?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Removed some unnecessary includes.
[wine.git] / relay32 / snoop.c
blobbf6f13bd3fc2b081ca751dc50f03390049b141d0
1 /*
2 * 386-specific Win32 dll<->dll snooping functions
3 *
4 * Copyright 1998 Marcus Meissner
5 */
6
7 #include "config.h"
8
9 #include <assert.h>
10 #include <stdio.h>
11 #include <string.h>
12 #include "winbase.h"
13 #include "winnt.h"
14 #include "heap.h"
15 #include "snoop.h"
16 #include "stackframe.h"
17 #include "debugtools.h"
18 #include "wine/exception.h"
19
20 DEFAULT_DEBUG_CHANNEL(snoop);
21
22 static WINE_EXCEPTION_FILTER(page_fault)
23 {
24 if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ||
25 GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION)
26 return EXCEPTION_EXECUTE_HANDLER;
27 return EXCEPTION_CONTINUE_SEARCH;
28 }
29
30 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
31
32 #ifdef __i386__
33
34 extern void WINAPI SNOOP_Entry();
35 extern void WINAPI SNOOP_Return();
36
37 #ifdef NEED_UNDERSCORE_PREFIX
38 # define PREFIX "_"
39 #else
40 # define PREFIX
41 #endif
42
43 #include "pshpack1.h"
44
45 typedef struct tagSNOOP_FUN {
46 /* code part */
47 BYTE lcall; /* 0xe8 call snoopentry (relative) */
48 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
49 * calculation!
50 */
51 DWORD snoopentry; /* SNOOP_Entry relative */
52 /* unreached */
53 int nrofargs;
54 FARPROC origfun;
55 char *name;
56 } SNOOP_FUN;
57
58 typedef struct tagSNOOP_DLL {
59 HMODULE hmod;
60 SNOOP_FUN *funs;
61 LPCSTR name;
62 DWORD nrofordinals;
63 struct tagSNOOP_DLL *next;
64 } SNOOP_DLL;
65 typedef struct tagSNOOP_RETURNENTRY {
66 /* code part */
67 BYTE lcall; /* 0xe8 call snoopret relative*/
68 /* NOTE: If you move snoopret OR origreturn fix the relative offset
69 * calculation!
70 */
71 DWORD snoopret; /* SNOOP_Ret relative */
72 /* unreached */
73 FARPROC origreturn;
74 SNOOP_DLL *dll;
75 DWORD ordinal;
76 DWORD origESP;
77 DWORD *args; /* saved args across a stdcall */
78 } SNOOP_RETURNENTRY;
79
80 typedef struct tagSNOOP_RETURNENTRIES {
81 SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
82 struct tagSNOOP_RETURNENTRIES *next;
83 } SNOOP_RETURNENTRIES;
84
85 #include "poppack.h"
86
87 static SNOOP_DLL *firstdll = NULL;
88 static SNOOP_RETURNENTRIES *firstrets = NULL;
89
90 /***********************************************************************
91 * SNOOP_ShowDebugmsgSnoop
92 *
93 * Simple function to decide if a particular debugging message is
94 * wanted.
95 */
96 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
97
98 if(debug_snoop_excludelist || debug_snoop_includelist) {
99 char **listitem;
100 char buf[80];
101 int len, len2, itemlen, show;
102
103 if(debug_snoop_excludelist) {
104 show = 1;
105 listitem = debug_snoop_excludelist;
106 } else {
107 show = 0;
108 listitem = debug_snoop_includelist;
109 }
110 len = strlen(dll);
111 assert(len < 64);
112 sprintf(buf, "%s.%d", dll, ord);
113 len2 = strlen(buf);
114 for(; *listitem; listitem++) {
115 itemlen = strlen(*listitem);
116 if((itemlen == len && !strncmp(*listitem, buf, len)) ||
117 (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
118 !strcmp(*listitem, fname)) {
119 show = !show;
120 break;
121 }
122 }
123 return show;
124 }
125 return 1;
126 }
127
128 void
129 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
130 SNOOP_DLL **dll = &(firstdll);
131 char *s;
132
133 if (!TRACE_ON(snoop)) return;
134 while (*dll) {
135 if ((*dll)->hmod == hmod)
136 return; /* already registered */
137 dll = &((*dll)->next);
138 }
139 *dll = (SNOOP_DLL*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
140 (*dll)->next = NULL;
141 (*dll)->hmod = hmod;
142 (*dll)->nrofordinals = nrofordinals;
143 (*dll)->name = HEAP_strdupA(GetProcessHeap(),0,name);
144 if ((s=strrchr((*dll)->name,'.')))
145 *s='\0';
146 (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
147 memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
148 if (!(*dll)->funs) {
149 HeapFree(GetProcessHeap(),0,*dll);
150 FIXME("out of memory\n");
151 return;
152 }
153 }
154
155 FARPROC
156 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
157 SNOOP_DLL *dll = firstdll;
158 SNOOP_FUN *fun;
159 int j;
160 IMAGE_SECTION_HEADER *pe_seg = PE_SECTIONS(hmod);
161
162 if (!TRACE_ON(snoop)) return origfun;
163 if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
164 return origfun;
165 for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
166 /* 0x42 is special ELF loader tag */
167 if ((pe_seg[j].VirtualAddress==0x42) ||
168 (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
169 ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
170 pe_seg[j].SizeOfRawData
171 ))
172 )
173 break;
174 /* If we looked through all sections (and didn't find one)
175 * or if the sectionname contains "data", we return the
176 * original function since it is most likely a datareference.
177 */
178 if ( (j==PE_HEADER(hmod)->FileHeader.NumberOfSections) ||
179 (strstr(pe_seg[j].Name,"data")) ||
180 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
181 )
182 return origfun;
183
184 while (dll) {
185 if (hmod == dll->hmod)
186 break;
187 dll=dll->next;
188 }
189 if (!dll) /* probably internal */
190 return origfun;
191 if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
192 return origfun;
193 assert(ordinal < dll->nrofordinals);
194 fun = dll->funs+ordinal;
195 if (!fun->name) fun->name = HEAP_strdupA(GetProcessHeap(),0,name);
196 fun->lcall = 0xe8;
197 /* NOTE: origreturn struct member MUST come directly after snoopentry */
198 fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
199 fun->origfun = origfun;
200 fun->nrofargs = -1;
201 return (FARPROC)&(fun->lcall);
202 }
203
204 static char*
205 SNOOP_PrintArg(DWORD x) {
206 static char buf[200];
207 int i,nostring;
208 char * volatile ret=0;
209
210 if ( !HIWORD(x) ) { /* trivial reject to avoid faults */
211 sprintf(buf,"%08lx",x);
212 return buf;
213 }
214 __TRY{
215 LPBYTE s=(LPBYTE)x;
216 i=0;nostring=0;
217 while (i<80) {
218 if (s[i]==0) break;
219 if (s[i]<0x20) {nostring=1;break;}
220 if (s[i]>=0x80) {nostring=1;break;}
221 i++;
222 }
223 if (!nostring) {
224 if (i>5) {
225 snprintf(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
226 ret=buf;
227 }
228 }
229 }
230 __EXCEPT(page_fault){}
231 __ENDTRY
232 if (ret)
233 return ret;
234 __TRY{
235 LPWSTR s=(LPWSTR)x;
236 i=0;nostring=0;
237 while (i<80) {
238 if (s[i]==0) break;
239 if (s[i]<0x20) {nostring=1;break;}
240 if (s[i]>0x100) {nostring=1;break;}
241 i++;
242 }
243 if (!nostring) {
244 if (i>5) {
245 snprintf(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
246 ret=buf;
247 }
248 }
249 }
250 __EXCEPT(page_fault){}
251 __ENDTRY
252 if (ret)
253 return ret;
254 sprintf(buf,"%08lx",x);
255 return buf;
256 }
257
258 #define CALLER1REF (*(DWORD*)context->Esp)
259
260 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
261 {
262 DWORD ordinal=0,entry = context->Eip - 5;
263 SNOOP_DLL *dll = firstdll;
264 SNOOP_FUN *fun = NULL;
265 SNOOP_RETURNENTRIES **rets = &firstrets;
266 SNOOP_RETURNENTRY *ret;
267 int i=0, max;
268
269 while (dll) {
270 if ( ((char*)entry>=(char*)dll->funs) &&
271 ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
272 ) {
273 fun = (SNOOP_FUN*)entry;
274 ordinal = fun-dll->funs;
275 break;
276 }
277 dll=dll->next;
278 }
279 if (!dll) {
280 FIXME("entrypoint 0x%08lx not found\n",entry);
281 return; /* oops */
282 }
283 /* guess cdecl ... */
284 if (fun->nrofargs<0) {
285 /* Typical cdecl return frame is:
286 * add esp, xxxxxxxx
287 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
288 * (after that 81 C2 xx xx xx xx)
289 */
290 LPBYTE reteip = (LPBYTE)CALLER1REF;
291
292 if (reteip) {
293 if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
294 fun->nrofargs=reteip[2]/4;
295 }
296 }
297
298
299 while (*rets) {
300 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
301 if (!(*rets)->entry[i].origreturn)
302 break;
303 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
304 break;
305 rets = &((*rets)->next);
306 }
307 if (!*rets) {
308 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
309 memset(*rets,0,4096);
310 i = 0; /* entry 0 is free */
311 }
312 ret = &((*rets)->entry[i]);
313 ret->lcall = 0xe8;
314 /* NOTE: origreturn struct member MUST come directly after snoopret */
315 ret->snoopret = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
316 ret->origreturn = (FARPROC)CALLER1REF;
317 CALLER1REF = (DWORD)&ret->lcall;
318 ret->dll = dll;
319 ret->args = NULL;
320 ret->ordinal = ordinal;
321 ret->origESP = context->Esp;
322
323 context->Eip = (DWORD)fun->origfun;
324
325 DPRINTF("CALL %s.%ld: %s(",dll->name,ordinal,fun->name);
326 if (fun->nrofargs>0) {
327 max = fun->nrofargs; if (max>16) max=16;
328 for (i=0;i<max;i++)
329 DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
330 if (max!=fun->nrofargs)
331 DPRINTF(" ...");
332 } else if (fun->nrofargs<0) {
333 DPRINTF("<unknown, check return>");
334 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
335 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
336 }
337 DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD)ret->origreturn,context->SegFs);
338 }
339
340
341 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
342 {
343 SNOOP_RETURNENTRY *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
344
345 /* We haven't found out the nrofargs yet. If we called a cdecl
346 * function it is too late anyway and we can just set '0' (which
347 * will be the difference between orig and current ESP
348 * If stdcall -> everything ok.
349 */
350 if (ret->dll->funs[ret->ordinal].nrofargs<0)
351 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
352 context->Eip = (DWORD)ret->origreturn;
353 if (ret->args) {
354 int i,max;
355
356 DPRINTF("RET %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
357 max = ret->dll->funs[ret->ordinal].nrofargs;
358 if (max>16) max=16;
359
360 for (i=0;i<max;i++)
361 DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
362 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
363 context->Eax,(DWORD)ret->origreturn,context->SegFs );
364 HeapFree(GetProcessHeap(),0,ret->args);
365 ret->args = NULL;
366 } else
367 DPRINTF("RET %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
368 ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
369 context->Eax,(DWORD)ret->origreturn,context->SegFs );
370 ret->origreturn = NULL; /* mark as empty */
371 }
372
373 /* assembly wrappers that save the context */
374 __ASM_GLOBAL_FUNC( SNOOP_Entry,
375 "call " __ASM_NAME("CALL32_Regs") "\n\t"
376 ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
377 __ASM_GLOBAL_FUNC( SNOOP_Return,
378 "call " __ASM_NAME("CALL32_Regs") "\n\t"
379 ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
380
381 #else /* !__i386__ */
382 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
383 FIXME("snooping works only on i386 for now.\n");
384 return;
385 }
386
387 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
388 return origfun;
389 }
390 #endif /* !__i386__ */
Windows API implementation