error return value if execution fails (unclear???)
591 * EDX.HI number of DWORD parameters
593 * (Note that we need to move the thunk table offset from CX to DI !)
595 * The called 16-bit stub expects its stack to look like this:
597 * (esp+40) 32-bit arguments
599 * (esp+8) 32 byte of stack space available as buffer
600 * (esp) 8 byte return address for use with 0x66 lret
602 * The called 16-bit stub uses a 0x66 lret to return to 32-bit code,
603 * and uses the EAX register to return a DWORD return value.
604 * Thus we need to use a special assembly glue routine
605 * (CallRegisterLongProc instead of CallRegisterShortProc).
607 * Finally, we return to the caller, popping the arguments off
610 * FIXME: The called function uses EBX to return the number of
611 * arguments that are to be popped off the caller's stack.
612 * This is clobbered by the assembly glue, so we simply use
613 * the original EDX.HI to get the number of arguments.
614 * (Those two values should be equal anyway ...?)
617 void WINAPI
Common32ThkLS( CONTEXT86
*context
)
622 memcpy(&context16
,context
,sizeof(context16
));
624 DI_reg(&context16
) = CX_reg(context
);
625 CS_reg(&context16
) = HIWORD(EAX_reg(context
));
626 EIP_reg(&context16
) = LOWORD(EAX_reg(context
));
627 EBP_reg(&context16
) = OFFSETOF( NtCurrentTeb()->cur_stack
)
628 + (WORD
)&((STACK16FRAME
*)0)->bp
;
630 argsize
= HIWORD(EDX_reg(context
)) * 4;
632 /* FIXME: hack for stupid USER32 CallbackGlueLS routine */
633 if (EDX_reg(context
) == EIP_reg(context
))
636 memcpy( (LPBYTE
)CURRENT_STACK16
- argsize
,
637 (LPBYTE
)ESP_reg(context
), argsize
);
639 EAX_reg(context
) = Callbacks
->CallRegisterLongProc(&context16
, argsize
+ 32);
641 /* Clean up caller's stack frame */
642 ESP_reg(context
) += argsize
;
645 /***********************************************************************
646 * OT_32ThkLSF (KERNEL32.40)
648 * YET Another 32->16 thunk. The difference to Common32ThkLS is that
649 * argument processing is done on both the 32-bit and the 16-bit side:
650 * The 32-bit side prepares arguments, copying them onto the stack.
652 * When this routine is called, the first word on the stack is the
653 * number of argument bytes prepared by the 32-bit code, and EDX
654 * contains the 16-bit target address.
656 * The called 16-bit routine is another relaycode, doing further
657 * argument processing and then calling the real 16-bit target
658 * whose address is stored at [bp-04].
660 * The call proceeds using a normal CallRegisterShortProc.
661 * After return from the 16-bit relaycode, the arguments need
662 * to be copied *back* to the 32-bit stack, since the 32-bit
663 * relaycode processes output parameters.
665 * Note that we copy twice the number of arguments, since some of the
666 * 16-bit relaycodes in SYSTHUNK.DLL directly access the original
667 * arguments of the caller!
669 * (Note that this function seems only to be used for
670 * OLECLI32 -> OLECLI and OLESVR32 -> OLESVR thunking.)
672 void WINAPI
OT_32ThkLSF( CONTEXT86
*context
)
677 memcpy(&context16
,context
,sizeof(context16
));
679 CS_reg(&context16
) = HIWORD(EDX_reg(context
));
680 EIP_reg(&context16
) = LOWORD(EDX_reg(context
));
681 EBP_reg(&context16
) = OFFSETOF( NtCurrentTeb()->cur_stack
)
682 + (WORD
)&((STACK16FRAME
*)0)->bp
;
684 argsize
= 2 * *(WORD
*)ESP_reg(context
) + 2;
686 memcpy( (LPBYTE
)CURRENT_STACK16
- argsize
,
687 (LPBYTE
)ESP_reg(context
), argsize
);
689 EAX_reg(context
) = Callbacks
->CallRegisterShortProc(&context16
, argsize
);
691 memcpy( (LPBYTE
)ESP_reg(context
),
692 (LPBYTE
)CURRENT_STACK16
- argsize
, argsize
);
695 /***********************************************************************
696 * ThunkInitLSF (KERNEL32.41)
697 * A thunk setup routine.
698 * Expects a pointer to a preinitialized thunkbuffer in the first argument
700 * 00..03: unknown (pointer, check _41, _43, _46)
703 * 06..23: unknown (space for replacement code, check .90)
705 * 24:>E800000000 call offset 29
706 * 29:>58 pop eax ( target of call )
707 * 2A: 2D25000000 sub eax,0x00000025 ( now points to offset 4 )
708 * 2F: BAxxxxxxxx mov edx,xxxxxxxx
709 * 34: 68yyyyyyyy push KERNEL32.90
713 * 3E ... 59: unknown (space for replacement code?)
714 * 5A: E8xxxxxxxx call <32bitoffset xxxxxxxx>
716 * 60: 81EA25xxxxxx sub edx, 0x25xxxxxx
718 * 67: 68xxxxxxxx push xxxxxxxx
719 * 6C: 68yyyyyyyy push KERNEL32.89
722 * This function checks if the code is there, and replaces the yyyyyyyy entries
723 * by the functionpointers.
724 * The thunkbuf looks like:
726 * 00: DWORD length ? don't know exactly
727 * 04: SEGPTR ptr ? where does it point to?
728 * The segpointer ptr is written into the first DWORD of 'thunk'.
731 * unclear, pointer to win16 thkbuffer?
733 LPVOID WINAPI
ThunkInitLSF(
734 LPBYTE thunk
, /* [in] win32 thunk */
735 LPCSTR thkbuf
, /* [in] thkbuffer name in win16 dll */
736 DWORD len
, /* [in] length of thkbuffer */
737 LPCSTR dll16
, /* [in] name of win16 dll */
738 LPCSTR dll32
/* [in] name of win32 dll */
740 HMODULE hkrnl32
= GetModuleHandleA("KERNEL32");
743 /* FIXME: add checks for valid code ... */
744 /* write pointers to kernel32.89 and kernel32.90 (+ordinal base of 1) */
745 *(DWORD
*)(thunk
+0x35) = (DWORD
)GetProcAddress(hkrnl32
,(LPSTR
)90);
746 *(DWORD
*)(thunk
+0x6D) = (DWORD
)GetProcAddress(hkrnl32
,(LPSTR
)89);
749 if (!(addr
= _loadthunk( dll16
, thkbuf
, dll32
, NULL
, len
)))
752 addr2
= PTR_SEG_TO_LIN(addr
[1]);
754 *(DWORD
*)thunk
= (DWORD
)addr2
;
759 /***********************************************************************
760 * FT_PrologPrime (KERNEL32.89)
762 * This function is called from the relay code installed by
763 * ThunkInitLSF. It replaces the location from where it was
764 * called by a standard FT_Prolog call stub (which is 'primed'
765 * by inserting the correct target table pointer).
766 * Finally, it calls that stub.
768 * Input: ECX target number + flags (passed through to FT_Prolog)
769 * (ESP) offset of location where target table pointer
770 * is stored, relative to the start of the relay code
771 * (ESP+4) pointer to start of relay code
772 * (this is where the FT_Prolog call stub gets written to)
774 * Note: The two DWORD arguments get popped off the stack.
777 void WINAPI
FT_PrologPrime( CONTEXT86
*context
)
779 DWORD targetTableOffset
;
782 /* Compensate for the fact that the Wine register relay code thought
783 we were being called, although we were in fact jumped to */
784 ESP_reg(context
) -= 4;
786 /* Write FT_Prolog call stub */
787 targetTableOffset
= stack32_pop(context
);
788 relayCode
= (LPBYTE
)stack32_pop(context
);
789 _write_ftprolog( relayCode
, *(DWORD
**)(relayCode
+targetTableOffset
) );
791 /* Jump to the call stub just created */
792 EIP_reg(context
) = (DWORD
)relayCode
;
795 /***********************************************************************
796 * QT_ThunkPrime (KERNEL32.90)
798 * This function corresponds to FT_PrologPrime, but installs a
799 * call stub for QT_Thunk instead.
801 * Input: (EBP-4) target number (passed through to QT_Thunk)
802 * EDX target table pointer location offset
803 * EAX start of relay code
806 void WINAPI
QT_ThunkPrime( CONTEXT86
*context
)
808 DWORD targetTableOffset
;
811 /* Compensate for the fact that the Wine register relay code thought
812 we were being called, although we were in fact jumped to */
813 ESP_reg(context
) -= 4;
815 /* Write QT_Thunk call stub */
816 targetTableOffset
= EDX_reg(context
);
817 relayCode
= (LPBYTE
)EAX_reg(context
);
818 _write_qtthunk( relayCode
, *(DWORD
**)(relayCode
+targetTableOffset
) );
820 /* Jump to the call stub just created */
821 EIP_reg(context
) = (DWORD
)relayCode
;
824 /***********************************************************************
825 * ThunkInitSL (KERNEL32.46)
826 * Another thunkbuf link routine.
827 * The start of the thunkbuf looks like this:
829 * 04: SEGPTR address for thunkbuffer pointer
832 VOID WINAPI
ThunkInitSL(
833 LPBYTE thunk
, /* [in] start of thunkbuffer */
834 LPCSTR thkbuf
, /* [in] name/ordinal of thunkbuffer in win16 dll */
835 DWORD len
, /* [in] length of thunkbuffer */
836 LPCSTR dll16
, /* [in] name of win16 dll containing the thkbuf */
837 LPCSTR dll32
/* [in] win32 dll. FIXME: strange, unused */
841 if (!(addr
= _loadthunk( dll16
, thkbuf
, dll32
, NULL
, len
)))
844 *(DWORD
*)PTR_SEG_TO_LIN(addr
[1]) = (DWORD
)thunk
;
847 /**********************************************************************
852 BOOL WINAPI
SSInit16()
857 /**********************************************************************
858 * SSOnBigStack KERNEL32.87
859 * Check if thunking is initialized (ss selector set up etc.)
860 * We do that differently, so just return TRUE.
865 BOOL WINAPI
SSOnBigStack()
867 TRACE("Yes, thunking is initialized\n");
871 /**********************************************************************
872 * SSConfirmSmallStack KERNEL.704
874 * Abort if not on small stack.
876 * This must be a register routine as it has to preserve *all* registers.
878 void WINAPI
SSConfirmSmallStack( CONTEXT86
*context
)
880 /* We are always on the small stack while in 16-bit code ... */
883 /**********************************************************************
885 * One of the real thunking functions. This one seems to be for 32<->32
886 * thunks. It should probably be capable of crossing processboundaries.
888 * And YES, I've seen nr=48 (somewhere in the Win95 32<->16 OLE coupling)
891 DWORD WINAPIV
SSCall(
892 DWORD nr
, /* [in] number of argument bytes */
893 DWORD flags
, /* [in] FIXME: flags ? */
894 FARPROC fun
, /* [in] function to call */
895 ... /* [in/out] arguments */
898 DWORD
*args
= ((DWORD
*)&fun
) + 1;
902 DPRINTF("(%ld,0x%08lx,%p,[",nr
,flags
,fun
);
904 DPRINTF("0x%08lx,",args
[i
]);
910 case 4: ret
= fun(args
[0]);
912 case 8: ret
= fun(args
[0],args
[1]);
914 case 12: ret
= fun(args
[0],args
[1],args
[2]);
916 case 16: ret
= fun(args
[0],args
[1],args
[2],args
[3]);
918 case 20: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4]);
920 case 24: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5]);
922 case 28: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6]);
924 case 32: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7]);
926 case 36: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8]);
928 case 40: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9]);
930 case 44: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9],args
[10]);
932 case 48: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9],args
[10],args
[11]);
935 WARN("Unsupported nr of arguments, %ld\n",nr
);
940 TRACE(" returning %ld ...\n",ret
);
944 /**********************************************************************
945 * W32S_BackTo32 (KERNEL32.51)
947 void WINAPI
W32S_BackTo32( CONTEXT86
*context
)
949 LPDWORD stack
= (LPDWORD
)ESP_reg( context
);
950 FARPROC proc
= (FARPROC
)EIP_reg(context
);
952 EAX_reg( context
) = proc( stack
[1], stack
[2], stack
[3], stack
[4], stack
[5],
953 stack
[6], stack
[7], stack
[8], stack
[9], stack
[10] );
955 EIP_reg( context
) = stack32_pop(context
);
958 /**********************************************************************
959 * AllocSLCallback (KERNEL32)
961 * Win95 uses some structchains for callbacks. It allocates them
962 * in blocks of 100 entries, size 32 bytes each, layout:
964 * 0: PTR nextblockstart
966 * 8: WORD sel ( start points to blockstart)
970 * 18: PDB *owning_process;
973 * We ignore this for now. (Just a note for further developers)
974 * FIXME: use this method, so we don't waste selectors...
976 * Following code is then generated by AllocSLCallback. The code is 16 bit, so
977 * the 0x66 prefix switches from word->long registers.
980 * 6668x arg2 x pushl <arg2>
982 * EAx arg1 x jmpf <arg1>
984 * returns the startaddress of this thunk.
986 * Note, that they look very similair to the ones allocates by THUNK_Alloc.
988 * segmented pointer to the start of the thunk
992 DWORD finalizer
, /* [in] finalizer function */
993 DWORD callback
/* [in] callback function */
995 LPBYTE x
,thunk
= HeapAlloc( GetProcessHeap(), 0, 32 );
999 *x
++=0x66;*x
++=0x5a; /* popl edx */
1000 *x
++=0x66;*x
++=0x68;*(DWORD
*)x
=finalizer
;x
+=4; /* pushl finalizer */
1001 *x
++=0x66;*x
++=0x52; /* pushl edx */
1002 *x
++=0xea;*(DWORD
*)x
=callback
;x
+=4; /* jmpf callback */
1004 *(PDB
**)(thunk
+18) = PROCESS_Current();
1006 sel
= SELECTOR_AllocBlock( thunk
, 32, SEGMENT_CODE
, FALSE
, FALSE
);
1010 /**********************************************************************
1011 * FreeSLCallback (KERNEL32.274)
1012 * Frees the specified 16->32 callback
1016 DWORD x
/* [in] 16 bit callback (segmented pointer?) */
1018 FIXME_(win32
)("(0x%08lx): stub\n",x
);
1022 /**********************************************************************
1023 * GetTEBSelectorFS (KERNEL.475)
1024 * Set the 16-bit %fs to the 32-bit %fs (current TEB selector)
1026 void WINAPI
GetTEBSelectorFS16(void)
1028 CURRENT_STACK16
->fs
= __get_fs();
1031 /**********************************************************************
1032 * KERNEL_431 (KERNEL.431)
1033 * IsPeFormat (W32SYS.2)
1034 * Checks the passed filename if it is a PE format executeable
1039 BOOL16 WINAPI
IsPeFormat16(
1040 LPSTR fn
, /* [in] filename to executeable */
1041 HFILE16 hf16
/* [in] open file, if filename is NULL */
1043 IMAGE_DOS_HEADER mzh
;
1044 HFILE hf
=FILE_GetHandle(hf16
);
1049 hf
= OpenFile(fn
,&ofs
,OF_READ
);
1050 if (hf
==HFILE_ERROR
)
1053 _llseek(hf
,0,SEEK_SET
);
1054 if (sizeof(mzh
)!=_lread(hf
,&mzh
,sizeof(mzh
))) {
1058 if (mzh
.e_magic
!=IMAGE_DOS_SIGNATURE
) {
1059 WARN("File has not got dos signature!\n");
1063 _llseek(hf
,mzh
.e_lfanew
,SEEK_SET
);
1064 if (sizeof(DWORD
)!=_lread(hf
,&xmagic
,sizeof(DWORD
))) {
1069 return (xmagic
== IMAGE_NT_SIGNATURE
);
1073 /***********************************************************************
1074 * K32Thk1632Prolog (KERNEL32.492)
1076 void WINAPI
K32Thk1632Prolog( CONTEXT86
*context
)
1078 LPBYTE code
= (LPBYTE
)EIP_reg(context
) - 5;
1080 /* Arrrgh! SYSTHUNK.DLL just has to re-implement another method
1081 of 16->32 thunks instead of using one of the standard methods!
1082 This means that SYSTHUNK.DLL itself switches to a 32-bit stack,
1083 and does a far call to the 32-bit code segment of OLECLI32/OLESVR32.
1084 Unfortunately, our CallTo/CallFrom mechanism is therefore completely
1085 bypassed, which means it will crash the next time the 32-bit OLE
1086 code thunks down again to 16-bit (this *will* happen!).
1088 The following hack tries to recognize this situation.
1089 This is possible since the called stubs in OLECLI32/OLESVR32 all
1090 look exactly the same:
1091 00 E8xxxxxxxx call K32Thk1632Prolog
1092 05 FF55FC call [ebp-04]
1093 08 E8xxxxxxxx call K32Thk1632Epilog
1096 If we recognize this situation, we try to simulate the actions
1097 of our CallTo/CallFrom mechanism by copying the 16-bit stack
1098 to our 32-bit stack, creating a proper STACK16FRAME and
1099 updating cur_stack. */
1101 if ( code
[5] == 0xFF && code
[6] == 0x55 && code
[7] == 0xFC
1102 && code
[13] == 0x66 && code
[14] == 0xCB)
1104 WORD stackSel
= NtCurrentTeb()->stack_sel
;
1105 DWORD stackBase
= GetSelectorBase(stackSel
);
1107 DWORD argSize
= EBP_reg(context
) - ESP_reg(context
);
1108 char *stack16
= (char *)ESP_reg(context
) - 4;
1109 char *stack32
= (char *)NtCurrentTeb()->cur_stack
- argSize
;
1110 STACK16FRAME
*frame16
= (STACK16FRAME
*)stack16
- 1;
1112 TRACE("before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1113 EBP_reg(context
), ESP_reg(context
), NtCurrentTeb()->cur_stack
);
1115 memset(frame16
, '\0', sizeof(STACK16FRAME
));
1116 frame16
->frame32
= (STACK32FRAME
*)NtCurrentTeb()->cur_stack
;
1117 frame16
->ebp
= EBP_reg(context
);
1119 memcpy(stack32
, stack16
, argSize
);
1120 NtCurrentTeb()->cur_stack
= PTR_SEG_OFF_TO_SEGPTR(stackSel
, (DWORD
)frame16
- stackBase
);
1122 ESP_reg(context
) = (DWORD
)stack32
+ 4;
1123 EBP_reg(context
) = ESP_reg(context
) + argSize
;
1125 TRACE("after SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1126 EBP_reg(context
), ESP_reg(context
), NtCurrentTeb()->cur_stack
);
1129 SYSLEVEL_ReleaseWin16Lock();
1132 /***********************************************************************
1133 * K32Thk1632Epilog (KERNEL32.491)
1135 void WINAPI
K32Thk1632Epilog( CONTEXT86
*context
)
1137 LPBYTE code
= (LPBYTE
)EIP_reg(context
) - 13;
1139 SYSLEVEL_RestoreWin16Lock();
1141 /* We undo the SYSTHUNK hack if necessary. See K32Thk1632Prolog. */
1143 if ( code
[5] == 0xFF && code
[6] == 0x55 && code
[7] == 0xFC
1144 && code
[13] == 0x66 && code
[14] == 0xCB)
1146 STACK16FRAME
*frame16
= (STACK16FRAME
*)PTR_SEG_TO_LIN(NtCurrentTeb()->cur_stack
);
1147 char *stack16
= (char *)(frame16
+ 1);
1148 DWORD argSize
= frame16
->ebp
- (DWORD
)stack16
;
1149 char *stack32
= (char *)frame16
->frame32
- argSize
;
1151 DWORD nArgsPopped
= ESP_reg(context
) - (DWORD
)stack32
;
1153 TRACE("before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1154 EBP_reg(context
), ESP_reg(context
), NtCurrentTeb()->cur_stack
);
1156 NtCurrentTeb()->cur_stack
= (DWORD
)frame16
->frame32
;
1158 ESP_reg(context
) = (DWORD
)stack16
+ nArgsPopped
;
1159 EBP_reg(context
) = frame16
->ebp
;
1161 TRACE("after SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1162 EBP_reg(context
), ESP_reg(context
), NtCurrentTeb()->cur_stack
);
1166 /***********************************************************************
1167 * UpdateResourceA (KERNEL32.707)
1169 BOOL WINAPI
UpdateResourceA(
1177 FIXME_(win32
)(": stub\n");
1178 SetLastError(ERROR_CALL_NOT_IMPLEMENTED
);
1182 /***********************************************************************
1183 * UpdateResourceW (KERNEL32.708)
1185 BOOL WINAPI
UpdateResourceW(
1193 FIXME_(win32
)(": stub\n");
1194 SetLastError(ERROR_CALL_NOT_IMPLEMENTED
);
1199 /***********************************************************************
1200 * WaitNamedPipeA [KERNEL32.725]
1202 BOOL WINAPI
WaitNamedPipeA (LPCSTR lpNamedPipeName
, DWORD nTimeOut
)
1203 { FIXME_(win32
)("%s 0x%08lx\n",lpNamedPipeName
,nTimeOut
);
1204 SetLastError(ERROR_PIPE_NOT_CONNECTED
);
1207 /***********************************************************************
1208 * WaitNamedPipeW [KERNEL32.726]
1210 BOOL WINAPI
WaitNamedPipeW (LPCWSTR lpNamedPipeName
, DWORD nTimeOut
)
1211 { FIXME_(win32
)("%s 0x%08lx\n",debugstr_w(lpNamedPipeName
),nTimeOut
);
1212 SetLastError(ERROR_PIPE_NOT_CONNECTED
);
1216 /*********************************************************************
1217 * PK16FNF [KERNEL32.91]
1219 * This routine fills in the supplied 13-byte (8.3 plus terminator)
1220 * string buffer with the 8.3 filename of a recently loaded 16-bit
1221 * module. It is unknown exactly what modules trigger this
1222 * mechanism or what purpose this serves. Win98 Explorer (and
1223 * probably also Win95 with IE 4 shell integration) calls this
1224 * several times during initialization.
1226 * FIXME: find out what this really does and make it work.
1228 void WINAPI
PK16FNF(LPSTR strPtr
)
1230 FIXME_(win32
)("(%p): stub\n", strPtr
);
1232 /* fill in a fake filename that'll be easy to recognize */
1233 lstrcpyA(strPtr
, "WINESTUB.FIX");