relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  */
   6
   7 #include "config.h"
   8
   9 #include <assert.h>
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include "winbase.h"
  13 #include "winnt.h"
  14 #include "snoop.h"
  15 #include "stackframe.h"
  16 #include "debugtools.h"
  17 #include "wine/exception.h"
  18
  19 DEFAULT_DEBUG_CHANNEL(snoop);
  20
  21 static WINE_EXCEPTION_FILTER(page_fault)
  22 {
  23     if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ||
  24         GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION)
  25         return EXCEPTION_EXECUTE_HANDLER;
  26     return EXCEPTION_CONTINUE_SEARCH;
  27 }
  28
  29 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
  30
  31 #ifdef __i386__
  32
  33 extern void WINAPI SNOOP_Entry();
  34 extern void WINAPI SNOOP_Return();
  35
  36 #ifdef NEED_UNDERSCORE_PREFIX
  37 # define PREFIX "_"
  38 #else
  39 # define PREFIX
  40 #endif
  41
  42 #include "pshpack1.h"
  43
  44 typedef struct tagSNOOP_FUN {
  45         /* code part */
  46         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  47         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  48          * calculation!
  49          */
  50         DWORD           snoopentry;     /* SNOOP_Entry relative */
  51         /* unreached */
  52         int             nrofargs;
  53         FARPROC origfun;
  54         char            *name;
  55 } SNOOP_FUN;
  56
  57 typedef struct tagSNOOP_DLL {
  58         HMODULE hmod;
  59         SNOOP_FUN       *funs;
  60         DWORD           ordbase;
  61         DWORD           nrofordinals;
  62         struct tagSNOOP_DLL     *next;
  63         char name[1];
  64 } SNOOP_DLL;
  65
  66 typedef struct tagSNOOP_RETURNENTRY {
  67         /* code part */
  68         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  69         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  70          * calculation!
  71          */
  72         DWORD           snoopret;       /* SNOOP_Ret relative */
  73         /* unreached */
  74         FARPROC origreturn;
  75         SNOOP_DLL       *dll;
  76         DWORD           ordinal;
  77         DWORD           origESP;
  78         DWORD           *args;          /* saved args across a stdcall */
  79 } SNOOP_RETURNENTRY;
  80
  81 typedef struct tagSNOOP_RETURNENTRIES {
  82         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  83         struct tagSNOOP_RETURNENTRIES   *next;
  84 } SNOOP_RETURNENTRIES;
  85
  86 #include "poppack.h"
  87
  88 static  SNOOP_DLL               *firstdll = NULL;
  89 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
  90
  91 /***********************************************************************
  92  *          SNOOP_ShowDebugmsgSnoop
  93  *
  94  * Simple function to decide if a particular debugging message is
  95  * wanted.
  96  */
  97 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
  98
  99   if(debug_snoop_excludelist || debug_snoop_includelist) {
 100     char **listitem;
 101     char buf[80];
 102     int len, len2, itemlen, show;
 103
 104     if(debug_snoop_excludelist) {
 105       show = 1;
 106       listitem = debug_snoop_excludelist;
 107     } else {
 108       show = 0;
 109       listitem = debug_snoop_includelist;
 110     }
 111     len = strlen(dll);
 112     assert(len < 64);
 113     sprintf(buf, "%s.%d", dll, ord);
 114     len2 = strlen(buf);
 115     for(; *listitem; listitem++) {
 116       itemlen = strlen(*listitem);
 117       if((itemlen == len && !strncasecmp(*listitem, buf, len)) ||
 118          (itemlen == len2 && !strncasecmp(*listitem, buf, len2)) ||
 119          !strcasecmp(*listitem, fname)) {
 120         show = !show;
 121        break;
 122       }
 123     }
 124     return show;
 125   }
 126   return 1;
 127 }
 128
 129 void
 130 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD ordbase,DWORD nrofordinals) {
 131         SNOOP_DLL       **dll = &(firstdll);
 132         char            *s;
 133
 134         if (!TRACE_ON(snoop)) return;
 135         while (*dll) {
 136                 if ((*dll)->hmod == hmod)
 137                         return; /* already registered */
 138                 dll = &((*dll)->next);
 139         }
 140         *dll = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL)+strlen(name));
 141         (*dll)->next    = NULL;
 142         (*dll)->hmod    = hmod;
 143         (*dll)->ordbase = ordbase;
 144         (*dll)->nrofordinals = nrofordinals;
 145         strcpy( (*dll)->name, name );
 146         if ((s=strrchr((*dll)->name,'.')))
 147                 *s='\0';
 148         (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 149         memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
 150         if (!(*dll)->funs) {
 151                 HeapFree(GetProcessHeap(),0,*dll);
 152                 FIXME("out of memory\n");
 153                 return;
 154         }
 155 }
 156
 157 FARPROC
 158 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 159         SNOOP_DLL                       *dll = firstdll;
 160         SNOOP_FUN                       *fun;
 161         int                             j;
 162         IMAGE_SECTION_HEADER            *pe_seg = PE_SECTIONS(hmod);
 163
 164         if (!TRACE_ON(snoop)) return origfun;
 165         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 166                 return origfun;
 167         for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
 168                 /* 0x42 is special ELF loader tag */
 169                 if ((pe_seg[j].VirtualAddress==0x42) ||
 170                     (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
 171                      ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
 172                                    pe_seg[j].SizeOfRawData
 173                    ))
 174                 )
 175                         break;
 176         /* If we looked through all sections (and didn't find one)
 177          * or if the sectionname contains "data", we return the
 178          * original function since it is most likely a datareference.
 179          */
 180         if (    (j==PE_HEADER(hmod)->FileHeader.NumberOfSections)       ||
 181                 (strstr(pe_seg[j].Name,"data"))                         ||
 182                 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
 183         )
 184                 return origfun;
 185
 186         while (dll) {
 187                 if (hmod == dll->hmod)
 188                         break;
 189                 dll=dll->next;
 190         }
 191         if (!dll)       /* probably internal */
 192                 return origfun;
 193         if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
 194                 return origfun;
 195         assert(ordinal < dll->nrofordinals);
 196         fun = dll->funs+ordinal;
 197         if (!fun->name)
 198           {
 199             fun->name = HeapAlloc(GetProcessHeap(),0,strlen(name)+1);
 200             strcpy( fun->name, name );
 201             fun->lcall  = 0xe8;
 202             /* NOTE: origreturn struct member MUST come directly after snoopentry */
 203             fun->snoopentry     = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 204             fun->origfun        = origfun;
 205             fun->nrofargs       = -1;
 206           }
 207         return (FARPROC)&(fun->lcall);
 208 }
 209
 210 static char*
 211 SNOOP_PrintArg(DWORD x) {
 212         static char     buf[200];
 213         int             i,nostring;
 214         char * volatile ret=0;
 215
 216         if ( !HIWORD(x) ) { /* trivial reject to avoid faults */
 217             sprintf(buf,"%08lx",x);
 218             return buf;
 219         }
 220         __TRY{
 221                 LPBYTE  s=(LPBYTE)x;
 222                 i=0;nostring=0;
 223                 while (i<80) {
 224                         if (s[i]==0) break;
 225                         if (s[i]<0x20) {nostring=1;break;}
 226                         if (s[i]>=0x80) {nostring=1;break;}
 227                         i++;
 228                 }
 229                 if (!nostring) {
 230                         if (i>5) {
 231                                 snprintf(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
 232                                 ret=buf;
 233                         }
 234                 }
 235         }
 236         __EXCEPT(page_fault){}
 237         __ENDTRY
 238         if (ret)
 239           return ret;
 240         __TRY{
 241                 LPWSTR  s=(LPWSTR)x;
 242                 i=0;nostring=0;
 243                 while (i<80) {
 244                         if (s[i]==0) break;
 245                         if (s[i]<0x20) {nostring=1;break;}
 246                         if (s[i]>0x100) {nostring=1;break;}
 247                         i++;
 248                 }
 249                 if (!nostring) {
 250                         if (i>5) {
 251                                 snprintf(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
 252                                 ret=buf;
 253                         }
 254                 }
 255         }
 256         __EXCEPT(page_fault){}
 257         __ENDTRY
 258         if (ret)
 259           return ret;
 260         sprintf(buf,"%08lx",x);
 261         return buf;
 262 }
 263
 264 #define CALLER1REF (*(DWORD*)context->Esp)
 265
 266 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
 267 {
 268         DWORD           ordinal=0,entry = context->Eip - 5;
 269         SNOOP_DLL       *dll = firstdll;
 270         SNOOP_FUN       *fun = NULL;
 271         SNOOP_RETURNENTRIES     **rets = &firstrets;
 272         SNOOP_RETURNENTRY       *ret;
 273         int             i=0, max;
 274
 275         while (dll) {
 276                 if (    ((char*)entry>=(char*)dll->funs)        &&
 277                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 278                 ) {
 279                         fun = (SNOOP_FUN*)entry;
 280                         ordinal = fun-dll->funs;
 281                         break;
 282                 }
 283                 dll=dll->next;
 284         }
 285         if (!dll) {
 286                 FIXME("entrypoint 0x%08lx not found\n",entry);
 287                 return; /* oops */
 288         }
 289         /* guess cdecl ... */
 290         if (fun->nrofargs<0) {
 291                 /* Typical cdecl return frame is:
 292                  *      add esp, xxxxxxxx
 293                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 294                  * (after that 81 C2 xx xx xx xx)
 295                  */
 296                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 297
 298                 if (reteip) {
 299                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 300                                 fun->nrofargs=reteip[2]/4;
 301                 }
 302         }
 303
 304
 305         while (*rets) {
 306                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 307                         if (!(*rets)->entry[i].origreturn)
 308                                 break;
 309                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 310                         break;
 311                 rets = &((*rets)->next);
 312         }
 313         if (!*rets) {
 314                 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 315                 memset(*rets,0,4096);
 316                 i = 0;  /* entry 0 is free */
 317         }
 318         ret = &((*rets)->entry[i]);
 319         ret->lcall      = 0xe8;
 320         /* NOTE: origreturn struct member MUST come directly after snoopret */
 321         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 322         ret->origreturn = (FARPROC)CALLER1REF;
 323         CALLER1REF      = (DWORD)&ret->lcall;
 324         ret->dll        = dll;
 325         ret->args       = NULL;
 326         ret->ordinal    = ordinal;
 327         ret->origESP    = context->Esp;
 328
 329         context->Eip = (DWORD)fun->origfun;
 330
 331         DPRINTF("%08lx:CALL %s.%ld: %s(",GetCurrentThreadId(),dll->name,dll->ordbase+ordinal,fun->name);
 332         if (fun->nrofargs>0) {
 333                 max = fun->nrofargs; if (max>16) max=16;
 334                 for (i=0;i<max;i++)
 335                         DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
 336                 if (max!=fun->nrofargs)
 337                         DPRINTF(" ...");
 338         } else if (fun->nrofargs<0) {
 339                 DPRINTF("<unknown, check return>");
 340                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
 341                 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
 342         }
 343         DPRINTF(") ret=%08lx\n",(DWORD)ret->origreturn);
 344 }
 345
 346
 347 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
 348 {
 349         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
 350
 351         /* We haven't found out the nrofargs yet. If we called a cdecl
 352          * function it is too late anyway and we can just set '0' (which
 353          * will be the difference between orig and current ESP
 354          * If stdcall -> everything ok.
 355          */
 356         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 357                 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
 358         context->Eip = (DWORD)ret->origreturn;
 359         if (ret->args) {
 360                 int     i,max;
 361
 362                 DPRINTF("%08lx:RET  %s.%ld: %s(",
 363                         GetCurrentThreadId(),
 364                         ret->dll->name,ret->dll->ordbase+ret->ordinal,ret->dll->funs[ret->ordinal].name);
 365                 max = ret->dll->funs[ret->ordinal].nrofargs;
 366                 if (max>16) max=16;
 367
 368                 for (i=0;i<max;i++)
 369                         DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
 370                 DPRINTF(") retval = %08lx ret=%08lx\n",
 371                         context->Eax,(DWORD)ret->origreturn );
 372                 HeapFree(GetProcessHeap(),0,ret->args);
 373                 ret->args = NULL;
 374         } else
 375                 DPRINTF("%08lx:RET  %s.%ld: %s() retval = %08lx ret=%08lx\n",
 376                         GetCurrentThreadId(),
 377                         ret->dll->name,ret->dll->ordbase+ret->ordinal,ret->dll->funs[ret->ordinal].name,
 378                         context->Eax, (DWORD)ret->origreturn);
 379         ret->origreturn = NULL; /* mark as empty */
 380 }
 381
 382 /* assembly wrappers that save the context */
 383 __ASM_GLOBAL_FUNC( SNOOP_Entry,
 384                    "call " __ASM_NAME("CALL32_Regs") "\n\t"
 385                    ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
 386 __ASM_GLOBAL_FUNC( SNOOP_Return,
 387                    "call " __ASM_NAME("CALL32_Regs") "\n\t"
 388                    ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
 389
 390 #else   /* !__i386__ */
 391 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
 392         if (!TRACE_ON(snoop)) return;
 393         FIXME("snooping works only on i386 for now.\n");
 394 }
 395
 396 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 397         return origfun;
 398 }
 399 #endif  /* !__i386__ */