if1632/snoop.c

   1 /*
   2  * 386-specific Win16 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  */
   6
   7 #include <assert.h>
   8 #include <string.h>
   9 #include "winbase.h"
  10 #include "winnt.h"
  11 #include "heap.h"
  12 #include "global.h"
  13 #include "selectors.h"
  14 #include "stackframe.h"
  15 #include "builtin16.h"
  16 #include "snoop.h"
  17 #include "debugstr.h"
  18 #include "debugtools.h"
  19
  20 DEFAULT_DEBUG_CHANNEL(snoop)
  21
  22 #ifdef __i386__
  23
  24 #include "pshpack1.h"
  25
  26 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context);
  27 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context);
  28
  29 typedef struct tagSNOOP16_FUN {
  30         /* code part */
  31         BYTE            lcall;          /* 0x9a call absolute with segment */
  32         DWORD           snr;
  33         /* unreached */
  34         int             nrofargs;
  35         FARPROC16       origfun;
  36         char            *name;
  37 } SNOOP16_FUN;
  38
  39 typedef struct tagSNOOP16_DLL {
  40         HMODULE16       hmod;
  41         HANDLE16        funhandle;
  42         SNOOP16_FUN     *funs;
  43         LPCSTR          name;
  44         struct tagSNOOP16_DLL   *next;
  45 } SNOOP16_DLL;
  46
  47 typedef struct tagSNOOP16_RETURNENTRY {
  48         /* code part */
  49         BYTE            lcall;          /* 0x9a call absolute with segment */
  50         DWORD           snr;
  51         /* unreached */
  52         FARPROC16       origreturn;
  53         SNOOP16_DLL     *dll;
  54         DWORD           ordinal;
  55         WORD            origSP;
  56         WORD            *args;          /* saved args across a stdcall */
  57 } SNOOP16_RETURNENTRY;
  58
  59 typedef struct tagSNOOP16_RETURNENTRIES {
  60         SNOOP16_RETURNENTRY entry[65500/sizeof(SNOOP16_RETURNENTRY)];
  61         HANDLE16        rethandle;
  62         struct tagSNOOP16_RETURNENTRIES *next;
  63 } SNOOP16_RETURNENTRIES;
  64
  65 typedef struct tagSNOOP16_RELAY {
  66         WORD            pushbp;         /* 0x5566 */
  67         BYTE            pusheax;        /* 0x50 */
  68         WORD            pushax;         /* 0x5066 */
  69         BYTE            pushl;          /* 0x68 */
  70         DWORD           realfun;        /* SNOOP16_Return */
  71         BYTE            lcall;          /* 0x9a call absolute with segment */
  72         DWORD           callfromregs;
  73         WORD            seg;
  74         WORD            lret;           /* 0xcb66 */
  75 } SNOOP16_RELAY;
  76
  77 #include "poppack.h"
  78
  79 static  SNOOP16_DLL             *firstdll = NULL;
  80 static  SNOOP16_RETURNENTRIES   *firstrets = NULL;
  81 static  SNOOP16_RELAY           *snr;
  82 static  HANDLE16                xsnr = 0;
  83
  84 void
  85 SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
  86         SNOOP16_DLL     **dll = &(firstdll);
  87         char            *s;
  88
  89         if (!TRACE_ON(snoop)) return;
  90         if (!snr) {
  91                 xsnr=GLOBAL_Alloc(GMEM_ZEROINIT,2*sizeof(*snr),0,TRUE,TRUE,FALSE);
  92                 snr = GlobalLock16(xsnr);
  93                 snr[0].pushbp   = 0x5566;
  94                 snr[0].pusheax  = 0x50;
  95                 snr[0].pushax   = 0x5066;
  96                 snr[0].pushl    = 0x68;
  97                 snr[0].realfun  = (DWORD)SNOOP16_Entry;
  98                 snr[0].lcall    = 0x9a;
  99                 snr[0].callfromregs = (DWORD)CallFrom16Register;
 100                 GET_CS(snr[0].seg);
 101                 snr[0].lret     = 0xcb66;
 102
 103                 snr[1].pushbp   = 0x5566;
 104                 snr[1].pusheax  = 0x50;
 105                 snr[1].pushax   = 0x5066;
 106                 snr[1].pushl    = 0x68;
 107                 snr[1].realfun  = (DWORD)SNOOP16_Return;
 108                 snr[1].lcall    = 0x9a;
 109                 snr[1].callfromregs = (DWORD)CallFrom16Register;
 110                 GET_CS(snr[1].seg);
 111                 snr[1].lret     = 0xcb66;
 112         }
 113         while (*dll) {
 114                 if ((*dll)->hmod == pModule->self)
 115                         return; /* already registered */
 116                 dll = &((*dll)->next);
 117         }
 118         *dll = (SNOOP16_DLL*)HeapAlloc(SystemHeap,HEAP_ZERO_MEMORY,sizeof(SNOOP16_DLL));
 119         (*dll)->next    = NULL;
 120         (*dll)->hmod    = pModule->self;
 121         if ((s=strrchr(name,'\\')))
 122                 name = s+1;
 123         (*dll)->name    = HEAP_strdupA(SystemHeap,0,name);
 124         if ((s=strrchr((*dll)->name,'.')))
 125                 *s='\0';
 126         (*dll)->funhandle = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,TRUE,FALSE,FALSE));
 127         (*dll)->funs = GlobalLock16((*dll)->funhandle);
 128         if (!(*dll)->funs) {
 129                 HeapFree(SystemHeap,0,*dll);
 130                 FIXME("out of memory\n");
 131                 return;
 132         }
 133         memset((*dll)->funs,0,65535);
 134 }
 135
 136 FARPROC16
 137 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
 138         SNOOP16_DLL                     *dll = firstdll;
 139         SNOOP16_FUN                     *fun;
 140         NE_MODULE                       *pModule = NE_GetPtr(hmod);
 141         unsigned char                   *cpnt;
 142         char                            name[200];
 143
 144         if (!TRACE_ON(snoop) || !pModule || !HIWORD(origfun))
 145                 return origfun;
 146         if (!*(LPBYTE)PTR_SEG_TO_LIN(origfun)) /* 0x00 is an imposs. opcode, poss. dataref. */
 147                 return origfun;
 148         while (dll) {
 149                 if (hmod == dll->hmod)
 150                         break;
 151                 dll=dll->next;
 152         }
 153         if (!dll)       /* probably internal */
 154                 return origfun;
 155         if (ordinal>65535/sizeof(SNOOP16_FUN))
 156                 return origfun;
 157         fun = dll->funs+ordinal;
 158         /* already done? */
 159         fun->lcall      = 0x9a;
 160         fun->snr        = MAKELONG(0,xsnr);
 161         fun->origfun    = origfun;
 162         if (fun->name)
 163                 return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
 164         cpnt = (unsigned char *)pModule + pModule->name_table;
 165         while (*cpnt) {
 166                 cpnt += *cpnt + 1 + sizeof(WORD);
 167                 if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
 168                         sprintf(name,"%.*s",*cpnt,cpnt+1);
 169                         break;
 170                 }
 171         }
 172         /* Now search the non-resident names table */
 173
 174         if (!*cpnt && pModule->nrname_handle) {
 175                 cpnt = (char *)GlobalLock16( pModule->nrname_handle );
 176                 while (*cpnt) {
 177                         cpnt += *cpnt + 1 + sizeof(WORD);
 178                         if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
 179                                     sprintf(name,"%.*s",*cpnt,cpnt+1);
 180                                     break;
 181                         }
 182                 }
 183         }
 184         if (*cpnt)
 185                 fun->name = HEAP_strdupA(SystemHeap,0,name);
 186         else
 187                 fun->name = HEAP_strdupA(SystemHeap,0,"");
 188         if (!SNOOP_ShowDebugmsgSnoop(dll->name, ordinal, fun->name))
 189                 return origfun;
 190
 191         /* more magic. do not try to snoop thunk data entries (MMSYSTEM) */
 192         if (strchr(fun->name,'_')) {
 193                 char *s=strchr(fun->name,'_');
 194
 195                 if (!strncasecmp(s,"_thunkdata",10)) {
 196                         HeapFree(SystemHeap,0,fun->name);
 197                         fun->name = NULL;
 198                         return origfun;
 199                 }
 200         }
 201         fun->lcall      = 0x9a;
 202         fun->snr        = MAKELONG(0,xsnr);
 203         fun->origfun    = origfun;
 204         fun->nrofargs   = -1;
 205         return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
 206 }
 207
 208 #define CALLER1REF (*(DWORD*)(PTR_SEG_OFF_TO_LIN(SS_reg(context),LOWORD(ESP_reg(context))+4)))
 209 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
 210         DWORD           ordinal=0;
 211         DWORD           entry=(DWORD)PTR_SEG_OFF_TO_LIN(CS_reg(context),LOWORD(EIP_reg(context)))-5;
 212         WORD            xcs = CS_reg(context);
 213         SNOOP16_DLL     *dll = firstdll;
 214         SNOOP16_FUN     *fun = NULL;
 215         SNOOP16_RETURNENTRIES   **rets = &firstrets;
 216         SNOOP16_RETURNENTRY     *ret;
 217         int             i,max;
 218
 219         while (dll) {
 220                 if (xcs == dll->funhandle) {
 221                         fun = (SNOOP16_FUN*)entry;
 222                         ordinal = fun-dll->funs;
 223                         break;
 224                 }
 225                 dll=dll->next;
 226         }
 227         if (!dll) {
 228                 FIXME("entrypoint 0x%08lx not found\n",entry);
 229                 return; /* oops */
 230         }
 231         while (*rets) {
 232                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 233                         if (!(*rets)->entry[i].origreturn)
 234                                 break;
 235                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 236                         break;
 237                 rets = &((*rets)->next);
 238         }
 239         if (!*rets) {
 240                 HANDLE16        hand = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,TRUE,FALSE,FALSE));
 241                 *rets = GlobalLock16(hand);
 242                 memset(*rets,0,65535);
 243                 (*rets)->rethandle = hand;
 244                 i = 0;  /* entry 0 is free */
 245         }
 246         ret = &((*rets)->entry[i]);
 247         ret->lcall      = 0x9a;
 248         ret->snr        = MAKELONG(sizeof(SNOOP16_RELAY),xsnr);
 249         ret->origreturn = (FARPROC16)CALLER1REF;
 250         CALLER1REF      = MAKELONG((char*)&(ret->lcall)-(char*)((*rets)->entry),(*rets)->rethandle);
 251         ret->dll        = dll;
 252         ret->args       = NULL;
 253         ret->ordinal    = ordinal;
 254         ret->origSP     = LOWORD(ESP_reg(context));
 255
 256         EIP_reg(context)= LOWORD(fun->origfun);
 257         CS_reg(context) = HIWORD(fun->origfun);
 258
 259
 260         DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
 261         if (fun->nrofargs>0) {
 262                 max = fun->nrofargs;
 263                 if (max>16) max=16;
 264                 for (i=max;i--;)
 265                         DPRINTF("%04x%s",*(WORD*)((char *) PTR_SEG_OFF_TO_LIN(SS_reg(context),LOWORD(ESP_reg(context)))+8+sizeof(WORD)*i),i?",":"");
 266                 if (max!=fun->nrofargs)
 267                         DPRINTF(" ...");
 268         } else if (fun->nrofargs<0) {
 269                 DPRINTF("<unknown, check return>");
 270                 ret->args = HeapAlloc(SystemHeap,0,16*sizeof(WORD));
 271                 memcpy(ret->args,(LPBYTE)((char *) PTR_SEG_OFF_TO_LIN(SS_reg(context),LOWORD(ESP_reg(context)))+8),sizeof(WORD)*16);
 272         }
 273         DPRINTF(") ret=%04x:%04x\n",HIWORD(ret->origreturn),LOWORD(ret->origreturn));
 274 }
 275
 276 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
 277         SNOOP16_RETURNENTRY     *ret = (SNOOP16_RETURNENTRY*)((char *) PTR_SEG_OFF_TO_LIN(CS_reg(context),LOWORD(EIP_reg(context)))-5);
 278
 279         /* We haven't found out the nrofargs yet. If we called a cdecl
 280          * function it is too late anyway and we can just set '0' (which
 281          * will be the difference between orig and current SP
 282          * If pascal -> everything ok.
 283          */
 284         if (ret->dll->funs[ret->ordinal].nrofargs<0) {
 285                 ret->dll->funs[ret->ordinal].nrofargs=(LOWORD(ESP_reg(context))-ret->origSP-4)/2;
 286         }
 287         EIP_reg(context) = LOWORD(ret->origreturn);
 288         CS_reg(context)  = HIWORD(ret->origreturn);
 289         if (ret->args) {
 290                 int     i,max;
 291
 292                 DPRINTF("Ret  %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
 293                 max = ret->dll->funs[ret->ordinal].nrofargs;
 294                 if (max>16)
 295                         max=16;
 296                 if (max<0)
 297                         max=0;
 298
 299                 for (i=max;i--;)
 300                         DPRINTF("%04x%s",ret->args[i],i?",":"");
 301                 if (max!=ret->dll->funs[ret->ordinal].nrofargs)
 302                         DPRINTF(" ...");
 303                 DPRINTF(") retval = %04x:%04x ret=%04x:%04x\n",
 304                         DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
 305                 );
 306                 HeapFree(SystemHeap,0,ret->args);
 307                 ret->args = NULL;
 308         } else
 309                 DPRINTF("Ret  %s.%ld: %s() retval = %04x:%04x ret=%04x:%04x\n",
 310                         ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
 311                         DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
 312                 );
 313         ret->origreturn = NULL; /* mark as empty */
 314 }
 315 #else   /* !__i386__ */
 316 void SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
 317         FIXME("snooping works only on i386 for now.\n");
 318         return;
 319 }
 320
 321 FARPROC16 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
 322         return origfun;
 323 }
 324 #endif  /* !__i386__ */
 325