2 * 386-specific Win16 dll<->dll snooping functions
4 * Copyright 1998 Marcus Meissner
15 #include "selectors.h"
16 #include "stackframe.h"
17 #include "builtin16.h"
19 #include "debugtools.h"
21 DEFAULT_DEBUG_CHANNEL(snoop
);
27 void WINAPI
SNOOP16_Entry(FARPROC proc
, LPBYTE args
, CONTEXT86
*context
);
28 void WINAPI
SNOOP16_Return(FARPROC proc
, LPBYTE args
, CONTEXT86
*context
);
30 typedef struct tagSNOOP16_FUN
{
32 BYTE lcall
; /* 0x9a call absolute with segment */
40 typedef struct tagSNOOP16_DLL
{
45 struct tagSNOOP16_DLL
*next
;
48 typedef struct tagSNOOP16_RETURNENTRY
{
50 BYTE lcall
; /* 0x9a call absolute with segment */
57 WORD
*args
; /* saved args across a stdcall */
58 } SNOOP16_RETURNENTRY
;
60 typedef struct tagSNOOP16_RETURNENTRIES
{
61 SNOOP16_RETURNENTRY entry
[65500/sizeof(SNOOP16_RETURNENTRY
)];
63 struct tagSNOOP16_RETURNENTRIES
*next
;
64 } SNOOP16_RETURNENTRIES
;
66 typedef struct tagSNOOP16_RELAY
{
67 WORD pushbp
; /* 0x5566 */
68 BYTE pusheax
; /* 0x50 */
69 WORD pushax
; /* 0x5066 */
70 BYTE pushl
; /* 0x68 */
71 DWORD realfun
; /* SNOOP16_Return */
72 BYTE lcall
; /* 0x9a call absolute with segment */
75 WORD lret
; /* 0xcb66 */
80 static SNOOP16_DLL
*firstdll
= NULL
;
81 static SNOOP16_RETURNENTRIES
*firstrets
= NULL
;
82 static SNOOP16_RELAY
*snr
;
83 static HANDLE16 xsnr
= 0;
86 SNOOP16_RegisterDLL(NE_MODULE
*pModule
,LPCSTR name
) {
87 SNOOP16_DLL
**dll
= &(firstdll
);
90 if (!TRACE_ON(snoop
)) return;
92 xsnr
=GLOBAL_Alloc(GMEM_ZEROINIT
,2*sizeof(*snr
),0,TRUE
,TRUE
,FALSE
);
93 snr
= GlobalLock16(xsnr
);
94 snr
[0].pushbp
= 0x5566;
95 snr
[0].pusheax
= 0x50;
96 snr
[0].pushax
= 0x5066;
98 snr
[0].realfun
= (DWORD
)SNOOP16_Entry
;
100 snr
[0].callfromregs
= (DWORD
)CallFrom16Register
;
101 snr
[0].seg
= __get_cs();
102 snr
[0].lret
= 0xcb66;
104 snr
[1].pushbp
= 0x5566;
105 snr
[1].pusheax
= 0x50;
106 snr
[1].pushax
= 0x5066;
108 snr
[1].realfun
= (DWORD
)SNOOP16_Return
;
110 snr
[1].callfromregs
= (DWORD
)CallFrom16Register
;
111 snr
[1].seg
= __get_cs();
112 snr
[1].lret
= 0xcb66;
115 if ((*dll
)->hmod
== pModule
->self
)
116 return; /* already registered */
117 dll
= &((*dll
)->next
);
119 *dll
= (SNOOP16_DLL
*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY
,sizeof(SNOOP16_DLL
));
121 (*dll
)->hmod
= pModule
->self
;
122 if ((s
=strrchr(name
,'\\')))
124 (*dll
)->name
= HEAP_strdupA(GetProcessHeap(),0,name
);
125 if ((s
=strrchr((*dll
)->name
,'.')))
127 (*dll
)->funhandle
= GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT
,65535,0,TRUE
,FALSE
,FALSE
));
128 (*dll
)->funs
= GlobalLock16((*dll
)->funhandle
);
130 HeapFree(GetProcessHeap(),0,*dll
);
131 FIXME("out of memory\n");
134 memset((*dll
)->funs
,0,65535);
138 SNOOP16_GetProcAddress16(HMODULE16 hmod
,DWORD ordinal
,FARPROC16 origfun
) {
139 SNOOP16_DLL
*dll
= firstdll
;
141 NE_MODULE
*pModule
= NE_GetPtr(hmod
);
145 if (!TRACE_ON(snoop
) || !pModule
|| !HIWORD(origfun
))
147 if (!*(LPBYTE
)PTR_SEG_TO_LIN(origfun
)) /* 0x00 is an imposs. opcode, poss. dataref. */
150 if (hmod
== dll
->hmod
)
154 if (!dll
) /* probably internal */
156 if (ordinal
>65535/sizeof(SNOOP16_FUN
))
158 fun
= dll
->funs
+ordinal
;
161 fun
->snr
= MAKELONG(0,xsnr
);
162 fun
->origfun
= origfun
;
164 return (FARPROC16
)(SEGPTR
)MAKELONG(((char*)fun
-(char*)dll
->funs
),dll
->funhandle
);
165 cpnt
= (unsigned char *)pModule
+ pModule
->name_table
;
167 cpnt
+= *cpnt
+ 1 + sizeof(WORD
);
168 if (*(WORD
*)(cpnt
+*cpnt
+1) == ordinal
) {
169 sprintf(name
,"%.*s",*cpnt
,cpnt
+1);
173 /* Now search the non-resident names table */
175 if (!*cpnt
&& pModule
->nrname_handle
) {
176 cpnt
= (char *)GlobalLock16( pModule
->nrname_handle
);
178 cpnt
+= *cpnt
+ 1 + sizeof(WORD
);
179 if (*(WORD
*)(cpnt
+*cpnt
+1) == ordinal
) {
180 sprintf(name
,"%.*s",*cpnt
,cpnt
+1);
186 fun
->name
= HEAP_strdupA(GetProcessHeap(),0,name
);
188 fun
->name
= HEAP_strdupA(GetProcessHeap(),0,"");
189 if (!SNOOP_ShowDebugmsgSnoop(dll
->name
, ordinal
, fun
->name
))
192 /* more magic. do not try to snoop thunk data entries (MMSYSTEM) */
193 if (strchr(fun
->name
,'_')) {
194 char *s
=strchr(fun
->name
,'_');
196 if (!strncasecmp(s
,"_thunkdata",10)) {
197 HeapFree(GetProcessHeap(),0,fun
->name
);
203 fun
->snr
= MAKELONG(0,xsnr
);
204 fun
->origfun
= origfun
;
206 return (FARPROC16
)(SEGPTR
)MAKELONG(((char*)fun
-(char*)dll
->funs
),dll
->funhandle
);
209 #define CALLER1REF (*(DWORD*)(PTR_SEG_OFF_TO_LIN(SS_reg(context),LOWORD(ESP_reg(context))+4)))
210 void WINAPI
SNOOP16_Entry(FARPROC proc
, LPBYTE args
, CONTEXT86
*context
) {
212 DWORD entry
=(DWORD
)PTR_SEG_OFF_TO_LIN(CS_reg(context
),LOWORD(EIP_reg(context
)))-5;
213 WORD xcs
= CS_reg(context
);
214 SNOOP16_DLL
*dll
= firstdll
;
215 SNOOP16_FUN
*fun
= NULL
;
216 SNOOP16_RETURNENTRIES
**rets
= &firstrets
;
217 SNOOP16_RETURNENTRY
*ret
;
221 if (xcs
== dll
->funhandle
) {
222 fun
= (SNOOP16_FUN
*)entry
;
223 ordinal
= fun
-dll
->funs
;
229 FIXME("entrypoint 0x%08lx not found\n",entry
);
233 for (i
=0;i
<sizeof((*rets
)->entry
)/sizeof((*rets
)->entry
[0]);i
++)
234 if (!(*rets
)->entry
[i
].origreturn
)
236 if (i
!=sizeof((*rets
)->entry
)/sizeof((*rets
)->entry
[0]))
238 rets
= &((*rets
)->next
);
241 HANDLE16 hand
= GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT
,65535,0,TRUE
,FALSE
,FALSE
));
242 *rets
= GlobalLock16(hand
);
243 memset(*rets
,0,65535);
244 (*rets
)->rethandle
= hand
;
245 i
= 0; /* entry 0 is free */
247 ret
= &((*rets
)->entry
[i
]);
249 ret
->snr
= MAKELONG(sizeof(SNOOP16_RELAY
),xsnr
);
250 ret
->origreturn
= (FARPROC16
)CALLER1REF
;
251 CALLER1REF
= MAKELONG((char*)&(ret
->lcall
)-(char*)((*rets
)->entry
),(*rets
)->rethandle
);
254 ret
->ordinal
= ordinal
;
255 ret
->origSP
= LOWORD(ESP_reg(context
));
257 EIP_reg(context
)= LOWORD(fun
->origfun
);
258 CS_reg(context
) = HIWORD(fun
->origfun
);
261 DPRINTF("CALL %s.%ld: %s(",dll
->name
,ordinal
,fun
->name
);
262 if (fun
->nrofargs
>0) {
266 DPRINTF("%04x%s",*(WORD
*)((char *) PTR_SEG_OFF_TO_LIN(SS_reg(context
),LOWORD(ESP_reg(context
)))+8+sizeof(WORD
)*i
),i
?",":"");
267 if (max
!=fun
->nrofargs
)
269 } else if (fun
->nrofargs
<0) {
270 DPRINTF("<unknown, check return>");
271 ret
->args
= HeapAlloc(GetProcessHeap(),0,16*sizeof(WORD
));
272 memcpy(ret
->args
,(LPBYTE
)((char *) PTR_SEG_OFF_TO_LIN(SS_reg(context
),LOWORD(ESP_reg(context
)))+8),sizeof(WORD
)*16);
274 DPRINTF(") ret=%04x:%04x\n",HIWORD(ret
->origreturn
),LOWORD(ret
->origreturn
));
277 void WINAPI
SNOOP16_Return(FARPROC proc
, LPBYTE args
, CONTEXT86
*context
) {
278 SNOOP16_RETURNENTRY
*ret
= (SNOOP16_RETURNENTRY
*)((char *) PTR_SEG_OFF_TO_LIN(CS_reg(context
),LOWORD(EIP_reg(context
)))-5);
280 /* We haven't found out the nrofargs yet. If we called a cdecl
281 * function it is too late anyway and we can just set '0' (which
282 * will be the difference between orig and current SP
283 * If pascal -> everything ok.
285 if (ret
->dll
->funs
[ret
->ordinal
].nrofargs
<0) {
286 ret
->dll
->funs
[ret
->ordinal
].nrofargs
=(LOWORD(ESP_reg(context
))-ret
->origSP
-4)/2;
288 EIP_reg(context
) = LOWORD(ret
->origreturn
);
289 CS_reg(context
) = HIWORD(ret
->origreturn
);
293 DPRINTF("RET %s.%ld: %s(",ret
->dll
->name
,ret
->ordinal
,ret
->dll
->funs
[ret
->ordinal
].name
);
294 max
= ret
->dll
->funs
[ret
->ordinal
].nrofargs
;
301 DPRINTF("%04x%s",ret
->args
[i
],i
?",":"");
302 if (max
!=ret
->dll
->funs
[ret
->ordinal
].nrofargs
)
304 DPRINTF(") retval = %04x:%04x ret=%04x:%04x\n",
305 DX_reg(context
),AX_reg(context
),HIWORD(ret
->origreturn
),LOWORD(ret
->origreturn
)
307 HeapFree(GetProcessHeap(),0,ret
->args
);
310 DPRINTF("RET %s.%ld: %s() retval = %04x:%04x ret=%04x:%04x\n",
311 ret
->dll
->name
,ret
->ordinal
,ret
->dll
->funs
[ret
->ordinal
].name
,
312 DX_reg(context
),AX_reg(context
),HIWORD(ret
->origreturn
),LOWORD(ret
->origreturn
)
314 ret
->origreturn
= NULL
; /* mark as empty */
316 #else /* !__i386__ */
317 void SNOOP16_RegisterDLL(NE_MODULE
*pModule
,LPCSTR name
) {
318 FIXME("snooping works only on i386 for now.\n");
322 FARPROC16
SNOOP16_GetProcAddress16(HMODULE16 hmod
,DWORD ordinal
,FARPROC16 origfun
) {
325 #endif /* !__i386__ */