win32/kernel32.c

   1 /*
   2  * KERNEL32 thunks and other undocumented stuff
   3  *
   4  * Copyright 1997-1998 Marcus Meissner
   5  * Copyright 1998      Ulrich Weigand
   6  */
   7
   8 #include "windows.h"
   9 #include "callback.h"
  10 #include "resource.h"
  11 #include "task.h"
  12 #include "user.h"
  13 #include "heap.h"
  14 #include "module.h"
  15 #include "process.h"
  16 #include "stackframe.h"
  17 #include "heap.h"
  18 #include "selectors.h"
  19 #include "task.h"
  20 #include "win.h"
  21 #include "file.h"
  22 #include "debug.h"
  23 #include "flatthunk.h"
  24 #include "syslevel.h"
  25
  26
  27 /***********************************************************************
  28  *                                                                     *
  29  *                 Win95 internal thunks                               *
  30  *                                                                     *
  31  ***********************************************************************/
  32
  33 /***********************************************************************
  34  * Generates a FT_Prolog call.
  35  *
  36  *  0FB6D1                  movzbl edx,cl
  37  *  8B1495xxxxxxxx          mov edx,[4*edx + targetTable]
  38  *  68xxxxxxxx              push FT_Prolog
  39  *  C3                      lret
  40  */
  41 static void _write_ftprolog(LPBYTE relayCode ,DWORD *targetTable) {
  42         LPBYTE  x;
  43
  44         x       = relayCode;
  45         *x++    = 0x0f;*x++=0xb6;*x++=0xd1; /* movzbl edx,cl */
  46         *x++    = 0x8B;*x++=0x14;*x++=0x95;*(DWORD**)x= targetTable;
  47         x+=4;   /* mov edx, [4*edx + targetTable] */
  48         *x++    = 0x68; *(DWORD*)x = (DWORD)GetProcAddress32(GetModuleHandle32A("KERNEL32"),"FT_Prolog");
  49         x+=4;   /* push FT_Prolog */
  50         *x++    = 0xC3;         /* lret */
  51         /* fill rest with 0xCC / int 3 */
  52 }
  53
  54 /***********************************************************************
  55  *      _write_qtthunk                                  (internal)
  56  * Generates a QT_Thunk style call.
  57  *
  58  *  33C9                    xor ecx, ecx
  59  *  8A4DFC                  mov cl , [ebp-04]
  60  *  8B148Dxxxxxxxx          mov edx, [4*ecx + targetTable]
  61  *  B8yyyyyyyy              mov eax, QT_Thunk
  62  *  FFE0                    jmp eax
  63  */
  64 static void _write_qtthunk(
  65         LPBYTE relayCode,       /* [in] start of QT_Thunk stub */
  66         DWORD *targetTable      /* [in] start of thunk (for index lookup) */
  67 ) {
  68         LPBYTE  x;
  69
  70         x       = relayCode;
  71         *x++    = 0x33;*x++=0xC9; /* xor ecx,ecx */
  72         *x++    = 0x8A;*x++=0x4D;*x++=0xFC; /* movb cl,[ebp-04] */
  73         *x++    = 0x8B;*x++=0x14;*x++=0x8D;*(DWORD**)x= targetTable;
  74         x+=4;   /* mov edx, [4*ecx + targetTable */
  75         *x++    = 0xB8; *(DWORD*)x = (DWORD)GetProcAddress32(GetModuleHandle32A("KERNEL32"),"QT_Thunk");
  76         x+=4;   /* mov eax , QT_Thunk */
  77         *x++    = 0xFF; *x++ = 0xE0;    /* jmp eax */
  78         /* should fill the rest of the 32 bytes with 0xCC */
  79 }
  80
  81 /***********************************************************************
  82  *           _loadthunk
  83  */
  84 static LPVOID _loadthunk(LPCSTR module, LPCSTR func, LPCSTR module32,
  85                          struct ThunkDataCommon *TD32, DWORD checksum)
  86 {
  87     struct ThunkDataCommon *TD16;
  88     HMODULE32 hmod;
  89     int ordinal;
  90
  91     if ((hmod = LoadLibrary16(module)) <= 32)
  92     {
  93         ERR(thunk, "(%s, %s, %s): Unable to load '%s', error %d\n",
  94                    module, func, module32, module, hmod);
  95         return 0;
  96     }
  97
  98     if (   !(ordinal = NE_GetOrdinal(hmod, func))
  99         || !(TD16 = PTR_SEG_TO_LIN(NE_GetEntryPointEx(hmod, ordinal, FALSE))))
 100     {
 101         ERR(thunk, "(%s, %s, %s): Unable to find '%s'\n",
 102                    module, func, module32, func);
 103         return 0;
 104     }
 105
 106     if (TD32 && memcmp(TD16->magic, TD32->magic, 4))
 107     {
 108         ERR(thunk, "(%s, %s, %s): Bad magic %c%c%c%c (should be %c%c%c%c)\n",
 109                    module, func, module32,
 110                    TD16->magic[0], TD16->magic[1], TD16->magic[2], TD16->magic[3],
 111                    TD32->magic[0], TD32->magic[1], TD32->magic[2], TD32->magic[3]);
 112         return 0;
 113     }
 114
 115     if (TD32 && TD16->checksum != TD32->checksum)
 116     {
 117         ERR(thunk, "(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
 118                    module, func, module32, TD16->checksum, TD32->checksum);
 119         return 0;
 120     }
 121
 122     if (!TD32 && checksum && checksum != *(LPDWORD)TD16)
 123     {
 124         ERR(thunk, "(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
 125                    module, func, module32, *(LPDWORD)TD16, checksum);
 126         return 0;
 127     }
 128
 129     return TD16;
 130 }
 131
 132 /***********************************************************************
 133  *           GetThunkStuff    (KERNEL32.53)
 134  */
 135 LPVOID WINAPI GetThunkStuff(LPSTR module, LPSTR func)
 136 {
 137     return _loadthunk(module, func, "<kernel>", NULL, 0L);
 138 }
 139
 140 /***********************************************************************
 141  *           GetThunkBuff    (KERNEL32.52)
 142  * Returns a pointer to ThkBuf in the 16bit library SYSTHUNK.DLL.
 143  */
 144 LPVOID WINAPI GetThunkBuff(void)
 145 {
 146     return GetThunkStuff("SYSTHUNK.DLL", "ThkBuf");
 147 }
 148
 149 /***********************************************************************
 150  *              ThunkConnect32          (KERNEL32)
 151  * Connects a 32bit and a 16bit thunkbuffer.
 152  */
 153 UINT32 WINAPI ThunkConnect32(
 154         struct ThunkDataCommon *TD,  /* [in/out] thunkbuffer */
 155         LPSTR thunkfun16,            /* [in] win16 thunkfunction */
 156         LPSTR module16,              /* [in] name of win16 dll */
 157         LPSTR module32,              /* [in] name of win32 dll */
 158         HMODULE32 hmod32,            /* [in] hmodule of win32 dll */
 159         DWORD dwReason               /* [in] initialisation argument */
 160 ) {
 161     BOOL32 directionSL;
 162
 163     if (!lstrncmp32A(TD->magic, "SL01", 4))
 164     {
 165         directionSL = TRUE;
 166
 167         TRACE(thunk, "SL01 thunk %s (%lx) <- %s (%s), Reason: %ld\n",
 168                      module32, (DWORD)TD, module16, thunkfun16, dwReason);
 169     }
 170     else if (!lstrncmp32A(TD->magic, "LS01", 4))
 171     {
 172         directionSL = FALSE;
 173
 174         TRACE(thunk, "LS01 thunk %s (%lx) -> %s (%s), Reason: %ld\n",
 175                      module32, (DWORD)TD, module16, thunkfun16, dwReason);
 176     }
 177     else
 178     {
 179         ERR(thunk, "Invalid magic %c%c%c%c\n",
 180                    TD->magic[0], TD->magic[1], TD->magic[2], TD->magic[3]);
 181         return 0;
 182     }
 183
 184     switch (dwReason)
 185     {
 186         case DLL_PROCESS_ATTACH:
 187         {
 188             struct ThunkDataCommon *TD16;
 189             if (!(TD16 = _loadthunk(module16, thunkfun16, module32, TD, 0L)))
 190                 return 0;
 191
 192             if (directionSL)
 193             {
 194                 struct ThunkDataSL32 *SL32 = (struct ThunkDataSL32 *)TD;
 195                 struct ThunkDataSL16 *SL16 = (struct ThunkDataSL16 *)TD16;
 196                 struct SLTargetDB *tdb;
 197
 198                 if (SL16->fpData == NULL)
 199                 {
 200                     ERR(thunk, "ThunkConnect16 was not called!\n");
 201                     return 0;
 202                 }
 203
 204                 SL32->data = SL16->fpData;
 205
 206                 tdb = HeapAlloc(GetProcessHeap(), 0, sizeof(*tdb));
 207                 tdb->process = PROCESS_Current();
 208                 tdb->targetTable = (DWORD *)(thunkfun16 + SL32->offsetTargetTable);
 209
 210                 tdb->next = SL32->data->targetDB;   /* FIXME: not thread-safe! */
 211                 SL32->data->targetDB = tdb;
 212
 213                 TRACE(thunk, "Process %08lx allocated TargetDB entry for ThunkDataSL %08lx\n",
 214                              (DWORD)PROCESS_Current(), (DWORD)SL32->data);
 215             }
 216             else
 217             {
 218                 struct ThunkDataLS32 *LS32 = (struct ThunkDataLS32 *)TD;
 219                 struct ThunkDataLS16 *LS16 = (struct ThunkDataLS16 *)TD16;
 220
 221                 LS32->targetTable = PTR_SEG_TO_LIN(LS16->targetTable);
 222
 223                 /* write QT_Thunk and FT_Prolog stubs */
 224                 _write_qtthunk ((LPBYTE)TD + LS32->offsetQTThunk,  LS32->targetTable);
 225                 _write_ftprolog((LPBYTE)TD + LS32->offsetFTProlog, LS32->targetTable);
 226             }
 227             break;
 228         }
 229
 230         case DLL_PROCESS_DETACH:
 231             /* FIXME: cleanup */
 232             break;
 233     }
 234
 235     return 1;
 236 }
 237
 238 /**********************************************************************
 239  *              QT_Thunk                        (KERNEL32)
 240  *
 241  * The target address is in EDX.
 242  * The 16 bit arguments start at ESP+4.
 243  * The number of 16bit argumentbytes is EBP-ESP-0x44 (68 Byte thunksetup).
 244  * [ok]
 245  */
 246 REGS_ENTRYPOINT(QT_Thunk)
 247 {
 248     CONTEXT context16;
 249     DWORD argsize;
 250     THDB *thdb = THREAD_Current();
 251
 252     memcpy(&context16,context,sizeof(context16));
 253
 254     CS_reg(&context16)  = HIWORD(EDX_reg(context));
 255     IP_reg(&context16)  = LOWORD(EDX_reg(context));
 256     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 257                            + (WORD)&((STACK16FRAME*)0)->bp;
 258
 259     argsize = EBP_reg(context)-ESP_reg(context)-0x44;
 260
 261     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 262             (LPBYTE)ESP_reg(context)+4, argsize );
 263
 264     EAX_reg(context) = Callbacks->CallRegisterShortProc( &context16, argsize );
 265     EDX_reg(context) = HIWORD(EAX_reg(context));
 266     EAX_reg(context) = LOWORD(EAX_reg(context));
 267 }
 268
 269
 270 /**********************************************************************
 271  *              FT_Prolog                       (KERNEL32.233)
 272  *
 273  * The set of FT_... thunk routines is used instead of QT_Thunk,
 274  * if structures have to be converted from 32-bit to 16-bit
 275  * (change of member alignment, conversion of members).
 276  *
 277  * The thunk function (as created by the thunk compiler) calls
 278  * FT_Prolog at the beginning, to set up a stack frame and
 279  * allocate a 64 byte buffer on the stack.
 280  * The input parameters (target address and some flags) are
 281  * saved for later use by FT_Thunk.
 282  *
 283  * Input:  EDX  16-bit target address (SEGPTR)
 284  *         CX   bits  0..7   target number (in target table)
 285  *              bits  8..9   some flags (unclear???)
 286  *              bits 10..15  number of DWORD arguments
 287  *
 288  * Output: A new stackframe is created, and a 64 byte buffer
 289  *         allocated on the stack. The layout of the stack
 290  *         on return is as follows:
 291  *
 292  *  (ebp+4)  return address to caller of thunk function
 293  *  (ebp)    old EBP
 294  *  (ebp-4)  saved EBX register of caller
 295  *  (ebp-8)  saved ESI register of caller
 296  *  (ebp-12) saved EDI register of caller
 297  *  (ebp-16) saved ECX register, containing flags
 298  *  (ebp-20) bitmap containing parameters that are to be converted
 299  *           by FT_Thunk; it is initialized to 0 by FT_Prolog and
 300  *           filled in by the thunk code before calling FT_Thunk
 301  *  (ebp-24)
 302  *    ...    (unclear)
 303  *  (ebp-44)
 304  *  (ebp-48) saved EAX register of caller (unclear, never restored???)
 305  *  (ebp-52) saved EDX register, containing 16-bit thunk target
 306  *  (ebp-56)
 307  *    ...    (unclear)
 308  *  (ebp-64)
 309  *
 310  *  ESP is EBP-68 on return.
 311  *
 312  */
 313
 314 REGS_ENTRYPOINT(FT_Prolog)
 315 {
 316     /* Pop return address to thunk code */
 317     EIP_reg(context) = STACK32_POP(context);
 318
 319     /* Build stack frame */
 320     STACK32_PUSH(context, EBP_reg(context));
 321     EBP_reg(context) = ESP_reg(context);
 322
 323     /* Allocate 64-byte Thunk Buffer */
 324     ESP_reg(context) -= 64;
 325     memset((char *)ESP_reg(context), '\0', 64);
 326
 327     /* Store Flags (ECX) and Target Address (EDX) */
 328     /* Save other registers to be restored later */
 329     *(DWORD *)(EBP_reg(context) -  4) = EBX_reg(context);
 330     *(DWORD *)(EBP_reg(context) -  8) = ESI_reg(context);
 331     *(DWORD *)(EBP_reg(context) - 12) = EDI_reg(context);
 332     *(DWORD *)(EBP_reg(context) - 16) = ECX_reg(context);
 333
 334     *(DWORD *)(EBP_reg(context) - 48) = EAX_reg(context);
 335     *(DWORD *)(EBP_reg(context) - 52) = EDX_reg(context);
 336
 337     /* Push return address back onto stack */
 338     STACK32_PUSH(context, EIP_reg(context));
 339 }
 340
 341 /**********************************************************************
 342  *              FT_Thunk                        (KERNEL32.234)
 343  *
 344  * This routine performs the actual call to 16-bit code,
 345  * similar to QT_Thunk. The differences are:
 346  *  - The call target is taken from the buffer created by FT_Prolog
 347  *  - Those arguments requested by the thunk code (by setting the
 348  *    corresponding bit in the bitmap at EBP-20) are converted
 349  *    from 32-bit pointers to segmented pointers (those pointers
 350  *    are guaranteed to point to structures copied to the stack
 351  *    by the thunk code, so we always use the 16-bit stack selector
 352  *    for those addresses).
 353  *
 354  *    The bit #i of EBP-20 corresponds here to the DWORD starting at
 355  *    ESP+4 + 2*i.
 356  *
 357  * FIXME: It is unclear what happens if there are more than 32 WORDs
 358  *        of arguments, so that the single DWORD bitmap is no longer
 359  *        sufficient ...
 360  */
 361
 362 REGS_ENTRYPOINT(FT_Thunk)
 363 {
 364     DWORD mapESPrelative = *(DWORD *)(EBP_reg(context) - 20);
 365     DWORD callTarget     = *(DWORD *)(EBP_reg(context) - 52);
 366
 367     CONTEXT context16;
 368     DWORD i, argsize;
 369     LPBYTE newstack, oldstack;
 370     THDB *thdb = THREAD_Current();
 371
 372     memcpy(&context16,context,sizeof(context16));
 373
 374     CS_reg(&context16)  = HIWORD(callTarget);
 375     IP_reg(&context16)  = LOWORD(callTarget);
 376     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 377                            + (WORD)&((STACK16FRAME*)0)->bp;
 378
 379     argsize  = EBP_reg(context)-ESP_reg(context)-0x44;
 380     newstack = ((LPBYTE)THREAD_STACK16(thdb))-argsize;
 381     oldstack = (LPBYTE)ESP_reg(context)+4;
 382
 383     memcpy( newstack, oldstack, argsize );
 384
 385     for (i = 0; i < 32; i++)    /* NOTE: What about > 32 arguments? */
 386         if (mapESPrelative & (1 << i))
 387         {
 388             SEGPTR *arg = (SEGPTR *)(newstack + 2*i);
 389             *arg = PTR_SEG_OFF_TO_SEGPTR(SELECTOROF(thdb->cur_stack),
 390                                          OFFSETOF(thdb->cur_stack) - argsize
 391                                          + (*(LPBYTE *)arg - oldstack));
 392         }
 393
 394     EAX_reg(context) = Callbacks->CallRegisterShortProc( &context16, argsize );
 395     EDX_reg(context) = HIWORD(EAX_reg(context));
 396     EAX_reg(context) = LOWORD(EAX_reg(context));
 397 }
 398
 399 /**********************************************************************
 400  *              FT_ExitNN               (KERNEL32.218 - 232)
 401  *
 402  * One of the FT_ExitNN functions is called at the end of the thunk code.
 403  * It removes the stack frame created by FT_Prolog, moves the function
 404  * return from EBX to EAX (yes, FT_Thunk did use EAX for the return
 405  * value, but the thunk code has moved it from EAX to EBX in the
 406  * meantime ... :-), restores the caller's EBX, ESI, and EDI registers,
 407  * and perform a return to the CALLER of the thunk code (while removing
 408  * the given number of arguments from the caller's stack).
 409  */
 410
 411 static void FT_Exit(CONTEXT *context, int nPopArgs)
 412 {
 413     /* Return value is in EBX */
 414     EAX_reg(context) = EBX_reg(context);
 415
 416     /* Restore EBX, ESI, and EDI registers */
 417     EBX_reg(context) = *(DWORD *)(EBP_reg(context) -  4);
 418     ESI_reg(context) = *(DWORD *)(EBP_reg(context) -  8);
 419     EDI_reg(context) = *(DWORD *)(EBP_reg(context) - 12);
 420
 421     /* Clean up stack frame */
 422     ESP_reg(context) = EBP_reg(context);
 423     EBP_reg(context) = STACK32_POP(context);
 424
 425     /* Pop return address to CALLER of thunk code */
 426     EIP_reg(context) = STACK32_POP(context);
 427     /* Remove arguments */
 428     ESP_reg(context) += nPopArgs;
 429     /* Push return address back onto stack */
 430     STACK32_PUSH(context, EIP_reg(context));
 431 }
 432
 433 REGS_ENTRYPOINT(FT_Exit0)  { FT_Exit(context,  0); }
 434 REGS_ENTRYPOINT(FT_Exit4)  { FT_Exit(context,  4); }
 435 REGS_ENTRYPOINT(FT_Exit8)  { FT_Exit(context,  8); }
 436 REGS_ENTRYPOINT(FT_Exit12) { FT_Exit(context, 12); }
 437 REGS_ENTRYPOINT(FT_Exit16) { FT_Exit(context, 16); }
 438 REGS_ENTRYPOINT(FT_Exit20) { FT_Exit(context, 20); }
 439 REGS_ENTRYPOINT(FT_Exit24) { FT_Exit(context, 24); }
 440 REGS_ENTRYPOINT(FT_Exit28) { FT_Exit(context, 28); }
 441 REGS_ENTRYPOINT(FT_Exit32) { FT_Exit(context, 32); }
 442 REGS_ENTRYPOINT(FT_Exit36) { FT_Exit(context, 36); }
 443 REGS_ENTRYPOINT(FT_Exit40) { FT_Exit(context, 40); }
 444 REGS_ENTRYPOINT(FT_Exit44) { FT_Exit(context, 44); }
 445 REGS_ENTRYPOINT(FT_Exit48) { FT_Exit(context, 48); }
 446 REGS_ENTRYPOINT(FT_Exit52) { FT_Exit(context, 52); }
 447 REGS_ENTRYPOINT(FT_Exit56) { FT_Exit(context, 56); }
 448
 449
 450 /**********************************************************************
 451  *           WOWCallback16 (KERNEL32.62)(WOW32.2)
 452  * Calls a win16 function with a single DWORD argument.
 453  * RETURNS
 454  *      the return value
 455  */
 456 DWORD WINAPI WOWCallback16(
 457         FARPROC16 fproc,        /* [in] win16 function to call */
 458         DWORD arg               /* [in] single DWORD argument to function */
 459 ) {
 460         DWORD   ret;
 461         TRACE(thunk,"(%p,0x%08lx)...\n",fproc,arg);
 462         ret =  Callbacks->CallWOWCallbackProc(fproc,arg);
 463         TRACE(thunk,"... returns %ld\n",ret);
 464         return ret;
 465 }
 466
 467 /**********************************************************************
 468  *           WOWCallback16Ex (KERNEL32.55)(WOW32.3)
 469  * Calls a function in 16bit code.
 470  * RETURNS
 471  *      TRUE for success
 472  */
 473 BOOL32 WINAPI WOWCallback16Ex(
 474         FARPROC16 vpfn16,       /* [in] win16 function to call */
 475         DWORD dwFlags,          /* [in] flags */
 476         DWORD cbArgs,           /* [in] nr of arguments */
 477         LPVOID pArgs,           /* [in] pointer to arguments (LPDWORD) */
 478         LPDWORD pdwRetCode      /* [out] return value of win16 function */
 479 ) {
 480         return Callbacks->CallWOWCallback16Ex(vpfn16,dwFlags,cbArgs,pArgs,pdwRetCode);
 481 }
 482
 483 /***********************************************************************
 484  *              ThunkInitLS     (KERNEL32.43)
 485  * A thunkbuffer link routine
 486  * The thunkbuf looks like:
 487  *
 488  *      00: DWORD       length          ? don't know exactly
 489  *      04: SEGPTR      ptr             ? where does it point to?
 490  * The pointer ptr is written into the first DWORD of 'thunk'.
 491  * (probably correct implemented)
 492  * [ok probably]
 493  * RETURNS
 494  *      segmented pointer to thunk?
 495  */
 496 DWORD WINAPI ThunkInitLS(
 497         LPDWORD thunk,  /* [in] win32 thunk */
 498         LPCSTR thkbuf,  /* [in] thkbuffer name in win16 dll */
 499         DWORD len,      /* [in] thkbuffer length */
 500         LPCSTR dll16,   /* [in] name of win16 dll */
 501         LPCSTR dll32    /* [in] name of win32 dll (FIXME: not used?) */
 502 ) {
 503         LPDWORD         addr;
 504
 505         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 506                 return 0;
 507
 508         if (!addr[1])
 509                 return 0;
 510         *(DWORD*)thunk = addr[1];
 511
 512         return addr[1];
 513 }
 514
 515 /***********************************************************************
 516  *              Common32ThkLS   (KERNEL32.45)
 517  *
 518  * This is another 32->16 thunk, independent of the QT_Thunk/FT_Thunk
 519  * style thunks. The basic difference is that the parameter conversion
 520  * is done completely on the *16-bit* side here. Thus we do not call
 521  * the 16-bit target directly, but call a common entry point instead.
 522  * This entry function then calls the target according to the target
 523  * number passed in the DI register.
 524  *
 525  * Input:  EAX    SEGPTR to the common 16-bit entry point
 526  *         CX     offset in thunk table (target number * 4)
 527  *         DX     error return value if execution fails (unclear???)
 528  *         EDX.HI number of DWORD parameters
 529  *
 530  * (Note that we need to move the thunk table offset from CX to DI !)
 531  *
 532  * The called 16-bit stub expects its stack to look like this:
 533  *     ...
 534  *   (esp+40)  32-bit arguments
 535  *     ...
 536  *   (esp+8)   32 byte of stack space available as buffer
 537  *   (esp)     8 byte return address for use with 0x66 lret
 538  *
 539  * The called 16-bit stub uses a 0x66 lret to return to 32-bit code,
 540  * and uses the EAX register to return a DWORD return value.
 541  * Thus we need to use a special assembly glue routine
 542  * (CallRegisterLongProc instead of CallRegisterShortProc).
 543  *
 544  * Finally, we return to the caller, popping the arguments off
 545  * the stack.
 546  *
 547  * FIXME: The called function uses EBX to return the number of
 548  *        arguments that are to be popped off the caller's stack.
 549  *        This is clobbered by the assembly glue, so we simply use
 550  *        the original EDX.HI to get the number of arguments.
 551  *        (Those two values should be equal anyway ...?)
 552  *
 553  */
 554 REGS_ENTRYPOINT(Common32ThkLS)
 555 {
 556     CONTEXT context16;
 557     DWORD argsize;
 558     THDB *thdb = THREAD_Current();
 559
 560     memcpy(&context16,context,sizeof(context16));
 561
 562     DI_reg(&context16)  = CX_reg(context);
 563     CS_reg(&context16)  = HIWORD(EAX_reg(context));
 564     IP_reg(&context16)  = LOWORD(EAX_reg(context));
 565     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 566                            + (WORD)&((STACK16FRAME*)0)->bp;
 567
 568     argsize = HIWORD(EDX_reg(context)) * 4;
 569
 570     /* FIXME: hack for stupid USER32 CallbackGlueLS routine */
 571     if (EDX_reg(context) == EIP_reg(context))
 572         argsize = 6 * 4;
 573
 574     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 575             (LPBYTE)ESP_reg(context)+4, argsize );
 576
 577     EAX_reg(context) = Callbacks->CallRegisterLongProc(&context16, argsize + 32);
 578
 579     /* Clean up caller's stack frame */
 580
 581     EIP_reg(context) = STACK32_POP(context);
 582     ESP_reg(context) += argsize;
 583     STACK32_PUSH(context, EIP_reg(context));
 584 }
 585
 586 /***********************************************************************
 587  *              OT_32ThkLSF     (KERNEL32.40)
 588  *
 589  * YET Another 32->16 thunk. The difference to Common32ThkLS is that
 590  * argument processing is done on both the 32-bit and the 16-bit side:
 591  * The 32-bit side prepares arguments, copying them onto the stack.
 592  *
 593  * When this routine is called, the first word on the stack is the
 594  * number of argument bytes prepared by the 32-bit code, and EDX
 595  * contains the 16-bit target address.
 596  *
 597  * The called 16-bit routine is another relaycode, doing further
 598  * argument processing and then calling the real 16-bit target
 599  * whose address is stored at [bp-04].
 600  *
 601  * The call proceeds using a normal CallRegisterShortProc.
 602  * After return from the 16-bit relaycode, the arguments need
 603  * to be copied *back* to the 32-bit stack, since the 32-bit
 604  * relaycode processes output parameters.
 605  *
 606  * Note that we copy twice the number of arguments, since some of the
 607  * 16-bit relaycodes in SYSTHUNK.DLL directly access the original
 608  * arguments of the caller!
 609  *
 610  * (Note that this function seems only to be used for
 611  *  OLECLI32 -> OLECLI and OLESVR32 -> OLESVR thunking.)
 612  */
 613 REGS_ENTRYPOINT(OT_32ThkLSF)
 614 {
 615     CONTEXT context16;
 616     DWORD argsize;
 617     THDB *thdb = THREAD_Current();
 618
 619     memcpy(&context16,context,sizeof(context16));
 620
 621     CS_reg(&context16)  = HIWORD(EDX_reg(context));
 622     IP_reg(&context16)  = LOWORD(EDX_reg(context));
 623     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 624                            + (WORD)&((STACK16FRAME*)0)->bp;
 625
 626     argsize = 2 * *(WORD *)(ESP_reg(context) + 4) + 2;
 627
 628     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 629             (LPBYTE)ESP_reg(context)+4, argsize );
 630
 631     EAX_reg(context) = Callbacks->CallRegisterShortProc(&context16, argsize);
 632
 633     memcpy( (LPBYTE)ESP_reg(context)+4,
 634             ((LPBYTE)THREAD_STACK16(thdb))-argsize, argsize );
 635 }
 636
 637 /***********************************************************************
 638  *              ThunkInitLSF            (KERNEL32.41)
 639  * A thunk setup routine.
 640  * Expects a pointer to a preinitialized thunkbuffer in the first argument
 641  * looking like:
 642  *      00..03:         unknown (pointer, check _41, _43, _46)
 643  *      04: EB1E                jmp +0x20
 644  *
 645  *      06..23:         unknown (space for replacement code, check .90)
 646  *
 647  *      24:>E800000000          call offset 29
 648  *      29:>58                  pop eax            ( target of call )
 649  *      2A: 2D25000000          sub eax,0x00000025 ( now points to offset 4 )
 650  *      2F: BAxxxxxxxx          mov edx,xxxxxxxx
 651  *      34: 68yyyyyyyy          push KERNEL32.90
 652  *      39: C3                  ret
 653  *
 654  *      3A: EB1E                jmp +0x20
 655  *      3E ... 59:      unknown (space for replacement code?)
 656  *      5A: E8xxxxxxxx          call <32bitoffset xxxxxxxx>
 657  *      5F: 5A                  pop edx
 658  *      60: 81EA25xxxxxx        sub edx, 0x25xxxxxx
 659  *      66: 52                  push edx
 660  *      67: 68xxxxxxxx          push xxxxxxxx
 661  *      6C: 68yyyyyyyy          push KERNEL32.89
 662  *      71: C3                  ret
 663  *      72: end?
 664  * This function checks if the code is there, and replaces the yyyyyyyy entries
 665  * by the functionpointers.
 666  * The thunkbuf looks like:
 667  *
 668  *      00: DWORD       length          ? don't know exactly
 669  *      04: SEGPTR      ptr             ? where does it point to?
 670  * The segpointer ptr is written into the first DWORD of 'thunk'.
 671  * [ok probably]
 672  * RETURNS
 673  *      unclear, pointer to win16 thkbuffer?
 674  */
 675 LPVOID WINAPI ThunkInitLSF(
 676         LPBYTE thunk,   /* [in] win32 thunk */
 677         LPCSTR thkbuf,  /* [in] thkbuffer name in win16 dll */
 678         DWORD len,      /* [in] length of thkbuffer */
 679         LPCSTR dll16,   /* [in] name of win16 dll */
 680         LPCSTR dll32    /* [in] name of win32 dll */
 681 ) {
 682         HMODULE32       hkrnl32 = GetModuleHandle32A("KERNEL32");
 683         LPDWORD         addr,addr2;
 684
 685         /* FIXME: add checks for valid code ... */
 686         /* write pointers to kernel32.89 and kernel32.90 (+ordinal base of 1) */
 687         *(DWORD*)(thunk+0x35) = (DWORD)GetProcAddress32(hkrnl32,(LPSTR)90);
 688         *(DWORD*)(thunk+0x6D) = (DWORD)GetProcAddress32(hkrnl32,(LPSTR)89);
 689
 690
 691         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 692                 return 0;
 693
 694         addr2 = PTR_SEG_TO_LIN(addr[1]);
 695         if (HIWORD(addr2))
 696                 *(DWORD*)thunk = (DWORD)addr2;
 697
 698         return addr2;
 699 }
 700
 701 /***********************************************************************
 702  *              FT_PrologPrime                  (KERNEL32.89)
 703  *
 704  * This function is called from the relay code installed by
 705  * ThunkInitLSF. It replaces the location from where it was
 706  * called by a standard FT_Prolog call stub (which is 'primed'
 707  * by inserting the correct target table pointer).
 708  * Finally, it calls that stub.
 709  *
 710  * Input:  ECX    target number + flags (passed through to FT_Prolog)
 711  *        (ESP)   offset of location where target table pointer
 712  *                is stored, relative to the start of the relay code
 713  *        (ESP+4) pointer to start of relay code
 714  *                (this is where the FT_Prolog call stub gets written to)
 715  *
 716  * Note: The two DWORD arguments get popped from the stack.
 717  *
 718  */
 719 REGS_ENTRYPOINT(FT_PrologPrime)
 720 {
 721     DWORD  targetTableOffset = STACK32_POP(context);
 722     LPBYTE relayCode = (LPBYTE)STACK32_POP(context);
 723     DWORD *targetTable = *(DWORD **)(relayCode+targetTableOffset);
 724     DWORD  targetNr = LOBYTE(ECX_reg(context));
 725
 726     _write_ftprolog(relayCode, targetTable);
 727
 728     /* We should actually call the relay code now, */
 729     /* but we skip it and go directly to FT_Prolog */
 730     EDX_reg(context) = targetTable[targetNr];
 731     __regs_FT_Prolog(context);
 732 }
 733
 734 /***********************************************************************
 735  *              QT_ThunkPrime                   (KERNEL32.90)
 736  *
 737  * This function corresponds to FT_PrologPrime, but installs a
 738  * call stub for QT_Thunk instead.
 739  *
 740  * Input: (EBP-4) target number (passed through to QT_Thunk)
 741  *         EDX    target table pointer location offset
 742  *         EAX    start of relay code
 743  *
 744  */
 745 REGS_ENTRYPOINT(QT_ThunkPrime)
 746 {
 747     DWORD  targetTableOffset = EDX_reg(context);
 748     LPBYTE relayCode = (LPBYTE)EAX_reg(context);
 749     DWORD *targetTable = *(DWORD **)(relayCode+targetTableOffset);
 750     DWORD  targetNr = LOBYTE(*(DWORD *)(EBP_reg(context) - 4));
 751
 752     _write_qtthunk(relayCode, targetTable);
 753
 754     /* We should actually call the relay code now, */
 755     /* but we skip it and go directly to QT_Thunk */
 756     EDX_reg(context) = targetTable[targetNr];
 757     __regs_QT_Thunk(context);
 758 }
 759
 760 /***********************************************************************
 761  *                                                      (KERNEL32.46)
 762  * Another thunkbuf link routine.
 763  * The start of the thunkbuf looks like this:
 764  *      00: DWORD       length
 765  *      04: SEGPTR      address for thunkbuffer pointer
 766  * [ok probably]
 767  */
 768 VOID WINAPI ThunkInitSL(
 769         LPBYTE thunk,           /* [in] start of thunkbuffer */
 770         LPCSTR thkbuf,          /* [in] name/ordinal of thunkbuffer in win16 dll */
 771         DWORD len,              /* [in] length of thunkbuffer */
 772         LPCSTR dll16,           /* [in] name of win16 dll containing the thkbuf */
 773         LPCSTR dll32            /* [in] win32 dll. FIXME: strange, unused */
 774 ) {
 775         LPDWORD         addr;
 776
 777         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 778                 return;
 779
 780         *(DWORD*)PTR_SEG_TO_LIN(addr[1]) = (DWORD)thunk;
 781 }
 782
 783 /**********************************************************************
 784  *           SSInit             KERNEL.700
 785  * RETURNS
 786  *      TRUE for success.
 787  */
 788 BOOL32 WINAPI SSInit()
 789 {
 790     return TRUE;
 791 }
 792
 793 /**********************************************************************
 794  *           SSOnBigStack       KERNEL32.87
 795  * Check if thunking is initialized (ss selector set up etc.)
 796  * We do that differently, so just return TRUE.
 797  * [ok]
 798  * RETURNS
 799  *      TRUE for success.
 800  */
 801 BOOL32 WINAPI SSOnBigStack()
 802 {
 803     TRACE(thunk, "Yes, thunking is initialized\n");
 804     return TRUE;
 805 }
 806
 807 /**********************************************************************
 808  *           SSCall
 809  * One of the real thunking functions. This one seems to be for 32<->32
 810  * thunks. It should probably be capable of crossing processboundaries.
 811  *
 812  * And YES, I've seen nr=48 (somewhere in the Win95 32<->16 OLE coupling)
 813  * [ok]
 814  */
 815 DWORD WINAPIV SSCall(
 816         DWORD nr,       /* [in] number of argument bytes */
 817         DWORD flags,    /* [in] FIXME: flags ? */
 818         FARPROC32 fun,  /* [in] function to call */
 819         ...             /* [in/out] arguments */
 820 ) {
 821     DWORD i,ret;
 822     DWORD *args = ((DWORD *)&fun) + 1;
 823
 824     if(TRACE_ON(thunk)){
 825       dbg_decl_str(thunk, 256);
 826       for (i=0;i<nr/4;i++)
 827         dsprintf(thunk,"0x%08lx,",args[i]);
 828       TRACE(thunk,"(%ld,0x%08lx,%p,[%s])\n",
 829                     nr,flags,fun,dbg_str(thunk));
 830     }
 831     switch (nr) {
 832     case 0:     ret = fun();
 833                 break;
 834     case 4:     ret = fun(args[0]);
 835                 break;
 836     case 8:     ret = fun(args[0],args[1]);
 837                 break;
 838     case 12:    ret = fun(args[0],args[1],args[2]);
 839                 break;
 840     case 16:    ret = fun(args[0],args[1],args[2],args[3]);
 841                 break;
 842     case 20:    ret = fun(args[0],args[1],args[2],args[3],args[4]);
 843                 break;
 844     case 24:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5]);
 845                 break;
 846     case 28:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6]);
 847                 break;
 848     case 32:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7]);
 849                 break;
 850     case 36:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8]);
 851                 break;
 852     case 40:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9]);
 853                 break;
 854     case 44:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9],args[10]);
 855                 break;
 856     case 48:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9],args[10],args[11]);
 857                 break;
 858     default:
 859         WARN(thunk,"Unsupported nr of arguments, %ld\n",nr);
 860         ret = 0;
 861         break;
 862
 863     }
 864     TRACE(thunk," returning %ld ...\n",ret);
 865     return ret;
 866 }
 867
 868 /**********************************************************************
 869  *           W32S_BackTo32                      (KERNEL32.51)
 870  */
 871 REGS_ENTRYPOINT(W32S_BackTo32)
 872 {
 873     LPDWORD stack = (LPDWORD)ESP_reg( context );
 874     FARPROC32 proc = (FARPROC32) stack[0];
 875
 876     EAX_reg( context ) = proc( stack[2], stack[3], stack[4], stack[5], stack[6],
 877                                stack[7], stack[8], stack[9], stack[10], stack[11] );
 878
 879     EIP_reg( context ) = stack[1];
 880 }
 881
 882 /**********************************************************************
 883  *                      AllocSLCallback         (KERNEL32)
 884  *
 885  * Win95 uses some structchains for callbacks. It allocates them
 886  * in blocks of 100 entries, size 32 bytes each, layout:
 887  * blockstart:
 888  *      0:      PTR     nextblockstart
 889  *      4:      entry   *first;
 890  *      8:      WORD    sel ( start points to blockstart)
 891  *      A:      WORD    unknown
 892  * 100xentry:
 893  *      00..17:         Code
 894  *      18:     PDB     *owning_process;
 895  *      1C:     PTR     blockstart
 896  *
 897  * We ignore this for now. (Just a note for further developers)
 898  * FIXME: use this method, so we don't waste selectors...
 899  *
 900  * Following code is then generated by AllocSLCallback. The code is 16 bit, so
 901  * the 0x66 prefix switches from word->long registers.
 902  *
 903  *      665A            pop     edx
 904  *      6668x arg2 x    pushl   <arg2>
 905  *      6652            push    edx
 906  *      EAx arg1 x      jmpf    <arg1>
 907  *
 908  * returns the startaddress of this thunk.
 909  *
 910  * Note, that they look very similair to the ones allocates by THUNK_Alloc.
 911  * RETURNS
 912  *      segmented pointer to the start of the thunk
 913  */
 914 DWORD WINAPI
 915 AllocSLCallback(
 916         DWORD finalizer,        /* [in] finalizer function */
 917         DWORD callback          /* [in] callback function */
 918 ) {
 919         LPBYTE  x,thunk = HeapAlloc( GetProcessHeap(), 0, 32 );
 920         WORD    sel;
 921
 922         x=thunk;
 923         *x++=0x66;*x++=0x5a;                            /* popl edx */
 924         *x++=0x66;*x++=0x68;*(DWORD*)x=finalizer;x+=4;  /* pushl finalizer */
 925         *x++=0x66;*x++=0x52;                            /* pushl edx */
 926         *x++=0xea;*(DWORD*)x=callback;x+=4;             /* jmpf callback */
 927
 928         *(PDB32**)(thunk+18) = PROCESS_Current();
 929
 930         sel = SELECTOR_AllocBlock( thunk , 32, SEGMENT_CODE, FALSE, FALSE );
 931         return (sel<<16)|0;
 932 }
 933
 934 /**********************************************************************
 935  *              FreeSLCallback          (KERNEL32.274)
 936  * Frees the specified 16->32 callback
 937  */
 938 void WINAPI
 939 FreeSLCallback(
 940         DWORD x /* [in] 16 bit callback (segmented pointer?) */
 941 ) {
 942         FIXME(win32,"(0x%08lx): stub\n",x);
 943 }
 944
 945
 946 /**********************************************************************
 947  *              GetTEBSelectorFS        (KERNEL.475)
 948  *      Set the 16-bit %fs to the 32-bit %fs (current TEB selector)
 949  */
 950 VOID WINAPI GetTEBSelectorFS( CONTEXT *context )
 951 {
 952     GET_FS( FS_reg(context) );
 953 }
 954
 955 /**********************************************************************
 956  *              KERNEL_431              (KERNEL.431)
 957  *              IsPeFormat              (W32SYS.2)
 958  * Checks the passed filename if it is a PE format executeable
 959  * RETURNS
 960  *  TRUE, if it is.
 961  *  FALSE if not.
 962  */
 963 BOOL16 WINAPI IsPeFormat(
 964         LPSTR   fn,     /* [in] filename to executeable */
 965         HFILE16 hf16    /* [in] open file, if filename is NULL */
 966 ) {
 967         IMAGE_DOS_HEADER        mzh;
 968         HFILE32                 hf=HFILE16_TO_HFILE32(hf16);
 969         OFSTRUCT                ofs;
 970         DWORD                   xmagic;
 971
 972         if (fn) {
 973                 hf = OpenFile32(fn,&ofs,OF_READ);
 974                 if (hf==HFILE_ERROR32)
 975                         return FALSE;
 976         }
 977         _llseek32(hf,0,SEEK_SET);
 978         if (sizeof(mzh)!=_lread32(hf,&mzh,sizeof(mzh))) {
 979                 _lclose32(hf);
 980                 return FALSE;
 981         }
 982         if (mzh.e_magic!=IMAGE_DOS_SIGNATURE) {
 983                 WARN(dosmem,"File has not got dos signature!\n");
 984                 _lclose32(hf);
 985                 return FALSE;
 986         }
 987         _llseek32(hf,mzh.e_lfanew,SEEK_SET);
 988         if (sizeof(DWORD)!=_lread32(hf,&xmagic,sizeof(DWORD))) {
 989                 _lclose32(hf);
 990                 return FALSE;
 991         }
 992         _lclose32(hf);
 993         return (xmagic == IMAGE_NT_SIGNATURE);
 994 }
 995
 996 /***********************************************************************
 997  *           WOWHandle32                        (KERNEL32.57)(WOW32.16)
 998  * Converts a win16 handle of type into the respective win32 handle.
 999  * We currently just return this handle, since most handles are the same
1000  * for win16 and win32.
1001  * RETURNS
1002  *      The new handle
1003  */
1004 HANDLE32 WINAPI WOWHandle32(
1005         WORD handle,            /* [in] win16 handle */
1006         WOW_HANDLE_TYPE type    /* [in] handle type */
1007 ) {
1008         TRACE(win32,"(0x%04x,%d)\n",handle,type);
1009         return (HANDLE32)handle;
1010 }
1011
1012 /***********************************************************************
1013  *           K32Thk1632Prolog                   (KERNEL32.492)
1014  */
1015 REGS_ENTRYPOINT(K32Thk1632Prolog)
1016 {
1017    LPBYTE code = (LPBYTE)EIP_reg(context) - 5;
1018
1019    /* Arrrgh! SYSTHUNK.DLL just has to re-implement another method
1020       of 16->32 thunks instead of using one of the standard methods!
1021       This means that SYSTHUNK.DLL itself switches to a 32-bit stack,
1022       and does a far call to the 32-bit code segment of OLECLI32/OLESVR32.
1023       Unfortunately, our CallTo/CallFrom mechanism is therefore completely
1024       bypassed, which means it will crash the next time the 32-bit OLE
1025       code thunks down again to 16-bit (this *will* happen!).
1026
1027       The following hack tries to recognize this situation.
1028       This is possible since the called stubs in OLECLI32/OLESVR32 all
1029       look exactly the same:
1030         00   E8xxxxxxxx    call K32Thk1632Prolog
1031         05   FF55FC        call [ebp-04]
1032         08   E8xxxxxxxx    call K32Thk1632Epilog
1033         0D   66CB          retf
1034
1035       If we recognize this situation, we try to simulate the actions
1036       of our CallTo/CallFrom mechanism by copying the 16-bit stack
1037       to our 32-bit stack, creating a proper STACK16FRAME and
1038       updating thdb->cur_stack. */
1039
1040    if (   code[5] == 0xFF && code[6] == 0x55 && code[7] == 0xFC
1041        && code[13] == 0x66 && code[14] == 0xCB)
1042    {
1043       WORD  stackSel  = NtCurrentTeb()->stack_sel;
1044       DWORD stackBase = GetSelectorBase(stackSel);
1045
1046       THDB *thdb = THREAD_Current();
1047       DWORD argSize = EBP_reg(context) - ESP_reg(context);
1048       char *stack16 = (char *)ESP_reg(context);
1049       char *stack32 = (char *)thdb->cur_stack - argSize;
1050       STACK16FRAME *frame16 = (STACK16FRAME *)stack16 - 1;
1051
1052       TRACE(thunk, "before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1053                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1054
1055       memset(frame16, '\0', sizeof(STACK16FRAME));
1056       frame16->frame32 = (STACK32FRAME *)thdb->cur_stack;
1057       frame16->ebp = EBP_reg(context);
1058
1059       memcpy(stack32, stack16, argSize);
1060       thdb->cur_stack = PTR_SEG_OFF_TO_SEGPTR(stackSel, (DWORD)frame16 - stackBase);
1061
1062       ESP_reg(context) = (DWORD)stack32;
1063       EBP_reg(context) = ESP_reg(context) + argSize;
1064
1065       TRACE(thunk, "after  SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1066                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1067    }
1068
1069    SYSLEVEL_ReleaseWin16Lock();
1070 }
1071
1072 /***********************************************************************
1073  *           K32Thk1632Epilog                   (KERNEL32.491)
1074  */
1075 REGS_ENTRYPOINT(K32Thk1632Epilog)
1076 {
1077    LPBYTE code = (LPBYTE)EIP_reg(context) - 13;
1078
1079    SYSLEVEL_RestoreWin16Lock();
1080
1081    /* We undo the SYSTHUNK hack if necessary. See K32Thk1632Prolog. */
1082
1083    if (   code[5] == 0xFF && code[6] == 0x55 && code[7] == 0xFC
1084        && code[13] == 0x66 && code[14] == 0xCB)
1085    {
1086       THDB *thdb = THREAD_Current();
1087       STACK16FRAME *frame16 = (STACK16FRAME *)PTR_SEG_TO_LIN(thdb->cur_stack);
1088       char *stack16 = (char *)(frame16 + 1);
1089       DWORD argSize = frame16->ebp - (DWORD)stack16;
1090       char *stack32 = (char *)frame16->frame32 - argSize;
1091
1092       DWORD nArgsPopped = ESP_reg(context) - (DWORD)stack32;
1093
1094       TRACE(thunk, "before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1095                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1096
1097       thdb->cur_stack = (DWORD)frame16->frame32;
1098
1099       ESP_reg(context) = (DWORD)stack16 + nArgsPopped;
1100       EBP_reg(context) = frame16->ebp;
1101
1102       TRACE(thunk, "after  SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1103                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1104    }
1105 }
1106