win32/kernel32.c

   1 /*
   2  * KERNEL32 thunks and other undocumented stuff
   3  *
   4  * Copyright 1997-1998 Marcus Meissner
   5  * Copyright 1998      Ulrich Weigand
   6  *
   7  */
   8
   9 #include <string.h>
  10
  11 #include "windef.h"
  12 #include "winbase.h"
  13 #include "wine/winbase16.h"
  14 #include "callback.h"
  15 #include "task.h"
  16 #include "user.h"
  17 #include "heap.h"
  18 #include "module.h"
  19 #include "neexe.h"
  20 #include "process.h"
  21 #include "stackframe.h"
  22 #include "heap.h"
  23 #include "selectors.h"
  24 #include "task.h"
  25 #include "file.h"
  26 #include "debug.h"
  27 #include "flatthunk.h"
  28 #include "syslevel.h"
  29 #include "winerror.h"
  30
  31
  32 /***********************************************************************
  33  *                                                                     *
  34  *                 Win95 internal thunks                               *
  35  *                                                                     *
  36  ***********************************************************************/
  37
  38 /***********************************************************************
  39  * Generates a FT_Prolog call.
  40  *
  41  *  0FB6D1                  movzbl edx,cl
  42  *  8B1495xxxxxxxx          mov edx,[4*edx + targetTable]
  43  *  68xxxxxxxx              push FT_Prolog
  44  *  C3                      lret
  45  */
  46 static void _write_ftprolog(LPBYTE relayCode ,DWORD *targetTable) {
  47         LPBYTE  x;
  48
  49         x       = relayCode;
  50         *x++    = 0x0f;*x++=0xb6;*x++=0xd1; /* movzbl edx,cl */
  51         *x++    = 0x8B;*x++=0x14;*x++=0x95;*(DWORD**)x= targetTable;
  52         x+=4;   /* mov edx, [4*edx + targetTable] */
  53         *x++    = 0x68; *(DWORD*)x = (DWORD)GetProcAddress(GetModuleHandleA("KERNEL32"),"FT_Prolog");
  54         x+=4;   /* push FT_Prolog */
  55         *x++    = 0xC3;         /* lret */
  56         /* fill rest with 0xCC / int 3 */
  57 }
  58
  59 /***********************************************************************
  60  *      _write_qtthunk                                  (internal)
  61  * Generates a QT_Thunk style call.
  62  *
  63  *  33C9                    xor ecx, ecx
  64  *  8A4DFC                  mov cl , [ebp-04]
  65  *  8B148Dxxxxxxxx          mov edx, [4*ecx + targetTable]
  66  *  B8yyyyyyyy              mov eax, QT_Thunk
  67  *  FFE0                    jmp eax
  68  */
  69 static void _write_qtthunk(
  70         LPBYTE relayCode,       /* [in] start of QT_Thunk stub */
  71         DWORD *targetTable      /* [in] start of thunk (for index lookup) */
  72 ) {
  73         LPBYTE  x;
  74
  75         x       = relayCode;
  76         *x++    = 0x33;*x++=0xC9; /* xor ecx,ecx */
  77         *x++    = 0x8A;*x++=0x4D;*x++=0xFC; /* movb cl,[ebp-04] */
  78         *x++    = 0x8B;*x++=0x14;*x++=0x8D;*(DWORD**)x= targetTable;
  79         x+=4;   /* mov edx, [4*ecx + targetTable */
  80         *x++    = 0xB8; *(DWORD*)x = (DWORD)GetProcAddress(GetModuleHandleA("KERNEL32"),"QT_Thunk");
  81         x+=4;   /* mov eax , QT_Thunk */
  82         *x++    = 0xFF; *x++ = 0xE0;    /* jmp eax */
  83         /* should fill the rest of the 32 bytes with 0xCC */
  84 }
  85
  86 /***********************************************************************
  87  *           _loadthunk
  88  */
  89 static LPVOID _loadthunk(LPCSTR module, LPCSTR func, LPCSTR module32,
  90                          struct ThunkDataCommon *TD32, DWORD checksum)
  91 {
  92     struct ThunkDataCommon *TD16;
  93     HMODULE hmod;
  94     int ordinal;
  95
  96     if ((hmod = LoadLibrary16(module)) <= 32)
  97     {
  98         ERR(thunk, "(%s, %s, %s): Unable to load '%s', error %d\n",
  99                    module, func, module32, module, hmod);
 100         return 0;
 101     }
 102
 103     if (   !(ordinal = NE_GetOrdinal(hmod, func))
 104         || !(TD16 = PTR_SEG_TO_LIN(NE_GetEntryPointEx(hmod, ordinal, FALSE))))
 105     {
 106         ERR(thunk, "(%s, %s, %s): Unable to find '%s'\n",
 107                    module, func, module32, func);
 108         return 0;
 109     }
 110
 111     if (TD32 && memcmp(TD16->magic, TD32->magic, 4))
 112     {
 113         ERR(thunk, "(%s, %s, %s): Bad magic %c%c%c%c (should be %c%c%c%c)\n",
 114                    module, func, module32,
 115                    TD16->magic[0], TD16->magic[1], TD16->magic[2], TD16->magic[3],
 116                    TD32->magic[0], TD32->magic[1], TD32->magic[2], TD32->magic[3]);
 117         return 0;
 118     }
 119
 120     if (TD32 && TD16->checksum != TD32->checksum)
 121     {
 122         ERR(thunk, "(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
 123                    module, func, module32, TD16->checksum, TD32->checksum);
 124         return 0;
 125     }
 126
 127     if (!TD32 && checksum && checksum != *(LPDWORD)TD16)
 128     {
 129         ERR(thunk, "(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
 130                    module, func, module32, *(LPDWORD)TD16, checksum);
 131         return 0;
 132     }
 133
 134     return TD16;
 135 }
 136
 137 /***********************************************************************
 138  *           GetThunkStuff    (KERNEL32.53)
 139  */
 140 LPVOID WINAPI GetThunkStuff(LPSTR module, LPSTR func)
 141 {
 142     return _loadthunk(module, func, "<kernel>", NULL, 0L);
 143 }
 144
 145 /***********************************************************************
 146  *           GetThunkBuff    (KERNEL32.52)
 147  * Returns a pointer to ThkBuf in the 16bit library SYSTHUNK.DLL.
 148  */
 149 LPVOID WINAPI GetThunkBuff(void)
 150 {
 151     return GetThunkStuff("SYSTHUNK.DLL", "ThkBuf");
 152 }
 153
 154 /***********************************************************************
 155  *              ThunkConnect32          (KERNEL32)
 156  * Connects a 32bit and a 16bit thunkbuffer.
 157  */
 158 UINT WINAPI ThunkConnect32(
 159         struct ThunkDataCommon *TD,  /* [in/out] thunkbuffer */
 160         LPSTR thunkfun16,            /* [in] win16 thunkfunction */
 161         LPSTR module16,              /* [in] name of win16 dll */
 162         LPSTR module32,              /* [in] name of win32 dll */
 163         HMODULE hmod32,            /* [in] hmodule of win32 dll */
 164         DWORD dwReason               /* [in] initialisation argument */
 165 ) {
 166     BOOL directionSL;
 167
 168     if (!lstrncmpA(TD->magic, "SL01", 4))
 169     {
 170         directionSL = TRUE;
 171
 172         TRACE(thunk, "SL01 thunk %s (%lx) <- %s (%s), Reason: %ld\n",
 173                      module32, (DWORD)TD, module16, thunkfun16, dwReason);
 174     }
 175     else if (!lstrncmpA(TD->magic, "LS01", 4))
 176     {
 177         directionSL = FALSE;
 178
 179         TRACE(thunk, "LS01 thunk %s (%lx) -> %s (%s), Reason: %ld\n",
 180                      module32, (DWORD)TD, module16, thunkfun16, dwReason);
 181     }
 182     else
 183     {
 184         ERR(thunk, "Invalid magic %c%c%c%c\n",
 185                    TD->magic[0], TD->magic[1], TD->magic[2], TD->magic[3]);
 186         return 0;
 187     }
 188
 189     switch (dwReason)
 190     {
 191         case DLL_PROCESS_ATTACH:
 192         {
 193             struct ThunkDataCommon *TD16;
 194             if (!(TD16 = _loadthunk(module16, thunkfun16, module32, TD, 0L)))
 195                 return 0;
 196
 197             if (directionSL)
 198             {
 199                 struct ThunkDataSL32 *SL32 = (struct ThunkDataSL32 *)TD;
 200                 struct ThunkDataSL16 *SL16 = (struct ThunkDataSL16 *)TD16;
 201                 struct SLTargetDB *tdb;
 202
 203                 if (SL16->fpData == NULL)
 204                 {
 205                     ERR(thunk, "ThunkConnect16 was not called!\n");
 206                     return 0;
 207                 }
 208
 209                 SL32->data = SL16->fpData;
 210
 211                 tdb = HeapAlloc(GetProcessHeap(), 0, sizeof(*tdb));
 212                 tdb->process = PROCESS_Current();
 213                 tdb->targetTable = (DWORD *)(thunkfun16 + SL32->offsetTargetTable);
 214
 215                 tdb->next = SL32->data->targetDB;   /* FIXME: not thread-safe! */
 216                 SL32->data->targetDB = tdb;
 217
 218                 TRACE(thunk, "Process %08lx allocated TargetDB entry for ThunkDataSL %08lx\n",
 219                              (DWORD)PROCESS_Current(), (DWORD)SL32->data);
 220             }
 221             else
 222             {
 223                 struct ThunkDataLS32 *LS32 = (struct ThunkDataLS32 *)TD;
 224                 struct ThunkDataLS16 *LS16 = (struct ThunkDataLS16 *)TD16;
 225
 226                 LS32->targetTable = PTR_SEG_TO_LIN(LS16->targetTable);
 227
 228                 /* write QT_Thunk and FT_Prolog stubs */
 229                 _write_qtthunk ((LPBYTE)TD + LS32->offsetQTThunk,  LS32->targetTable);
 230                 _write_ftprolog((LPBYTE)TD + LS32->offsetFTProlog, LS32->targetTable);
 231             }
 232             break;
 233         }
 234
 235         case DLL_PROCESS_DETACH:
 236             /* FIXME: cleanup */
 237             break;
 238     }
 239
 240     return 1;
 241 }
 242
 243 /**********************************************************************
 244  *              QT_Thunk                        (KERNEL32)
 245  *
 246  * The target address is in EDX.
 247  * The 16 bit arguments start at ESP+4.
 248  * The number of 16bit argumentbytes is EBP-ESP-0x44 (68 Byte thunksetup).
 249  * [ok]
 250  */
 251 REGS_ENTRYPOINT(QT_Thunk)
 252 {
 253     CONTEXT context16;
 254     DWORD argsize;
 255     THDB *thdb = THREAD_Current();
 256
 257     memcpy(&context16,context,sizeof(context16));
 258
 259     CS_reg(&context16)  = HIWORD(EDX_reg(context));
 260     IP_reg(&context16)  = LOWORD(EDX_reg(context));
 261     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 262                            + (WORD)&((STACK16FRAME*)0)->bp;
 263
 264     argsize = EBP_reg(context)-ESP_reg(context)-0x44;
 265
 266     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 267             (LPBYTE)ESP_reg(context)+4, argsize );
 268
 269     EAX_reg(context) = Callbacks->CallRegisterShortProc( &context16, argsize );
 270     EDX_reg(context) = HIWORD(EAX_reg(context));
 271     EAX_reg(context) = LOWORD(EAX_reg(context));
 272 }
 273
 274
 275 /**********************************************************************
 276  *              FT_Prolog                       (KERNEL32.233)
 277  *
 278  * The set of FT_... thunk routines is used instead of QT_Thunk,
 279  * if structures have to be converted from 32-bit to 16-bit
 280  * (change of member alignment, conversion of members).
 281  *
 282  * The thunk function (as created by the thunk compiler) calls
 283  * FT_Prolog at the beginning, to set up a stack frame and
 284  * allocate a 64 byte buffer on the stack.
 285  * The input parameters (target address and some flags) are
 286  * saved for later use by FT_Thunk.
 287  *
 288  * Input:  EDX  16-bit target address (SEGPTR)
 289  *         CX   bits  0..7   target number (in target table)
 290  *              bits  8..9   some flags (unclear???)
 291  *              bits 10..15  number of DWORD arguments
 292  *
 293  * Output: A new stackframe is created, and a 64 byte buffer
 294  *         allocated on the stack. The layout of the stack
 295  *         on return is as follows:
 296  *
 297  *  (ebp+4)  return address to caller of thunk function
 298  *  (ebp)    old EBP
 299  *  (ebp-4)  saved EBX register of caller
 300  *  (ebp-8)  saved ESI register of caller
 301  *  (ebp-12) saved EDI register of caller
 302  *  (ebp-16) saved ECX register, containing flags
 303  *  (ebp-20) bitmap containing parameters that are to be converted
 304  *           by FT_Thunk; it is initialized to 0 by FT_Prolog and
 305  *           filled in by the thunk code before calling FT_Thunk
 306  *  (ebp-24)
 307  *    ...    (unclear)
 308  *  (ebp-44)
 309  *  (ebp-48) saved EAX register of caller (unclear, never restored???)
 310  *  (ebp-52) saved EDX register, containing 16-bit thunk target
 311  *  (ebp-56)
 312  *    ...    (unclear)
 313  *  (ebp-64)
 314  *
 315  *  ESP is EBP-68 on return.
 316  *
 317  */
 318
 319 REGS_ENTRYPOINT(FT_Prolog)
 320 {
 321     /* Pop return address to thunk code */
 322     EIP_reg(context) = STACK32_POP(context);
 323
 324     /* Build stack frame */
 325     STACK32_PUSH(context, EBP_reg(context));
 326     EBP_reg(context) = ESP_reg(context);
 327
 328     /* Allocate 64-byte Thunk Buffer */
 329     ESP_reg(context) -= 64;
 330     memset((char *)ESP_reg(context), '\0', 64);
 331
 332     /* Store Flags (ECX) and Target Address (EDX) */
 333     /* Save other registers to be restored later */
 334     *(DWORD *)(EBP_reg(context) -  4) = EBX_reg(context);
 335     *(DWORD *)(EBP_reg(context) -  8) = ESI_reg(context);
 336     *(DWORD *)(EBP_reg(context) - 12) = EDI_reg(context);
 337     *(DWORD *)(EBP_reg(context) - 16) = ECX_reg(context);
 338
 339     *(DWORD *)(EBP_reg(context) - 48) = EAX_reg(context);
 340     *(DWORD *)(EBP_reg(context) - 52) = EDX_reg(context);
 341
 342     /* Push return address back onto stack */
 343     STACK32_PUSH(context, EIP_reg(context));
 344 }
 345
 346 /**********************************************************************
 347  *              FT_Thunk                        (KERNEL32.234)
 348  *
 349  * This routine performs the actual call to 16-bit code,
 350  * similar to QT_Thunk. The differences are:
 351  *  - The call target is taken from the buffer created by FT_Prolog
 352  *  - Those arguments requested by the thunk code (by setting the
 353  *    corresponding bit in the bitmap at EBP-20) are converted
 354  *    from 32-bit pointers to segmented pointers (those pointers
 355  *    are guaranteed to point to structures copied to the stack
 356  *    by the thunk code, so we always use the 16-bit stack selector
 357  *    for those addresses).
 358  *
 359  *    The bit #i of EBP-20 corresponds here to the DWORD starting at
 360  *    ESP+4 + 2*i.
 361  *
 362  * FIXME: It is unclear what happens if there are more than 32 WORDs
 363  *        of arguments, so that the single DWORD bitmap is no longer
 364  *        sufficient ...
 365  */
 366
 367 REGS_ENTRYPOINT(FT_Thunk)
 368 {
 369     DWORD mapESPrelative = *(DWORD *)(EBP_reg(context) - 20);
 370     DWORD callTarget     = *(DWORD *)(EBP_reg(context) - 52);
 371
 372     CONTEXT context16;
 373     DWORD i, argsize;
 374     LPBYTE newstack, oldstack;
 375     THDB *thdb = THREAD_Current();
 376
 377     memcpy(&context16,context,sizeof(context16));
 378
 379     CS_reg(&context16)  = HIWORD(callTarget);
 380     IP_reg(&context16)  = LOWORD(callTarget);
 381     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 382                            + (WORD)&((STACK16FRAME*)0)->bp;
 383
 384     argsize  = EBP_reg(context)-ESP_reg(context)-0x44;
 385     newstack = ((LPBYTE)THREAD_STACK16(thdb))-argsize;
 386     oldstack = (LPBYTE)ESP_reg(context)+4;
 387
 388     memcpy( newstack, oldstack, argsize );
 389
 390     for (i = 0; i < 32; i++)    /* NOTE: What about > 32 arguments? */
 391         if (mapESPrelative & (1 << i))
 392         {
 393             SEGPTR *arg = (SEGPTR *)(newstack + 2*i);
 394             *arg = PTR_SEG_OFF_TO_SEGPTR(SELECTOROF(thdb->cur_stack),
 395                                          OFFSETOF(thdb->cur_stack) - argsize
 396                                          + (*(LPBYTE *)arg - oldstack));
 397         }
 398
 399     EAX_reg(context) = Callbacks->CallRegisterShortProc( &context16, argsize );
 400     EDX_reg(context) = HIWORD(EAX_reg(context));
 401     EAX_reg(context) = LOWORD(EAX_reg(context));
 402 }
 403
 404 /**********************************************************************
 405  *              FT_ExitNN               (KERNEL32.218 - 232)
 406  *
 407  * One of the FT_ExitNN functions is called at the end of the thunk code.
 408  * It removes the stack frame created by FT_Prolog, moves the function
 409  * return from EBX to EAX (yes, FT_Thunk did use EAX for the return
 410  * value, but the thunk code has moved it from EAX to EBX in the
 411  * meantime ... :-), restores the caller's EBX, ESI, and EDI registers,
 412  * and perform a return to the CALLER of the thunk code (while removing
 413  * the given number of arguments from the caller's stack).
 414  */
 415
 416 static void FT_Exit(CONTEXT *context, int nPopArgs)
 417 {
 418     /* Return value is in EBX */
 419     EAX_reg(context) = EBX_reg(context);
 420
 421     /* Restore EBX, ESI, and EDI registers */
 422     EBX_reg(context) = *(DWORD *)(EBP_reg(context) -  4);
 423     ESI_reg(context) = *(DWORD *)(EBP_reg(context) -  8);
 424     EDI_reg(context) = *(DWORD *)(EBP_reg(context) - 12);
 425
 426     /* Clean up stack frame */
 427     ESP_reg(context) = EBP_reg(context);
 428     EBP_reg(context) = STACK32_POP(context);
 429
 430     /* Pop return address to CALLER of thunk code */
 431     EIP_reg(context) = STACK32_POP(context);
 432     /* Remove arguments */
 433     ESP_reg(context) += nPopArgs;
 434     /* Push return address back onto stack */
 435     STACK32_PUSH(context, EIP_reg(context));
 436 }
 437
 438 REGS_ENTRYPOINT(FT_Exit0)  { FT_Exit(context,  0); }
 439 REGS_ENTRYPOINT(FT_Exit4)  { FT_Exit(context,  4); }
 440 REGS_ENTRYPOINT(FT_Exit8)  { FT_Exit(context,  8); }
 441 REGS_ENTRYPOINT(FT_Exit12) { FT_Exit(context, 12); }
 442 REGS_ENTRYPOINT(FT_Exit16) { FT_Exit(context, 16); }
 443 REGS_ENTRYPOINT(FT_Exit20) { FT_Exit(context, 20); }
 444 REGS_ENTRYPOINT(FT_Exit24) { FT_Exit(context, 24); }
 445 REGS_ENTRYPOINT(FT_Exit28) { FT_Exit(context, 28); }
 446 REGS_ENTRYPOINT(FT_Exit32) { FT_Exit(context, 32); }
 447 REGS_ENTRYPOINT(FT_Exit36) { FT_Exit(context, 36); }
 448 REGS_ENTRYPOINT(FT_Exit40) { FT_Exit(context, 40); }
 449 REGS_ENTRYPOINT(FT_Exit44) { FT_Exit(context, 44); }
 450 REGS_ENTRYPOINT(FT_Exit48) { FT_Exit(context, 48); }
 451 REGS_ENTRYPOINT(FT_Exit52) { FT_Exit(context, 52); }
 452 REGS_ENTRYPOINT(FT_Exit56) { FT_Exit(context, 56); }
 453
 454
 455 /**********************************************************************
 456  *           WOWCallback16 (KERNEL32.62)(WOW32.2)
 457  * Calls a win16 function with a single DWORD argument.
 458  * RETURNS
 459  *      the return value
 460  */
 461 DWORD WINAPI WOWCallback16(
 462         FARPROC16 fproc,        /* [in] win16 function to call */
 463         DWORD arg               /* [in] single DWORD argument to function */
 464 ) {
 465         DWORD   ret;
 466         TRACE(thunk,"(%p,0x%08lx)...\n",fproc,arg);
 467         ret =  Callbacks->CallWOWCallbackProc(fproc,arg);
 468         TRACE(thunk,"... returns %ld\n",ret);
 469         return ret;
 470 }
 471
 472 /**********************************************************************
 473  *           WOWCallback16Ex (KERNEL32.55)(WOW32.3)
 474  * Calls a function in 16bit code.
 475  * RETURNS
 476  *      TRUE for success
 477  */
 478 BOOL WINAPI WOWCallback16Ex(
 479         FARPROC16 vpfn16,       /* [in] win16 function to call */
 480         DWORD dwFlags,          /* [in] flags */
 481         DWORD cbArgs,           /* [in] nr of arguments */
 482         LPVOID pArgs,           /* [in] pointer to arguments (LPDWORD) */
 483         LPDWORD pdwRetCode      /* [out] return value of win16 function */
 484 ) {
 485         return Callbacks->CallWOWCallback16Ex(vpfn16,dwFlags,cbArgs,pArgs,pdwRetCode);
 486 }
 487
 488 /***********************************************************************
 489  *              ThunkInitLS     (KERNEL32.43)
 490  * A thunkbuffer link routine
 491  * The thunkbuf looks like:
 492  *
 493  *      00: DWORD       length          ? don't know exactly
 494  *      04: SEGPTR      ptr             ? where does it point to?
 495  * The pointer ptr is written into the first DWORD of 'thunk'.
 496  * (probably correct implemented)
 497  * [ok probably]
 498  * RETURNS
 499  *      segmented pointer to thunk?
 500  */
 501 DWORD WINAPI ThunkInitLS(
 502         LPDWORD thunk,  /* [in] win32 thunk */
 503         LPCSTR thkbuf,  /* [in] thkbuffer name in win16 dll */
 504         DWORD len,      /* [in] thkbuffer length */
 505         LPCSTR dll16,   /* [in] name of win16 dll */
 506         LPCSTR dll32    /* [in] name of win32 dll (FIXME: not used?) */
 507 ) {
 508         LPDWORD         addr;
 509
 510         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 511                 return 0;
 512
 513         if (!addr[1])
 514                 return 0;
 515         *(DWORD*)thunk = addr[1];
 516
 517         return addr[1];
 518 }
 519
 520 /***********************************************************************
 521  *              Common32ThkLS   (KERNEL32.45)
 522  *
 523  * This is another 32->16 thunk, independent of the QT_Thunk/FT_Thunk
 524  * style thunks. The basic difference is that the parameter conversion
 525  * is done completely on the *16-bit* side here. Thus we do not call
 526  * the 16-bit target directly, but call a common entry point instead.
 527  * This entry function then calls the target according to the target
 528  * number passed in the DI register.
 529  *
 530  * Input:  EAX    SEGPTR to the common 16-bit entry point
 531  *         CX     offset in thunk table (target number * 4)
 532  *         DX     error return value if execution fails (unclear???)
 533  *         EDX.HI number of DWORD parameters
 534  *
 535  * (Note that we need to move the thunk table offset from CX to DI !)
 536  *
 537  * The called 16-bit stub expects its stack to look like this:
 538  *     ...
 539  *   (esp+40)  32-bit arguments
 540  *     ...
 541  *   (esp+8)   32 byte of stack space available as buffer
 542  *   (esp)     8 byte return address for use with 0x66 lret
 543  *
 544  * The called 16-bit stub uses a 0x66 lret to return to 32-bit code,
 545  * and uses the EAX register to return a DWORD return value.
 546  * Thus we need to use a special assembly glue routine
 547  * (CallRegisterLongProc instead of CallRegisterShortProc).
 548  *
 549  * Finally, we return to the caller, popping the arguments off
 550  * the stack.
 551  *
 552  * FIXME: The called function uses EBX to return the number of
 553  *        arguments that are to be popped off the caller's stack.
 554  *        This is clobbered by the assembly glue, so we simply use
 555  *        the original EDX.HI to get the number of arguments.
 556  *        (Those two values should be equal anyway ...?)
 557  *
 558  */
 559 REGS_ENTRYPOINT(Common32ThkLS)
 560 {
 561     CONTEXT context16;
 562     DWORD argsize;
 563     THDB *thdb = THREAD_Current();
 564
 565     memcpy(&context16,context,sizeof(context16));
 566
 567     DI_reg(&context16)  = CX_reg(context);
 568     CS_reg(&context16)  = HIWORD(EAX_reg(context));
 569     IP_reg(&context16)  = LOWORD(EAX_reg(context));
 570     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 571                            + (WORD)&((STACK16FRAME*)0)->bp;
 572
 573     argsize = HIWORD(EDX_reg(context)) * 4;
 574
 575     /* FIXME: hack for stupid USER32 CallbackGlueLS routine */
 576     if (EDX_reg(context) == EIP_reg(context))
 577         argsize = 6 * 4;
 578
 579     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 580             (LPBYTE)ESP_reg(context)+4, argsize );
 581
 582     EAX_reg(context) = Callbacks->CallRegisterLongProc(&context16, argsize + 32);
 583
 584     /* Clean up caller's stack frame */
 585
 586     EIP_reg(context) = STACK32_POP(context);
 587     ESP_reg(context) += argsize;
 588     STACK32_PUSH(context, EIP_reg(context));
 589 }
 590
 591 /***********************************************************************
 592  *              OT_32ThkLSF     (KERNEL32.40)
 593  *
 594  * YET Another 32->16 thunk. The difference to Common32ThkLS is that
 595  * argument processing is done on both the 32-bit and the 16-bit side:
 596  * The 32-bit side prepares arguments, copying them onto the stack.
 597  *
 598  * When this routine is called, the first word on the stack is the
 599  * number of argument bytes prepared by the 32-bit code, and EDX
 600  * contains the 16-bit target address.
 601  *
 602  * The called 16-bit routine is another relaycode, doing further
 603  * argument processing and then calling the real 16-bit target
 604  * whose address is stored at [bp-04].
 605  *
 606  * The call proceeds using a normal CallRegisterShortProc.
 607  * After return from the 16-bit relaycode, the arguments need
 608  * to be copied *back* to the 32-bit stack, since the 32-bit
 609  * relaycode processes output parameters.
 610  *
 611  * Note that we copy twice the number of arguments, since some of the
 612  * 16-bit relaycodes in SYSTHUNK.DLL directly access the original
 613  * arguments of the caller!
 614  *
 615  * (Note that this function seems only to be used for
 616  *  OLECLI32 -> OLECLI and OLESVR32 -> OLESVR thunking.)
 617  */
 618 REGS_ENTRYPOINT(OT_32ThkLSF)
 619 {
 620     CONTEXT context16;
 621     DWORD argsize;
 622     THDB *thdb = THREAD_Current();
 623
 624     memcpy(&context16,context,sizeof(context16));
 625
 626     CS_reg(&context16)  = HIWORD(EDX_reg(context));
 627     IP_reg(&context16)  = LOWORD(EDX_reg(context));
 628     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 629                            + (WORD)&((STACK16FRAME*)0)->bp;
 630
 631     argsize = 2 * *(WORD *)(ESP_reg(context) + 4) + 2;
 632
 633     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 634             (LPBYTE)ESP_reg(context)+4, argsize );
 635
 636     EAX_reg(context) = Callbacks->CallRegisterShortProc(&context16, argsize);
 637
 638     memcpy( (LPBYTE)ESP_reg(context)+4,
 639             ((LPBYTE)THREAD_STACK16(thdb))-argsize, argsize );
 640 }
 641
 642 /***********************************************************************
 643  *              ThunkInitLSF            (KERNEL32.41)
 644  * A thunk setup routine.
 645  * Expects a pointer to a preinitialized thunkbuffer in the first argument
 646  * looking like:
 647  *      00..03:         unknown (pointer, check _41, _43, _46)
 648  *      04: EB1E                jmp +0x20
 649  *
 650  *      06..23:         unknown (space for replacement code, check .90)
 651  *
 652  *      24:>E800000000          call offset 29
 653  *      29:>58                  pop eax            ( target of call )
 654  *      2A: 2D25000000          sub eax,0x00000025 ( now points to offset 4 )
 655  *      2F: BAxxxxxxxx          mov edx,xxxxxxxx
 656  *      34: 68yyyyyyyy          push KERNEL32.90
 657  *      39: C3                  ret
 658  *
 659  *      3A: EB1E                jmp +0x20
 660  *      3E ... 59:      unknown (space for replacement code?)
 661  *      5A: E8xxxxxxxx          call <32bitoffset xxxxxxxx>
 662  *      5F: 5A                  pop edx
 663  *      60: 81EA25xxxxxx        sub edx, 0x25xxxxxx
 664  *      66: 52                  push edx
 665  *      67: 68xxxxxxxx          push xxxxxxxx
 666  *      6C: 68yyyyyyyy          push KERNEL32.89
 667  *      71: C3                  ret
 668  *      72: end?
 669  * This function checks if the code is there, and replaces the yyyyyyyy entries
 670  * by the functionpointers.
 671  * The thunkbuf looks like:
 672  *
 673  *      00: DWORD       length          ? don't know exactly
 674  *      04: SEGPTR      ptr             ? where does it point to?
 675  * The segpointer ptr is written into the first DWORD of 'thunk'.
 676  * [ok probably]
 677  * RETURNS
 678  *      unclear, pointer to win16 thkbuffer?
 679  */
 680 LPVOID WINAPI ThunkInitLSF(
 681         LPBYTE thunk,   /* [in] win32 thunk */
 682         LPCSTR thkbuf,  /* [in] thkbuffer name in win16 dll */
 683         DWORD len,      /* [in] length of thkbuffer */
 684         LPCSTR dll16,   /* [in] name of win16 dll */
 685         LPCSTR dll32    /* [in] name of win32 dll */
 686 ) {
 687         HMODULE hkrnl32 = GetModuleHandleA("KERNEL32");
 688         LPDWORD         addr,addr2;
 689
 690         /* FIXME: add checks for valid code ... */
 691         /* write pointers to kernel32.89 and kernel32.90 (+ordinal base of 1) */
 692         *(DWORD*)(thunk+0x35) = (DWORD)GetProcAddress(hkrnl32,(LPSTR)90);
 693         *(DWORD*)(thunk+0x6D) = (DWORD)GetProcAddress(hkrnl32,(LPSTR)89);
 694
 695
 696         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 697                 return 0;
 698
 699         addr2 = PTR_SEG_TO_LIN(addr[1]);
 700         if (HIWORD(addr2))
 701                 *(DWORD*)thunk = (DWORD)addr2;
 702
 703         return addr2;
 704 }
 705
 706 /***********************************************************************
 707  *              FT_PrologPrime                  (KERNEL32.89)
 708  *
 709  * This function is called from the relay code installed by
 710  * ThunkInitLSF. It replaces the location from where it was
 711  * called by a standard FT_Prolog call stub (which is 'primed'
 712  * by inserting the correct target table pointer).
 713  * Finally, it calls that stub.
 714  *
 715  * Input:  ECX    target number + flags (passed through to FT_Prolog)
 716  *        (ESP)   offset of location where target table pointer
 717  *                is stored, relative to the start of the relay code
 718  *        (ESP+4) pointer to start of relay code
 719  *                (this is where the FT_Prolog call stub gets written to)
 720  *
 721  * Note: The two DWORD arguments get popped from the stack.
 722  *
 723  */
 724 REGS_ENTRYPOINT(FT_PrologPrime)
 725 {
 726     DWORD  targetTableOffset = STACK32_POP(context);
 727     LPBYTE relayCode = (LPBYTE)STACK32_POP(context);
 728     DWORD *targetTable = *(DWORD **)(relayCode+targetTableOffset);
 729     DWORD  targetNr = LOBYTE(ECX_reg(context));
 730
 731     _write_ftprolog(relayCode, targetTable);
 732
 733     /* We should actually call the relay code now, */
 734     /* but we skip it and go directly to FT_Prolog */
 735     EDX_reg(context) = targetTable[targetNr];
 736     __regs_FT_Prolog(context);
 737 }
 738
 739 /***********************************************************************
 740  *              QT_ThunkPrime                   (KERNEL32.90)
 741  *
 742  * This function corresponds to FT_PrologPrime, but installs a
 743  * call stub for QT_Thunk instead.
 744  *
 745  * Input: (EBP-4) target number (passed through to QT_Thunk)
 746  *         EDX    target table pointer location offset
 747  *         EAX    start of relay code
 748  *
 749  */
 750 REGS_ENTRYPOINT(QT_ThunkPrime)
 751 {
 752     DWORD  targetTableOffset = EDX_reg(context);
 753     LPBYTE relayCode = (LPBYTE)EAX_reg(context);
 754     DWORD *targetTable = *(DWORD **)(relayCode+targetTableOffset);
 755     DWORD  targetNr = LOBYTE(*(DWORD *)(EBP_reg(context) - 4));
 756
 757     _write_qtthunk(relayCode, targetTable);
 758
 759     /* We should actually call the relay code now, */
 760     /* but we skip it and go directly to QT_Thunk */
 761     EDX_reg(context) = targetTable[targetNr];
 762     __regs_QT_Thunk(context);
 763 }
 764
 765 /***********************************************************************
 766  *                                                      (KERNEL32.46)
 767  * Another thunkbuf link routine.
 768  * The start of the thunkbuf looks like this:
 769  *      00: DWORD       length
 770  *      04: SEGPTR      address for thunkbuffer pointer
 771  * [ok probably]
 772  */
 773 VOID WINAPI ThunkInitSL(
 774         LPBYTE thunk,           /* [in] start of thunkbuffer */
 775         LPCSTR thkbuf,          /* [in] name/ordinal of thunkbuffer in win16 dll */
 776         DWORD len,              /* [in] length of thunkbuffer */
 777         LPCSTR dll16,           /* [in] name of win16 dll containing the thkbuf */
 778         LPCSTR dll32            /* [in] win32 dll. FIXME: strange, unused */
 779 ) {
 780         LPDWORD         addr;
 781
 782         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 783                 return;
 784
 785         *(DWORD*)PTR_SEG_TO_LIN(addr[1]) = (DWORD)thunk;
 786 }
 787
 788 /**********************************************************************
 789  *           SSInit             KERNEL.700
 790  * RETURNS
 791  *      TRUE for success.
 792  */
 793 BOOL WINAPI SSInit16()
 794 {
 795     return TRUE;
 796 }
 797
 798 /**********************************************************************
 799  *           SSOnBigStack       KERNEL32.87
 800  * Check if thunking is initialized (ss selector set up etc.)
 801  * We do that differently, so just return TRUE.
 802  * [ok]
 803  * RETURNS
 804  *      TRUE for success.
 805  */
 806 BOOL WINAPI SSOnBigStack()
 807 {
 808     TRACE(thunk, "Yes, thunking is initialized\n");
 809     return TRUE;
 810 }
 811
 812 /**********************************************************************
 813  *           SSCall
 814  * One of the real thunking functions. This one seems to be for 32<->32
 815  * thunks. It should probably be capable of crossing processboundaries.
 816  *
 817  * And YES, I've seen nr=48 (somewhere in the Win95 32<->16 OLE coupling)
 818  * [ok]
 819  */
 820 DWORD WINAPIV SSCall(
 821         DWORD nr,       /* [in] number of argument bytes */
 822         DWORD flags,    /* [in] FIXME: flags ? */
 823         FARPROC fun,    /* [in] function to call */
 824         ...             /* [in/out] arguments */
 825 ) {
 826     DWORD i,ret;
 827     DWORD *args = ((DWORD *)&fun) + 1;
 828
 829     if(TRACE_ON(thunk)){
 830       dbg_decl_str(thunk, 256);
 831       for (i=0;i<nr/4;i++)
 832         dsprintf(thunk,"0x%08lx,",args[i]);
 833       TRACE(thunk,"(%ld,0x%08lx,%p,[%s])\n",
 834                     nr,flags,fun,dbg_str(thunk));
 835     }
 836     switch (nr) {
 837     case 0:     ret = fun();
 838                 break;
 839     case 4:     ret = fun(args[0]);
 840                 break;
 841     case 8:     ret = fun(args[0],args[1]);
 842                 break;
 843     case 12:    ret = fun(args[0],args[1],args[2]);
 844                 break;
 845     case 16:    ret = fun(args[0],args[1],args[2],args[3]);
 846                 break;
 847     case 20:    ret = fun(args[0],args[1],args[2],args[3],args[4]);
 848                 break;
 849     case 24:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5]);
 850                 break;
 851     case 28:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6]);
 852                 break;
 853     case 32:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7]);
 854                 break;
 855     case 36:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8]);
 856                 break;
 857     case 40:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9]);
 858                 break;
 859     case 44:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9],args[10]);
 860                 break;
 861     case 48:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9],args[10],args[11]);
 862                 break;
 863     default:
 864         WARN(thunk,"Unsupported nr of arguments, %ld\n",nr);
 865         ret = 0;
 866         break;
 867
 868     }
 869     TRACE(thunk," returning %ld ...\n",ret);
 870     return ret;
 871 }
 872
 873 /**********************************************************************
 874  *           W32S_BackTo32                      (KERNEL32.51)
 875  */
 876 REGS_ENTRYPOINT(W32S_BackTo32)
 877 {
 878     LPDWORD stack = (LPDWORD)ESP_reg( context );
 879     FARPROC proc = (FARPROC) stack[0];
 880
 881     EAX_reg( context ) = proc( stack[2], stack[3], stack[4], stack[5], stack[6],
 882                                stack[7], stack[8], stack[9], stack[10], stack[11] );
 883
 884     EIP_reg( context ) = stack[1];
 885 }
 886
 887 /**********************************************************************
 888  *                      AllocSLCallback         (KERNEL32)
 889  *
 890  * Win95 uses some structchains for callbacks. It allocates them
 891  * in blocks of 100 entries, size 32 bytes each, layout:
 892  * blockstart:
 893  *      0:      PTR     nextblockstart
 894  *      4:      entry   *first;
 895  *      8:      WORD    sel ( start points to blockstart)
 896  *      A:      WORD    unknown
 897  * 100xentry:
 898  *      00..17:         Code
 899  *      18:     PDB     *owning_process;
 900  *      1C:     PTR     blockstart
 901  *
 902  * We ignore this for now. (Just a note for further developers)
 903  * FIXME: use this method, so we don't waste selectors...
 904  *
 905  * Following code is then generated by AllocSLCallback. The code is 16 bit, so
 906  * the 0x66 prefix switches from word->long registers.
 907  *
 908  *      665A            pop     edx
 909  *      6668x arg2 x    pushl   <arg2>
 910  *      6652            push    edx
 911  *      EAx arg1 x      jmpf    <arg1>
 912  *
 913  * returns the startaddress of this thunk.
 914  *
 915  * Note, that they look very similair to the ones allocates by THUNK_Alloc.
 916  * RETURNS
 917  *      segmented pointer to the start of the thunk
 918  */
 919 DWORD WINAPI
 920 AllocSLCallback(
 921         DWORD finalizer,        /* [in] finalizer function */
 922         DWORD callback          /* [in] callback function */
 923 ) {
 924         LPBYTE  x,thunk = HeapAlloc( GetProcessHeap(), 0, 32 );
 925         WORD    sel;
 926
 927         x=thunk;
 928         *x++=0x66;*x++=0x5a;                            /* popl edx */
 929         *x++=0x66;*x++=0x68;*(DWORD*)x=finalizer;x+=4;  /* pushl finalizer */
 930         *x++=0x66;*x++=0x52;                            /* pushl edx */
 931         *x++=0xea;*(DWORD*)x=callback;x+=4;             /* jmpf callback */
 932
 933         *(PDB**)(thunk+18) = PROCESS_Current();
 934
 935         sel = SELECTOR_AllocBlock( thunk , 32, SEGMENT_CODE, FALSE, FALSE );
 936         return (sel<<16)|0;
 937 }
 938
 939 /**********************************************************************
 940  *              FreeSLCallback          (KERNEL32.274)
 941  * Frees the specified 16->32 callback
 942  */
 943 void WINAPI
 944 FreeSLCallback(
 945         DWORD x /* [in] 16 bit callback (segmented pointer?) */
 946 ) {
 947         FIXME(win32,"(0x%08lx): stub\n",x);
 948 }
 949
 950
 951 /**********************************************************************
 952  *              GetTEBSelectorFS        (KERNEL.475)
 953  *      Set the 16-bit %fs to the 32-bit %fs (current TEB selector)
 954  */
 955 VOID WINAPI GetTEBSelectorFS16( CONTEXT *context )
 956 {
 957     GET_FS( FS_reg(context) );
 958 }
 959
 960 /**********************************************************************
 961  *              KERNEL_431              (KERNEL.431)
 962  *              IsPeFormat              (W32SYS.2)
 963  * Checks the passed filename if it is a PE format executeable
 964  * RETURNS
 965  *  TRUE, if it is.
 966  *  FALSE if not.
 967  */
 968 BOOL16 WINAPI IsPeFormat16(
 969         LPSTR   fn,     /* [in] filename to executeable */
 970         HFILE16 hf16    /* [in] open file, if filename is NULL */
 971 ) {
 972         IMAGE_DOS_HEADER        mzh;
 973         HFILE                 hf=FILE_GetHandle(hf16);
 974         OFSTRUCT                ofs;
 975         DWORD                   xmagic;
 976
 977         if (fn) {
 978                 hf = OpenFile(fn,&ofs,OF_READ);
 979                 if (hf==HFILE_ERROR)
 980                         return FALSE;
 981         }
 982         _llseek(hf,0,SEEK_SET);
 983         if (sizeof(mzh)!=_lread(hf,&mzh,sizeof(mzh))) {
 984                 _lclose(hf);
 985                 return FALSE;
 986         }
 987         if (mzh.e_magic!=IMAGE_DOS_SIGNATURE) {
 988                 WARN(dosmem,"File has not got dos signature!\n");
 989                 _lclose(hf);
 990                 return FALSE;
 991         }
 992         _llseek(hf,mzh.e_lfanew,SEEK_SET);
 993         if (sizeof(DWORD)!=_lread(hf,&xmagic,sizeof(DWORD))) {
 994                 _lclose(hf);
 995                 return FALSE;
 996         }
 997         _lclose(hf);
 998         return (xmagic == IMAGE_NT_SIGNATURE);
 999 }
1000
1001 /***********************************************************************
1002  *           WOWHandle32                        (KERNEL32.57)(WOW32.16)
1003  * Converts a win16 handle of type into the respective win32 handle.
1004  * We currently just return this handle, since most handles are the same
1005  * for win16 and win32.
1006  * RETURNS
1007  *      The new handle
1008  */
1009 HANDLE WINAPI WOWHandle32(
1010         WORD handle,            /* [in] win16 handle */
1011         WOW_HANDLE_TYPE type    /* [in] handle type */
1012 ) {
1013         TRACE(win32,"(0x%04x,%d)\n",handle,type);
1014         return (HANDLE)handle;
1015 }
1016
1017 /***********************************************************************
1018  *           K32Thk1632Prolog                   (KERNEL32.492)
1019  */
1020 REGS_ENTRYPOINT(K32Thk1632Prolog)
1021 {
1022    LPBYTE code = (LPBYTE)EIP_reg(context) - 5;
1023
1024    /* Arrrgh! SYSTHUNK.DLL just has to re-implement another method
1025       of 16->32 thunks instead of using one of the standard methods!
1026       This means that SYSTHUNK.DLL itself switches to a 32-bit stack,
1027       and does a far call to the 32-bit code segment of OLECLI32/OLESVR32.
1028       Unfortunately, our CallTo/CallFrom mechanism is therefore completely
1029       bypassed, which means it will crash the next time the 32-bit OLE
1030       code thunks down again to 16-bit (this *will* happen!).
1031
1032       The following hack tries to recognize this situation.
1033       This is possible since the called stubs in OLECLI32/OLESVR32 all
1034       look exactly the same:
1035         00   E8xxxxxxxx    call K32Thk1632Prolog
1036         05   FF55FC        call [ebp-04]
1037         08   E8xxxxxxxx    call K32Thk1632Epilog
1038         0D   66CB          retf
1039
1040       If we recognize this situation, we try to simulate the actions
1041       of our CallTo/CallFrom mechanism by copying the 16-bit stack
1042       to our 32-bit stack, creating a proper STACK16FRAME and
1043       updating thdb->cur_stack. */
1044
1045    if (   code[5] == 0xFF && code[6] == 0x55 && code[7] == 0xFC
1046        && code[13] == 0x66 && code[14] == 0xCB)
1047    {
1048       WORD  stackSel  = NtCurrentTeb()->stack_sel;
1049       DWORD stackBase = GetSelectorBase(stackSel);
1050
1051       THDB *thdb = THREAD_Current();
1052       DWORD argSize = EBP_reg(context) - ESP_reg(context);
1053       char *stack16 = (char *)ESP_reg(context);
1054       char *stack32 = (char *)thdb->cur_stack - argSize;
1055       STACK16FRAME *frame16 = (STACK16FRAME *)stack16 - 1;
1056
1057       TRACE(thunk, "before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1058                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1059
1060       memset(frame16, '\0', sizeof(STACK16FRAME));
1061       frame16->frame32 = (STACK32FRAME *)thdb->cur_stack;
1062       frame16->ebp = EBP_reg(context);
1063
1064       memcpy(stack32, stack16, argSize);
1065       thdb->cur_stack = PTR_SEG_OFF_TO_SEGPTR(stackSel, (DWORD)frame16 - stackBase);
1066
1067       ESP_reg(context) = (DWORD)stack32;
1068       EBP_reg(context) = ESP_reg(context) + argSize;
1069
1070       TRACE(thunk, "after  SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1071                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1072    }
1073
1074    SYSLEVEL_ReleaseWin16Lock();
1075 }
1076
1077 /***********************************************************************
1078  *           K32Thk1632Epilog                   (KERNEL32.491)
1079  */
1080 REGS_ENTRYPOINT(K32Thk1632Epilog)
1081 {
1082    LPBYTE code = (LPBYTE)EIP_reg(context) - 13;
1083
1084    SYSLEVEL_RestoreWin16Lock();
1085
1086    /* We undo the SYSTHUNK hack if necessary. See K32Thk1632Prolog. */
1087
1088    if (   code[5] == 0xFF && code[6] == 0x55 && code[7] == 0xFC
1089        && code[13] == 0x66 && code[14] == 0xCB)
1090    {
1091       THDB *thdb = THREAD_Current();
1092       STACK16FRAME *frame16 = (STACK16FRAME *)PTR_SEG_TO_LIN(thdb->cur_stack);
1093       char *stack16 = (char *)(frame16 + 1);
1094       DWORD argSize = frame16->ebp - (DWORD)stack16;
1095       char *stack32 = (char *)frame16->frame32 - argSize;
1096
1097       DWORD nArgsPopped = ESP_reg(context) - (DWORD)stack32;
1098
1099       TRACE(thunk, "before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1100                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1101
1102       thdb->cur_stack = (DWORD)frame16->frame32;
1103
1104       ESP_reg(context) = (DWORD)stack16 + nArgsPopped;
1105       EBP_reg(context) = frame16->ebp;
1106
1107       TRACE(thunk, "after  SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1108                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1109    }
1110 }
1111
1112 /***********************************************************************
1113  *           UpdateResource32A                 (KERNEL32.707)
1114  */
1115 BOOL WINAPI UpdateResourceA(
1116   HANDLE  hUpdate,
1117   LPCSTR  lpType,
1118   LPCSTR  lpName,
1119   WORD    wLanguage,
1120   LPVOID  lpData,
1121   DWORD   cbData) {
1122
1123   FIXME(win32, ": stub\n");
1124   SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
1125   return FALSE;
1126 }
1127
1128 /***********************************************************************
1129  *           UpdateResource32W                 (KERNEL32.708)
1130  */
1131 BOOL WINAPI UpdateResourceW(
1132   HANDLE  hUpdate,
1133   LPCWSTR lpType,
1134   LPCWSTR lpName,
1135   WORD    wLanguage,
1136   LPVOID  lpData,
1137   DWORD   cbData) {
1138
1139   FIXME(win32, ": stub\n");
1140   SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
1141   return FALSE;
1142 }
1143
1144
1145 /***********************************************************************
1146  *           WaitNamedPipe32A                 [KERNEL32.725]
1147  */
1148 BOOL WINAPI WaitNamedPipeA (LPCSTR lpNamedPipeName, DWORD nTimeOut)
1149 {       FIXME (win32,"%s 0x%08lx\n",lpNamedPipeName,nTimeOut);
1150         SetLastError(ERROR_PIPE_NOT_CONNECTED);
1151         return FALSE;
1152 }
1153 /***********************************************************************
1154  *           WaitNamedPipe32W                 [KERNEL32.726]
1155  */
1156 BOOL WINAPI WaitNamedPipeW (LPCWSTR lpNamedPipeName, DWORD nTimeOut)
1157 {       FIXME (win32,"%s 0x%08lx\n",debugstr_w(lpNamedPipeName),nTimeOut);
1158         SetLastError(ERROR_PIPE_NOT_CONNECTED);
1159         return FALSE;
1160 }
1161
1162 /*********************************************************************
1163  *                   PK16FNF [KERNEL32.91]
1164  *
1165  *  This routine fills in the supplied 13-byte (8.3 plus terminator)
1166  *  string buffer with the 8.3 filename of a recently loaded 16-bit
1167  *  module.  It is unknown exactly what modules trigger this
1168  *  mechanism or what purpose this serves.  Win98 Explorer (and
1169  *  probably also Win95 with IE 4 shell integration) calls this
1170  *  several times during initialization.
1171  *
1172  *  FIXME: find out what this really does and make it work.
1173  */
1174 void WINAPI PK16FNF(LPSTR strPtr)
1175 {
1176        FIXME(win32, "(%p): stub\n", strPtr);
1177
1178        /* fill in a fake filename that'll be easy to recognize */
1179        lstrcpyA(strPtr, "WINESTUB.FIX");
1180 }