relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21 #include "config.h"
  22 #include "wine/port.h"
  23
  24 #include <assert.h>
  25 #include <stdio.h>
  26 #include <string.h>
  27 #include "winbase.h"
  28 #include "winnt.h"
  29 #include "winternl.h"
  30 #include "snoop.h"
  31 #include "stackframe.h"
  32 #include "wine/debug.h"
  33 #include "wine/exception.h"
  34 #include "excpt.h"
  35
  36 WINE_DEFAULT_DEBUG_CHANNEL(snoop);
  37 WINE_DECLARE_DEBUG_CHANNEL(seh);
  38
  39 static WINE_EXCEPTION_FILTER(page_fault)
  40 {
  41     if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ||
  42         GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION)
  43         return EXCEPTION_EXECUTE_HANDLER;
  44     return EXCEPTION_CONTINUE_SEARCH;
  45 }
  46
  47 extern const char **debug_snoop_excludelist;
  48 extern const char **debug_snoop_includelist;
  49
  50 #ifdef __i386__
  51
  52 extern void WINAPI SNOOP_Entry();
  53 extern void WINAPI SNOOP_Return();
  54
  55 #include "pshpack1.h"
  56
  57 typedef struct tagSNOOP_FUN {
  58         /* code part */
  59         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  60         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  61          * calculation!
  62          */
  63         DWORD           snoopentry;     /* SNOOP_Entry relative */
  64         /* unreached */
  65         int             nrofargs;
  66         FARPROC origfun;
  67         char            *name;
  68 } SNOOP_FUN;
  69
  70 typedef struct tagSNOOP_DLL {
  71         HMODULE hmod;
  72         SNOOP_FUN       *funs;
  73         DWORD           ordbase;
  74         DWORD           nrofordinals;
  75         struct tagSNOOP_DLL     *next;
  76         char name[1];
  77 } SNOOP_DLL;
  78
  79 typedef struct tagSNOOP_RETURNENTRY {
  80         /* code part */
  81         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  82         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  83          * calculation!
  84          */
  85         DWORD           snoopret;       /* SNOOP_Ret relative */
  86         /* unreached */
  87         FARPROC origreturn;
  88         SNOOP_DLL       *dll;
  89         DWORD           ordinal;
  90         DWORD           origESP;
  91         DWORD           *args;          /* saved args across a stdcall */
  92 } SNOOP_RETURNENTRY;
  93
  94 typedef struct tagSNOOP_RETURNENTRIES {
  95         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  96         struct tagSNOOP_RETURNENTRIES   *next;
  97 } SNOOP_RETURNENTRIES;
  98
  99 #include "poppack.h"
 100
 101 static  SNOOP_DLL               *firstdll = NULL;
 102 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
 103
 104 /***********************************************************************
 105  *          SNOOP_ShowDebugmsgSnoop
 106  *
 107  * Simple function to decide if a particular debugging message is
 108  * wanted.
 109  */
 110 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
 111
 112   if(debug_snoop_excludelist || debug_snoop_includelist) {
 113     const char **listitem;
 114     char buf[80];
 115     int len, len2, itemlen, show;
 116
 117     if(debug_snoop_excludelist) {
 118       show = 1;
 119       listitem = debug_snoop_excludelist;
 120     } else {
 121       show = 0;
 122       listitem = debug_snoop_includelist;
 123     }
 124     len = strlen(dll);
 125     assert(len < 64);
 126     sprintf(buf, "%s.%d", dll, ord);
 127     len2 = strlen(buf);
 128     for(; *listitem; listitem++) {
 129       itemlen = strlen(*listitem);
 130       if((itemlen == len && !strncasecmp(*listitem, buf, len)) ||
 131          (itemlen == len2 && !strncasecmp(*listitem, buf, len2)) ||
 132          !strcasecmp(*listitem, fname)) {
 133         show = !show;
 134        break;
 135       }
 136     }
 137     return show;
 138   }
 139   return 1;
 140 }
 141
 142 void
 143 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD ordbase,DWORD nrofordinals) {
 144         SNOOP_DLL       **dll = &(firstdll);
 145         char            *s;
 146
 147     TRACE("hmod=%p, name=%s, ordbase=%ld, nrofordinals=%ld\n",
 148            hmod, name, ordbase, nrofordinals);
 149
 150         if (!TRACE_ON(snoop)) return;
 151         while (*dll) {
 152                 if ((*dll)->hmod == hmod)
 153                 {
 154                     /* another dll, loaded at the same address */
 155                     VirtualFree((*dll)->funs, (*dll)->nrofordinals*sizeof(SNOOP_FUN), MEM_RELEASE);
 156                     break;
 157                 }
 158                 dll = &((*dll)->next);
 159         }
 160         *dll = HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, *dll, sizeof(SNOOP_DLL)+strlen(name));
 161         (*dll)->hmod    = hmod;
 162         (*dll)->ordbase = ordbase;
 163         (*dll)->nrofordinals = nrofordinals;
 164         strcpy( (*dll)->name, name );
 165         if ((s=strrchr((*dll)->name,'.')))
 166                 *s='\0';
 167         (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 168         memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
 169         if (!(*dll)->funs) {
 170                 HeapFree(GetProcessHeap(),0,*dll);
 171                 FIXME("out of memory\n");
 172                 return;
 173         }
 174 }
 175
 176 FARPROC
 177 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 178         SNOOP_DLL                       *dll = firstdll;
 179         SNOOP_FUN                       *fun;
 180         IMAGE_SECTION_HEADER *sec;
 181
 182         if (!TRACE_ON(snoop)) return origfun;
 183         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 184                 return origfun;
 185
 186         sec = RtlImageRvaToSection( RtlImageNtHeader(hmod), hmod, (char *)origfun - (char *)hmod );
 187
 188         if (!sec || !(sec->Characteristics & IMAGE_SCN_CNT_CODE))
 189             return origfun;  /* most likely a data reference */
 190
 191         while (dll) {
 192                 if (hmod == dll->hmod)
 193                         break;
 194                 dll=dll->next;
 195         }
 196         if (!dll)       /* probably internal */
 197                 return origfun;
 198         if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
 199                 return origfun;
 200         assert(ordinal < dll->nrofordinals);
 201         fun = dll->funs+ordinal;
 202         if (!fun->name)
 203           {
 204             fun->name = HeapAlloc(GetProcessHeap(),0,strlen(name)+1);
 205             strcpy( fun->name, name );
 206             fun->lcall  = 0xe8;
 207             /* NOTE: origreturn struct member MUST come directly after snoopentry */
 208             fun->snoopentry     = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 209             fun->origfun        = origfun;
 210             fun->nrofargs       = -1;
 211           }
 212         return (FARPROC)&(fun->lcall);
 213 }
 214
 215 static void SNOOP_PrintArg(DWORD x)
 216 {
 217     int i,nostring;
 218
 219     DPRINTF("%08lx",x);
 220     if (!HIWORD(x) || TRACE_ON(seh)) return; /* trivial reject to avoid faults */
 221     __TRY
 222     {
 223         LPBYTE s=(LPBYTE)x;
 224         i=0;nostring=0;
 225         while (i<80) {
 226             if (s[i]==0) break;
 227             if (s[i]<0x20) {nostring=1;break;}
 228             if (s[i]>=0x80) {nostring=1;break;}
 229             i++;
 230         }
 231         if (!nostring && i > 5)
 232             DPRINTF(" %s",debugstr_an((LPSTR)x,i));
 233         else  /* try unicode */
 234         {
 235             LPWSTR s=(LPWSTR)x;
 236             i=0;nostring=0;
 237             while (i<80) {
 238                 if (s[i]==0) break;
 239                 if (s[i]<0x20) {nostring=1;break;}
 240                 if (s[i]>0x100) {nostring=1;break;}
 241                 i++;
 242             }
 243             if (!nostring && i > 5) DPRINTF(" %s",debugstr_wn((LPWSTR)x,i));
 244         }
 245     }
 246     __EXCEPT(page_fault)
 247     {
 248     }
 249     __ENDTRY
 250 }
 251
 252 #define CALLER1REF (*(DWORD*)context->Esp)
 253
 254 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
 255 {
 256         DWORD           ordinal=0,entry = context->Eip - 5;
 257         SNOOP_DLL       *dll = firstdll;
 258         SNOOP_FUN       *fun = NULL;
 259         SNOOP_RETURNENTRIES     **rets = &firstrets;
 260         SNOOP_RETURNENTRY       *ret;
 261         int             i=0, max;
 262
 263         while (dll) {
 264                 if (    ((char*)entry>=(char*)dll->funs)        &&
 265                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 266                 ) {
 267                         fun = (SNOOP_FUN*)entry;
 268                         ordinal = fun-dll->funs;
 269                         break;
 270                 }
 271                 dll=dll->next;
 272         }
 273         if (!dll) {
 274                 FIXME("entrypoint 0x%08lx not found\n",entry);
 275                 return; /* oops */
 276         }
 277         /* guess cdecl ... */
 278         if (fun->nrofargs<0) {
 279                 /* Typical cdecl return frame is:
 280                  *      add esp, xxxxxxxx
 281                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 282                  * (after that 81 C2 xx xx xx xx)
 283                  */
 284                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 285
 286                 if (reteip) {
 287                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 288                                 fun->nrofargs=reteip[2]/4;
 289                 }
 290         }
 291
 292
 293         while (*rets) {
 294                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 295                         if (!(*rets)->entry[i].origreturn)
 296                                 break;
 297                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 298                         break;
 299                 rets = &((*rets)->next);
 300         }
 301         if (!*rets) {
 302                 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 303                 memset(*rets,0,4096);
 304                 i = 0;  /* entry 0 is free */
 305         }
 306         ret = &((*rets)->entry[i]);
 307         ret->lcall      = 0xe8;
 308         /* NOTE: origreturn struct member MUST come directly after snoopret */
 309         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 310         ret->origreturn = (FARPROC)CALLER1REF;
 311         CALLER1REF      = (DWORD)&ret->lcall;
 312         ret->dll        = dll;
 313         ret->args       = NULL;
 314         ret->ordinal    = ordinal;
 315         ret->origESP    = context->Esp;
 316
 317         context->Eip = (DWORD)fun->origfun;
 318
 319         DPRINTF("%04lx:CALL %s.%ld: %s(",GetCurrentThreadId(),dll->name,dll->ordbase+ordinal,fun->name);
 320         if (fun->nrofargs>0) {
 321                 max = fun->nrofargs; if (max>16) max=16;
 322                 for (i=0;i<max;i++)
 323                 {
 324                     SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i));
 325                     if (i<fun->nrofargs-1) DPRINTF(",");
 326                 }
 327                 if (max!=fun->nrofargs)
 328                         DPRINTF(" ...");
 329         } else if (fun->nrofargs<0) {
 330                 DPRINTF("<unknown, check return>");
 331                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
 332                 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
 333         }
 334         DPRINTF(") ret=%08lx\n",(DWORD)ret->origreturn);
 335 }
 336
 337
 338 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
 339 {
 340         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
 341
 342         /* We haven't found out the nrofargs yet. If we called a cdecl
 343          * function it is too late anyway and we can just set '0' (which
 344          * will be the difference between orig and current ESP
 345          * If stdcall -> everything ok.
 346          */
 347         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 348                 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
 349         context->Eip = (DWORD)ret->origreturn;
 350         if (ret->args) {
 351                 int     i,max;
 352
 353                 DPRINTF("%04lx:RET  %s.%ld: %s(",
 354                         GetCurrentThreadId(),
 355                         ret->dll->name,ret->dll->ordbase+ret->ordinal,ret->dll->funs[ret->ordinal].name);
 356                 max = ret->dll->funs[ret->ordinal].nrofargs;
 357                 if (max>16) max=16;
 358
 359                 for (i=0;i<max;i++)
 360                 {
 361                     SNOOP_PrintArg(ret->args[i]);
 362                     if (i<max-1) DPRINTF(",");
 363                 }
 364                 DPRINTF(") retval = %08lx ret=%08lx\n",
 365                         context->Eax,(DWORD)ret->origreturn );
 366                 HeapFree(GetProcessHeap(),0,ret->args);
 367                 ret->args = NULL;
 368         } else
 369                 DPRINTF("%04lx:RET  %s.%ld: %s() retval = %08lx ret=%08lx\n",
 370                         GetCurrentThreadId(),
 371                         ret->dll->name,ret->dll->ordbase+ret->ordinal,ret->dll->funs[ret->ordinal].name,
 372                         context->Eax, (DWORD)ret->origreturn);
 373         ret->origreturn = NULL; /* mark as empty */
 374 }
 375
 376 /* assembly wrappers that save the context */
 377 __ASM_GLOBAL_FUNC( SNOOP_Entry,
 378                    "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
 379                    ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
 380 __ASM_GLOBAL_FUNC( SNOOP_Return,
 381                    "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
 382                    ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
 383
 384 #else   /* !__i386__ */
 385 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals, DWORD dw) {
 386         if (!TRACE_ON(snoop)) return;
 387         FIXME("snooping works only on i386 for now.\n");
 388 }
 389
 390 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 391         return origfun;
 392 }
 393 #endif  /* !__i386__ */