relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21 #include "config.h"
  22 #include "wine/port.h"
  23
  24 #include <assert.h>
  25 #include <stdio.h>
  26 #include <string.h>
  27 #include "winternl.h"
  28 #include "snoop.h"
  29 #include "wine/debug.h"
  30 #include "wine/exception.h"
  31 #include "excpt.h"
  32 #include "ntdll_misc.h"
  33
  34 WINE_DEFAULT_DEBUG_CHANNEL(snoop);
  35 WINE_DECLARE_DEBUG_CHANNEL(seh);
  36
  37 static WINE_EXCEPTION_FILTER(page_fault)
  38 {
  39     if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ||
  40         GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION)
  41         return EXCEPTION_EXECUTE_HANDLER;
  42     return EXCEPTION_CONTINUE_SEARCH;
  43 }
  44
  45 extern const char **debug_snoop_excludelist;
  46 extern const char **debug_snoop_includelist;
  47
  48 #ifdef __i386__
  49
  50 extern void WINAPI SNOOP_Entry();
  51 extern void WINAPI SNOOP_Return();
  52
  53 #include "pshpack1.h"
  54
  55 typedef struct tagSNOOP_FUN {
  56         /* code part */
  57         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  58         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  59          * calculation!
  60          */
  61         DWORD           snoopentry;     /* SNOOP_Entry relative */
  62         /* unreached */
  63         int             nrofargs;
  64         FARPROC origfun;
  65         const char *name;
  66 } SNOOP_FUN;
  67
  68 typedef struct tagSNOOP_DLL {
  69         HMODULE hmod;
  70         SNOOP_FUN       *funs;
  71         DWORD           ordbase;
  72         DWORD           nrofordinals;
  73         struct tagSNOOP_DLL     *next;
  74         char name[1];
  75 } SNOOP_DLL;
  76
  77 typedef struct tagSNOOP_RETURNENTRY {
  78         /* code part */
  79         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  80         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  81          * calculation!
  82          */
  83         DWORD           snoopret;       /* SNOOP_Ret relative */
  84         /* unreached */
  85         FARPROC origreturn;
  86         SNOOP_DLL       *dll;
  87         DWORD           ordinal;
  88         DWORD           origESP;
  89         DWORD           *args;          /* saved args across a stdcall */
  90 } SNOOP_RETURNENTRY;
  91
  92 typedef struct tagSNOOP_RETURNENTRIES {
  93         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  94         struct tagSNOOP_RETURNENTRIES   *next;
  95 } SNOOP_RETURNENTRIES;
  96
  97 #include "poppack.h"
  98
  99 static  SNOOP_DLL               *firstdll = NULL;
 100 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
 101
 102 /***********************************************************************
 103  *          SNOOP_ShowDebugmsgSnoop
 104  *
 105  * Simple function to decide if a particular debugging message is
 106  * wanted.
 107  */
 108 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
 109
 110   if(debug_snoop_excludelist || debug_snoop_includelist) {
 111     const char **listitem;
 112     char buf[80];
 113     int len, len2, itemlen, show;
 114
 115     if(debug_snoop_excludelist) {
 116       show = 1;
 117       listitem = debug_snoop_excludelist;
 118     } else {
 119       show = 0;
 120       listitem = debug_snoop_includelist;
 121     }
 122     len = strlen(dll);
 123     assert(len < 64);
 124     sprintf(buf, "%s.%d", dll, ord);
 125     len2 = strlen(buf);
 126     for(; *listitem; listitem++) {
 127       itemlen = strlen(*listitem);
 128       if((itemlen == len && !strncasecmp(*listitem, buf, len)) ||
 129          (itemlen == len2 && !strncasecmp(*listitem, buf, len2)) ||
 130          !strcasecmp(*listitem, fname)) {
 131         show = !show;
 132        break;
 133       }
 134     }
 135     return show;
 136   }
 137   return 1;
 138 }
 139
 140 void
 141 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD ordbase,DWORD nrofordinals) {
 142         SNOOP_DLL       **dll = &(firstdll);
 143         char            *s;
 144         void            *addr;
 145         SIZE_T          size;
 146
 147     TRACE("hmod=%p, name=%s, ordbase=%ld, nrofordinals=%ld\n",
 148            hmod, name, ordbase, nrofordinals);
 149
 150         if (!TRACE_ON(snoop)) return;
 151         while (*dll) {
 152                 if ((*dll)->hmod == hmod)
 153                 {
 154                     /* another dll, loaded at the same address */
 155                     addr = (*dll)->funs;
 156                     size = (*dll)->nrofordinals * sizeof(SNOOP_FUN);
 157                     NtFreeVirtualMemory(GetCurrentProcess(), &addr, &size, MEM_RELEASE);
 158                     break;
 159                 }
 160                 dll = &((*dll)->next);
 161         }
 162         *dll = RtlReAllocateHeap(ntdll_get_process_heap(),
 163                                  HEAP_ZERO_MEMORY, *dll,
 164                                  sizeof(SNOOP_DLL) + strlen(name));
 165         (*dll)->hmod    = hmod;
 166         (*dll)->ordbase = ordbase;
 167         (*dll)->nrofordinals = nrofordinals;
 168         strcpy( (*dll)->name, name );
 169         if ((s=strrchr((*dll)->name,'.')))
 170                 *s='\0';
 171         size = nrofordinals * sizeof(SNOOP_FUN);
 172         NtAllocateVirtualMemory(GetCurrentProcess(), &addr, NULL, &size,
 173                                 MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
 174         if (!addr) {
 175                 RtlFreeHeap(ntdll_get_process_heap(),0,*dll);
 176                 FIXME("out of memory\n");
 177                 return;
 178         }
 179         (*dll)->funs = addr;
 180         memset((*dll)->funs,0,size);
 181 }
 182
 183 FARPROC SNOOP_GetProcAddress( HMODULE hmod, IMAGE_EXPORT_DIRECTORY *exports, DWORD exp_size,
 184                               FARPROC origfun, DWORD ordinal )
 185 {
 186         int i;
 187         const char *ename;
 188         WORD *ordinals;
 189         DWORD *names;
 190         SNOOP_DLL                       *dll = firstdll;
 191         SNOOP_FUN                       *fun;
 192         IMAGE_SECTION_HEADER *sec;
 193
 194         if (!TRACE_ON(snoop)) return origfun;
 195         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 196                 return origfun;
 197
 198         sec = RtlImageRvaToSection( RtlImageNtHeader(hmod), hmod, (char *)origfun - (char *)hmod );
 199
 200         if (!sec || !(sec->Characteristics & IMAGE_SCN_CNT_CODE))
 201             return origfun;  /* most likely a data reference */
 202
 203         while (dll) {
 204                 if (hmod == dll->hmod)
 205                         break;
 206                 dll=dll->next;
 207         }
 208         if (!dll)       /* probably internal */
 209                 return origfun;
 210
 211         /* try to find a name for it */
 212         ename = NULL;
 213         names = (DWORD *)((char *)hmod + exports->AddressOfNames);
 214         ordinals = (WORD *)((char *)hmod + exports->AddressOfNameOrdinals);
 215         if (names) for (i = 0; i < exports->NumberOfNames; i++)
 216         {
 217             if (ordinals[i] == ordinal)
 218             {
 219                 ename = (char *)hmod + names[i];
 220                 break;
 221             }
 222         }
 223         if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,ename))
 224                 return origfun;
 225         assert(ordinal < dll->nrofordinals);
 226         fun = dll->funs+ordinal;
 227         if (!fun->name)
 228           {
 229             fun->name = ename;
 230             fun->lcall  = 0xe8;
 231             /* NOTE: origreturn struct member MUST come directly after snoopentry */
 232             fun->snoopentry     = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 233             fun->origfun        = origfun;
 234             fun->nrofargs       = -1;
 235           }
 236         return (FARPROC)&(fun->lcall);
 237 }
 238
 239 static void SNOOP_PrintArg(DWORD x)
 240 {
 241     int i,nostring;
 242
 243     DPRINTF("%08lx",x);
 244     if (!HIWORD(x) || TRACE_ON(seh)) return; /* trivial reject to avoid faults */
 245     __TRY
 246     {
 247         LPBYTE s=(LPBYTE)x;
 248         i=0;nostring=0;
 249         while (i<80) {
 250             if (s[i]==0) break;
 251             if (s[i]<0x20) {nostring=1;break;}
 252             if (s[i]>=0x80) {nostring=1;break;}
 253             i++;
 254         }
 255         if (!nostring && i > 5)
 256             DPRINTF(" %s",debugstr_an((LPSTR)x,i));
 257         else  /* try unicode */
 258         {
 259             LPWSTR s=(LPWSTR)x;
 260             i=0;nostring=0;
 261             while (i<80) {
 262                 if (s[i]==0) break;
 263                 if (s[i]<0x20) {nostring=1;break;}
 264                 if (s[i]>0x100) {nostring=1;break;}
 265                 i++;
 266             }
 267             if (!nostring && i > 5) DPRINTF(" %s",debugstr_wn((LPWSTR)x,i));
 268         }
 269     }
 270     __EXCEPT(page_fault)
 271     {
 272     }
 273     __ENDTRY
 274 }
 275
 276 #define CALLER1REF (*(DWORD*)context->Esp)
 277
 278 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
 279 {
 280         DWORD           ordinal=0,entry = context->Eip - 5;
 281         SNOOP_DLL       *dll = firstdll;
 282         SNOOP_FUN       *fun = NULL;
 283         SNOOP_RETURNENTRIES     **rets = &firstrets;
 284         SNOOP_RETURNENTRY       *ret;
 285         int             i=0, max;
 286
 287         while (dll) {
 288                 if (    ((char*)entry>=(char*)dll->funs)        &&
 289                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 290                 ) {
 291                         fun = (SNOOP_FUN*)entry;
 292                         ordinal = fun-dll->funs;
 293                         break;
 294                 }
 295                 dll=dll->next;
 296         }
 297         if (!dll) {
 298                 FIXME("entrypoint 0x%08lx not found\n",entry);
 299                 return; /* oops */
 300         }
 301         /* guess cdecl ... */
 302         if (fun->nrofargs<0) {
 303                 /* Typical cdecl return frame is:
 304                  *      add esp, xxxxxxxx
 305                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 306                  * (after that 81 C2 xx xx xx xx)
 307                  */
 308                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 309
 310                 if (reteip) {
 311                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 312                                 fun->nrofargs=reteip[2]/4;
 313                 }
 314         }
 315
 316
 317         while (*rets) {
 318                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 319                         if (!(*rets)->entry[i].origreturn)
 320                                 break;
 321                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 322                         break;
 323                 rets = &((*rets)->next);
 324         }
 325         if (!*rets) {
 326                 SIZE_T size = 4096;
 327                 VOID* addr;
 328
 329                 NtAllocateVirtualMemory(GetCurrentProcess(), &addr, NULL, &size,
 330                                         MEM_COMMIT | MEM_RESERVE,
 331                                         PAGE_EXECUTE_READWRITE);
 332                 if (!addr) return;
 333                 *rets = addr;
 334                 memset(*rets,0,4096);
 335                 i = 0;  /* entry 0 is free */
 336         }
 337         ret = &((*rets)->entry[i]);
 338         ret->lcall      = 0xe8;
 339         /* NOTE: origreturn struct member MUST come directly after snoopret */
 340         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 341         ret->origreturn = (FARPROC)CALLER1REF;
 342         CALLER1REF      = (DWORD)&ret->lcall;
 343         ret->dll        = dll;
 344         ret->args       = NULL;
 345         ret->ordinal    = ordinal;
 346         ret->origESP    = context->Esp;
 347
 348         context->Eip = (DWORD)fun->origfun;
 349
 350         if (fun->name) DPRINTF("%04lx:CALL %s.%s(",GetCurrentThreadId(),dll->name,fun->name);
 351         else DPRINTF("%04lx:CALL %s.%ld(",GetCurrentThreadId(),dll->name,dll->ordbase+ordinal);
 352         if (fun->nrofargs>0) {
 353                 max = fun->nrofargs; if (max>16) max=16;
 354                 for (i=0;i<max;i++)
 355                 {
 356                     SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i));
 357                     if (i<fun->nrofargs-1) DPRINTF(",");
 358                 }
 359                 if (max!=fun->nrofargs)
 360                         DPRINTF(" ...");
 361         } else if (fun->nrofargs<0) {
 362                 DPRINTF("<unknown, check return>");
 363                 ret->args = RtlAllocateHeap(ntdll_get_process_heap(),
 364                                             0,16*sizeof(DWORD));
 365                 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
 366         }
 367         DPRINTF(") ret=%08lx\n",(DWORD)ret->origreturn);
 368 }
 369
 370
 371 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
 372 {
 373         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
 374         SNOOP_FUN *fun = &ret->dll->funs[ret->ordinal];
 375
 376         /* We haven't found out the nrofargs yet. If we called a cdecl
 377          * function it is too late anyway and we can just set '0' (which
 378          * will be the difference between orig and current ESP
 379          * If stdcall -> everything ok.
 380          */
 381         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 382                 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
 383         context->Eip = (DWORD)ret->origreturn;
 384         if (ret->args) {
 385                 int     i,max;
 386
 387                 if (fun->name)
 388                     DPRINTF("%04lx:RET  %s.%s(", GetCurrentThreadId(), ret->dll->name, fun->name);
 389                 else
 390                     DPRINTF("%04lx:RET  %s.%ld(", GetCurrentThreadId(),
 391                             ret->dll->name,ret->dll->ordbase+ret->ordinal);
 392
 393                 max = fun->nrofargs;
 394                 if (max>16) max=16;
 395
 396                 for (i=0;i<max;i++)
 397                 {
 398                     SNOOP_PrintArg(ret->args[i]);
 399                     if (i<max-1) DPRINTF(",");
 400                 }
 401                 DPRINTF(") retval=%08lx ret=%08lx\n",
 402                         context->Eax,(DWORD)ret->origreturn );
 403                 RtlFreeHeap(ntdll_get_process_heap(),0,ret->args);
 404                 ret->args = NULL;
 405         }
 406         else
 407         {
 408             if (fun->name)
 409                 DPRINTF("%04lx:RET  %s.%s() retval=%08lx ret=%08lx\n",
 410                         GetCurrentThreadId(),
 411                         ret->dll->name, fun->name, context->Eax, (DWORD)ret->origreturn);
 412             else
 413                 DPRINTF("%04lx:RET  %s.%ld() retval=%08lx ret=%08lx\n",
 414                         GetCurrentThreadId(),
 415                         ret->dll->name,ret->dll->ordbase+ret->ordinal,
 416                         context->Eax, (DWORD)ret->origreturn);
 417         }
 418         ret->origreturn = NULL; /* mark as empty */
 419 }
 420
 421 /* assembly wrappers that save the context */
 422 __ASM_GLOBAL_FUNC( SNOOP_Entry,
 423                    "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
 424                    ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
 425 __ASM_GLOBAL_FUNC( SNOOP_Return,
 426                    "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
 427                    ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
 428
 429 #else   /* !__i386__ */
 430 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals, DWORD dw) {
 431         if (!TRACE_ON(snoop)) return;
 432         FIXME("snooping works only on i386 for now.\n");
 433 }
 434
 435 FARPROC SNOOP_GetProcAddress( HMODULE hmod, IMAGE_EXPORT_DIRECTORY *exports, DWORD exp_size,
 436                               FARPROC origfun, DWORD ordinal )
 437 {
 438     return origfun;
 439 }
 440 #endif  /* !__i386__ */