relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  */
   6
   7 #include "config.h"
   8
   9 #include <assert.h>
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include "winbase.h"
  13 #include "wingdi.h"
  14 #include "winuser.h"
  15 #include "winnt.h"
  16 #include "heap.h"
  17 #include "builtin32.h"
  18 #include "snoop.h"
  19 #include "neexe.h"
  20 #include "selectors.h"
  21 #include "stackframe.h"
  22 #include "debugtools.h"
  23 #include "wine/exception.h"
  24
  25 DEFAULT_DEBUG_CHANNEL(snoop);
  26
  27 static WINE_EXCEPTION_FILTER(page_fault)
  28 {
  29     if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION)
  30         return EXCEPTION_EXECUTE_HANDLER;
  31     return EXCEPTION_CONTINUE_SEARCH;
  32 }
  33
  34 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
  35
  36 #ifdef __i386__
  37
  38 extern void WINAPI SNOOP_Entry();
  39 extern void WINAPI SNOOP_Return();
  40
  41 #ifdef NEED_UNDERSCORE_PREFIX
  42 # define PREFIX "_"
  43 #else
  44 # define PREFIX
  45 #endif
  46
  47 #include "pshpack1.h"
  48
  49 typedef struct tagSNOOP_FUN {
  50         /* code part */
  51         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  52         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  53          * calculation!
  54          */
  55         DWORD           snoopentry;     /* SNOOP_Entry relative */
  56         /* unreached */
  57         int             nrofargs;
  58         FARPROC origfun;
  59         char            *name;
  60 } SNOOP_FUN;
  61
  62 typedef struct tagSNOOP_DLL {
  63         HMODULE hmod;
  64         SNOOP_FUN       *funs;
  65         LPCSTR          name;
  66         int             nrofordinals;
  67         struct tagSNOOP_DLL     *next;
  68 } SNOOP_DLL;
  69 typedef struct tagSNOOP_RETURNENTRY {
  70         /* code part */
  71         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  72         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  73          * calculation!
  74          */
  75         DWORD           snoopret;       /* SNOOP_Ret relative */
  76         /* unreached */
  77         FARPROC origreturn;
  78         SNOOP_DLL       *dll;
  79         DWORD           ordinal;
  80         DWORD           origESP;
  81         DWORD           *args;          /* saved args across a stdcall */
  82 } SNOOP_RETURNENTRY;
  83
  84 typedef struct tagSNOOP_RETURNENTRIES {
  85         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  86         struct tagSNOOP_RETURNENTRIES   *next;
  87 } SNOOP_RETURNENTRIES;
  88
  89 #include "poppack.h"
  90
  91 static  SNOOP_DLL               *firstdll = NULL;
  92 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
  93
  94 /***********************************************************************
  95  *          SNOOP_ShowDebugmsgSnoop
  96  *
  97  * Simple function to decide if a particular debugging message is
  98  * wanted.
  99  */
 100 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
 101
 102   if(debug_snoop_excludelist || debug_snoop_includelist) {
 103     char **listitem;
 104     char buf[80];
 105     int len, len2, itemlen, show;
 106
 107     if(debug_snoop_excludelist) {
 108       show = 1;
 109       listitem = debug_snoop_excludelist;
 110     } else {
 111       show = 0;
 112       listitem = debug_snoop_includelist;
 113     }
 114     len = strlen(dll);
 115     assert(len < 64);
 116     sprintf(buf, "%s.%d", dll, ord);
 117     len2 = strlen(buf);
 118     for(; *listitem; listitem++) {
 119       itemlen = strlen(*listitem);
 120       if((itemlen == len && !strncmp(*listitem, buf, len)) ||
 121          (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
 122          !strcmp(*listitem, fname)) {
 123         show = !show;
 124        break;
 125       }
 126     }
 127     return show;
 128   }
 129   return 1;
 130 }
 131
 132 void
 133 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
 134         SNOOP_DLL       **dll = &(firstdll);
 135         char            *s;
 136
 137         if (!TRACE_ON(snoop)) return;
 138         while (*dll) {
 139                 if ((*dll)->hmod == hmod)
 140                         return; /* already registered */
 141                 dll = &((*dll)->next);
 142         }
 143         *dll = (SNOOP_DLL*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
 144         (*dll)->next    = NULL;
 145         (*dll)->hmod    = hmod;
 146         (*dll)->nrofordinals = nrofordinals;
 147         (*dll)->name    = HEAP_strdupA(GetProcessHeap(),0,name);
 148         if ((s=strrchr((*dll)->name,'.')))
 149                 *s='\0';
 150         (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 151         memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
 152         if (!(*dll)->funs) {
 153                 HeapFree(GetProcessHeap(),0,*dll);
 154                 FIXME("out of memory\n");
 155                 return;
 156         }
 157 }
 158
 159 FARPROC
 160 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 161         SNOOP_DLL                       *dll = firstdll;
 162         SNOOP_FUN                       *fun;
 163         int                             j;
 164         IMAGE_SECTION_HEADER            *pe_seg = PE_SECTIONS(hmod);
 165
 166         if (!TRACE_ON(snoop)) return origfun;
 167         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 168                 return origfun;
 169         for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
 170                 /* 0x42 is special ELF loader tag */
 171                 if ((pe_seg[j].VirtualAddress==0x42) ||
 172                     (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
 173                      ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
 174                                    pe_seg[j].SizeOfRawData
 175                    ))
 176                 )
 177                         break;
 178         /* If we looked through all sections (and didn't find one)
 179          * or if the sectionname contains "data", we return the
 180          * original function since it is most likely a datareference.
 181          */
 182         if (    (j==PE_HEADER(hmod)->FileHeader.NumberOfSections)       ||
 183                 (strstr(pe_seg[j].Name,"data"))                         ||
 184                 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
 185         )
 186                 return origfun;
 187
 188         while (dll) {
 189                 if (hmod == dll->hmod)
 190                         break;
 191                 dll=dll->next;
 192         }
 193         if (!dll)       /* probably internal */
 194                 return origfun;
 195         if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
 196                 return origfun;
 197         assert(ordinal<dll->nrofordinals);
 198         fun = dll->funs+ordinal;
 199         if (!fun->name) fun->name = HEAP_strdupA(GetProcessHeap(),0,name);
 200         fun->lcall      = 0xe8;
 201         /* NOTE: origreturn struct member MUST come directly after snoopentry */
 202         fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 203         fun->origfun    = origfun;
 204         fun->nrofargs   = -1;
 205         return (FARPROC)&(fun->lcall);
 206 }
 207
 208 static char*
 209 SNOOP_PrintArg(DWORD x) {
 210         static char     buf[200];
 211         int             i,nostring;
 212         char * volatile ret=0;
 213         MEMORY_BASIC_INFORMATION        mbi;
 214
 215         if (    !HIWORD(x)                                      ||
 216                 !VirtualQuery((LPVOID)x,&mbi,sizeof(mbi))       ||
 217                 !mbi.Type                                       ||
 218                 (mbi.Protect == PAGE_NOACCESS)
 219         ) {
 220                 sprintf(buf,"%08lx",x);
 221                 return buf;
 222         }
 223         __TRY{
 224                 LPBYTE  s=(LPBYTE)x;
 225                 i=0;nostring=0;
 226                 while (i<80) {
 227                         if (s[i]==0) break;
 228                         if (s[i]<0x20) {nostring=1;break;}
 229                         if (s[i]>=0x80) {nostring=1;break;}
 230                         i++;
 231                 }
 232                 if (!nostring) {
 233                         if (i>5) {
 234                                 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
 235                                 ret=buf;
 236                         }
 237                 }
 238         }
 239         __EXCEPT(page_fault){}
 240         __ENDTRY
 241         if (ret)
 242           return ret;
 243         __TRY{
 244                 LPWSTR  s=(LPWSTR)x;
 245                 i=0;nostring=0;
 246                 while (i<80) {
 247                         if (s[i]==0) break;
 248                         if (s[i]<0x20) {nostring=1;break;}
 249                         if (s[i]>0x100) {nostring=1;break;}
 250                         i++;
 251                 }
 252                 if (!nostring) {
 253                         if (i>5) {
 254                                 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
 255                                 ret=buf;
 256                         }
 257                 }
 258         }
 259         __EXCEPT(page_fault){}
 260         __ENDTRY
 261         if (ret)
 262           return ret;
 263         sprintf(buf,"%08lx",x);
 264         return buf;
 265 }
 266
 267 #define CALLER1REF (*(DWORD*)ESP_reg(context))
 268
 269 void WINAPI SNOOP_DoEntry( CONTEXT86 *context );
 270 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Entry, SNOOP_DoEntry );
 271 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
 272 {
 273         DWORD           ordinal=0,entry = EIP_reg(context)-5;
 274         SNOOP_DLL       *dll = firstdll;
 275         SNOOP_FUN       *fun = NULL;
 276         SNOOP_RETURNENTRIES     **rets = &firstrets;
 277         SNOOP_RETURNENTRY       *ret;
 278         int             i,max;
 279
 280         while (dll) {
 281                 if (    ((char*)entry>=(char*)dll->funs)        &&
 282                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 283                 ) {
 284                         fun = (SNOOP_FUN*)entry;
 285                         ordinal = fun-dll->funs;
 286                         break;
 287                 }
 288                 dll=dll->next;
 289         }
 290         if (!dll) {
 291                 FIXME("entrypoint 0x%08lx not found\n",entry);
 292                 return; /* oops */
 293         }
 294         /* guess cdecl ... */
 295         if (fun->nrofargs<0) {
 296                 /* Typical cdecl return frame is:
 297                  *      add esp, xxxxxxxx
 298                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 299                  * (after that 81 C2 xx xx xx xx)
 300                  */
 301                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 302
 303                 if (reteip) {
 304                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 305                                 fun->nrofargs=reteip[2]/4;
 306                 }
 307         }
 308
 309
 310         while (*rets) {
 311                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 312                         if (!(*rets)->entry[i].origreturn)
 313                                 break;
 314                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 315                         break;
 316                 rets = &((*rets)->next);
 317         }
 318         if (!*rets) {
 319                 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 320                 memset(*rets,0,4096);
 321                 i = 0;  /* entry 0 is free */
 322         }
 323         ret = &((*rets)->entry[i]);
 324         ret->lcall      = 0xe8;
 325         /* NOTE: origreturn struct member MUST come directly after snoopret */
 326         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 327         ret->origreturn = (FARPROC)CALLER1REF;
 328         CALLER1REF      = (DWORD)&ret->lcall;
 329         ret->dll        = dll;
 330         ret->args       = NULL;
 331         ret->ordinal    = ordinal;
 332         ret->origESP    = ESP_reg(context);
 333
 334         EIP_reg(context)= (DWORD)fun->origfun;
 335
 336         DPRINTF("CALL %s.%ld: %s(",dll->name,ordinal,fun->name);
 337         if (fun->nrofargs>0) {
 338                 max = fun->nrofargs; if (max>16) max=16;
 339                 for (i=0;i<max;i++)
 340                         DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(ESP_reg(context)+4+sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
 341                 if (max!=fun->nrofargs)
 342                         DPRINTF(" ...");
 343         } else if (fun->nrofargs<0) {
 344                 DPRINTF("<unknown, check return>");
 345                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
 346                 memcpy(ret->args,(LPBYTE)(ESP_reg(context)+4),sizeof(DWORD)*16);
 347         }
 348         DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD)ret->origreturn,FS_reg(context));
 349 }
 350
 351 void WINAPI SNOOP_DoReturn( CONTEXT86 *context );
 352 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Return, SNOOP_DoReturn );
 353 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
 354 {
 355         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(EIP_reg(context)-5);
 356
 357         /* We haven't found out the nrofargs yet. If we called a cdecl
 358          * function it is too late anyway and we can just set '0' (which
 359          * will be the difference between orig and current ESP
 360          * If stdcall -> everything ok.
 361          */
 362         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 363                 ret->dll->funs[ret->ordinal].nrofargs=(ESP_reg(context)-ret->origESP-4)/4;
 364         EIP_reg(context) = (DWORD)ret->origreturn;
 365         if (ret->args) {
 366                 int     i,max;
 367
 368                 DPRINTF("RET  %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
 369                 max = ret->dll->funs[ret->ordinal].nrofargs;
 370                 if (max>16) max=16;
 371
 372                 for (i=0;i<max;i++)
 373                         DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
 374                 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
 375                         EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
 376                 );
 377                 HeapFree(GetProcessHeap(),0,ret->args);
 378                 ret->args = NULL;
 379         } else
 380                 DPRINTF("RET  %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
 381                         ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
 382                         EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
 383                 );
 384         ret->origreturn = NULL; /* mark as empty */
 385 }
 386 #else   /* !__i386__ */
 387 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
 388         FIXME("snooping works only on i386 for now.\n");
 389         return;
 390 }
 391
 392 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 393         return origfun;
 394 }
 395 #endif  /* !__i386__ */