relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21 #include "config.h"
  22 #include "wine/port.h"
  23
  24 #include <assert.h>
  25 #include <stdarg.h>
  26 #include <stdio.h>
  27 #include <string.h>
  28 #include "ntstatus.h"
  29 #include "windef.h"
  30 #include "winbase.h"
  31 #include "winreg.h"
  32 #include "winternl.h"
  33 #include "snoop.h"
  34 #include "wine/debug.h"
  35 #include "wine/exception.h"
  36 #include "excpt.h"
  37 #include "ntdll_misc.h"
  38
  39 WINE_DEFAULT_DEBUG_CHANNEL(snoop);
  40 WINE_DECLARE_DEBUG_CHANNEL(seh);
  41
  42 static WINE_EXCEPTION_FILTER(page_fault)
  43 {
  44     if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ||
  45         GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION)
  46         return EXCEPTION_EXECUTE_HANDLER;
  47     return EXCEPTION_CONTINUE_SEARCH;
  48 }
  49
  50 extern const char **debug_snoop_excludelist;
  51 extern const char **debug_snoop_includelist;
  52
  53 #ifdef __i386__
  54
  55 extern void WINAPI SNOOP_Entry();
  56 extern void WINAPI SNOOP_Return();
  57
  58 #include "pshpack1.h"
  59
  60 typedef struct tagSNOOP_FUN {
  61         /* code part */
  62         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  63         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  64          * calculation!
  65          */
  66         DWORD           snoopentry;     /* SNOOP_Entry relative */
  67         /* unreached */
  68         int             nrofargs;
  69         FARPROC origfun;
  70         const char *name;
  71 } SNOOP_FUN;
  72
  73 typedef struct tagSNOOP_DLL {
  74         HMODULE hmod;
  75         SNOOP_FUN       *funs;
  76         DWORD           ordbase;
  77         DWORD           nrofordinals;
  78         struct tagSNOOP_DLL     *next;
  79         char name[1];
  80 } SNOOP_DLL;
  81
  82 typedef struct tagSNOOP_RETURNENTRY {
  83         /* code part */
  84         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  85         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  86          * calculation!
  87          */
  88         DWORD           snoopret;       /* SNOOP_Ret relative */
  89         /* unreached */
  90         FARPROC origreturn;
  91         SNOOP_DLL       *dll;
  92         DWORD           ordinal;
  93         DWORD           origESP;
  94         DWORD           *args;          /* saved args across a stdcall */
  95 } SNOOP_RETURNENTRY;
  96
  97 typedef struct tagSNOOP_RETURNENTRIES {
  98         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  99         struct tagSNOOP_RETURNENTRIES   *next;
 100 } SNOOP_RETURNENTRIES;
 101
 102 #include "poppack.h"
 103
 104 static  SNOOP_DLL               *firstdll = NULL;
 105 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
 106
 107 /***********************************************************************
 108  *          SNOOP_ShowDebugmsgSnoop
 109  *
 110  * Simple function to decide if a particular debugging message is
 111  * wanted.
 112  */
 113 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
 114
 115   if(debug_snoop_excludelist || debug_snoop_includelist) {
 116     const char **listitem;
 117     char buf[80];
 118     int len, len2, itemlen, show;
 119
 120     if(debug_snoop_excludelist) {
 121       show = 1;
 122       listitem = debug_snoop_excludelist;
 123     } else {
 124       show = 0;
 125       listitem = debug_snoop_includelist;
 126     }
 127     len = strlen(dll);
 128     assert(len < 64);
 129     sprintf(buf, "%s.%d", dll, ord);
 130     len2 = strlen(buf);
 131     for(; *listitem; listitem++) {
 132       itemlen = strlen(*listitem);
 133       if((itemlen == len && !strncasecmp(*listitem, buf, len)) ||
 134          (itemlen == len2 && !strncasecmp(*listitem, buf, len2)) ||
 135          !strcasecmp(*listitem, fname)) {
 136         show = !show;
 137        break;
 138       }
 139     }
 140     return show;
 141   }
 142   return 1;
 143 }
 144
 145 void
 146 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD ordbase,DWORD nrofordinals) {
 147         SNOOP_DLL       **dll = &(firstdll);
 148         char            *s;
 149         void            *addr;
 150         SIZE_T          size;
 151
 152     TRACE("hmod=%p, name=%s, ordbase=%ld, nrofordinals=%ld\n",
 153            hmod, name, ordbase, nrofordinals);
 154
 155         if (!TRACE_ON(snoop)) return;
 156         while (*dll) {
 157                 if ((*dll)->hmod == hmod)
 158                 {
 159                     /* another dll, loaded at the same address */
 160                     addr = (*dll)->funs;
 161                     size = (*dll)->nrofordinals * sizeof(SNOOP_FUN);
 162                     NtFreeVirtualMemory(GetCurrentProcess(), &addr, &size, MEM_RELEASE);
 163                     break;
 164                 }
 165                 dll = &((*dll)->next);
 166         }
 167         *dll = RtlReAllocateHeap(ntdll_get_process_heap(),
 168                                  HEAP_ZERO_MEMORY, *dll,
 169                                  sizeof(SNOOP_DLL) + strlen(name));
 170         (*dll)->hmod    = hmod;
 171         (*dll)->ordbase = ordbase;
 172         (*dll)->nrofordinals = nrofordinals;
 173         strcpy( (*dll)->name, name );
 174         if ((s=strrchr((*dll)->name,'.')))
 175                 *s='\0';
 176         size = nrofordinals * sizeof(SNOOP_FUN);
 177         NtAllocateVirtualMemory(GetCurrentProcess(), &addr, NULL, &size,
 178                                 MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
 179         if (!addr) {
 180                 RtlFreeHeap(ntdll_get_process_heap(),0,*dll);
 181                 FIXME("out of memory\n");
 182                 return;
 183         }
 184         (*dll)->funs = addr;
 185         memset((*dll)->funs,0,size);
 186 }
 187
 188 FARPROC SNOOP_GetProcAddress( HMODULE hmod, IMAGE_EXPORT_DIRECTORY *exports, DWORD exp_size,
 189                               FARPROC origfun, DWORD ordinal )
 190 {
 191         int i;
 192         const char *ename;
 193         WORD *ordinals;
 194         DWORD *names;
 195         SNOOP_DLL                       *dll = firstdll;
 196         SNOOP_FUN                       *fun;
 197         IMAGE_SECTION_HEADER *sec;
 198
 199         if (!TRACE_ON(snoop)) return origfun;
 200         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 201                 return origfun;
 202
 203         sec = RtlImageRvaToSection( RtlImageNtHeader(hmod), hmod, (char *)origfun - (char *)hmod );
 204
 205         if (!sec || !(sec->Characteristics & IMAGE_SCN_CNT_CODE))
 206             return origfun;  /* most likely a data reference */
 207
 208         while (dll) {
 209                 if (hmod == dll->hmod)
 210                         break;
 211                 dll=dll->next;
 212         }
 213         if (!dll)       /* probably internal */
 214                 return origfun;
 215
 216         /* try to find a name for it */
 217         ename = NULL;
 218         names = (DWORD *)((char *)hmod + exports->AddressOfNames);
 219         ordinals = (WORD *)((char *)hmod + exports->AddressOfNameOrdinals);
 220         if (names) for (i = 0; i < exports->NumberOfNames; i++)
 221         {
 222             if (ordinals[i] == ordinal)
 223             {
 224                 ename = (char *)hmod + names[i];
 225                 break;
 226             }
 227         }
 228         if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,ename))
 229                 return origfun;
 230         assert(ordinal < dll->nrofordinals);
 231         fun = dll->funs+ordinal;
 232         if (!fun->name)
 233           {
 234             fun->name = ename;
 235             fun->lcall  = 0xe8;
 236             /* NOTE: origreturn struct member MUST come directly after snoopentry */
 237             fun->snoopentry     = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 238             fun->origfun        = origfun;
 239             fun->nrofargs       = -1;
 240           }
 241         return (FARPROC)&(fun->lcall);
 242 }
 243
 244 static void SNOOP_PrintArg(DWORD x)
 245 {
 246     int i,nostring;
 247
 248     DPRINTF("%08lx",x);
 249     if (!HIWORD(x) || TRACE_ON(seh)) return; /* trivial reject to avoid faults */
 250     __TRY
 251     {
 252         LPBYTE s=(LPBYTE)x;
 253         i=0;nostring=0;
 254         while (i<80) {
 255             if (s[i]==0) break;
 256             if (s[i]<0x20) {nostring=1;break;}
 257             if (s[i]>=0x80) {nostring=1;break;}
 258             i++;
 259         }
 260         if (!nostring && i > 5)
 261             DPRINTF(" %s",debugstr_an((LPSTR)x,i));
 262         else  /* try unicode */
 263         {
 264             LPWSTR s=(LPWSTR)x;
 265             i=0;nostring=0;
 266             while (i<80) {
 267                 if (s[i]==0) break;
 268                 if (s[i]<0x20) {nostring=1;break;}
 269                 if (s[i]>0x100) {nostring=1;break;}
 270                 i++;
 271             }
 272             if (!nostring && i > 5) DPRINTF(" %s",debugstr_wn((LPWSTR)x,i));
 273         }
 274     }
 275     __EXCEPT(page_fault)
 276     {
 277     }
 278     __ENDTRY
 279 }
 280
 281 #define CALLER1REF (*(DWORD*)context->Esp)
 282
 283 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
 284 {
 285         DWORD           ordinal=0,entry = context->Eip - 5;
 286         SNOOP_DLL       *dll = firstdll;
 287         SNOOP_FUN       *fun = NULL;
 288         SNOOP_RETURNENTRIES     **rets = &firstrets;
 289         SNOOP_RETURNENTRY       *ret;
 290         int             i=0, max;
 291
 292         while (dll) {
 293                 if (    ((char*)entry>=(char*)dll->funs)        &&
 294                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 295                 ) {
 296                         fun = (SNOOP_FUN*)entry;
 297                         ordinal = fun-dll->funs;
 298                         break;
 299                 }
 300                 dll=dll->next;
 301         }
 302         if (!dll) {
 303                 FIXME("entrypoint 0x%08lx not found\n",entry);
 304                 return; /* oops */
 305         }
 306         /* guess cdecl ... */
 307         if (fun->nrofargs<0) {
 308                 /* Typical cdecl return frame is:
 309                  *      add esp, xxxxxxxx
 310                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 311                  * (after that 81 C2 xx xx xx xx)
 312                  */
 313                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 314
 315                 if (reteip) {
 316                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 317                                 fun->nrofargs=reteip[2]/4;
 318                 }
 319         }
 320
 321
 322         while (*rets) {
 323                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 324                         if (!(*rets)->entry[i].origreturn)
 325                                 break;
 326                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 327                         break;
 328                 rets = &((*rets)->next);
 329         }
 330         if (!*rets) {
 331                 SIZE_T size = 4096;
 332                 VOID* addr;
 333
 334                 NtAllocateVirtualMemory(GetCurrentProcess(), &addr, NULL, &size,
 335                                         MEM_COMMIT | MEM_RESERVE,
 336                                         PAGE_EXECUTE_READWRITE);
 337                 if (!addr) return;
 338                 *rets = addr;
 339                 memset(*rets,0,4096);
 340                 i = 0;  /* entry 0 is free */
 341         }
 342         ret = &((*rets)->entry[i]);
 343         ret->lcall      = 0xe8;
 344         /* NOTE: origreturn struct member MUST come directly after snoopret */
 345         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 346         ret->origreturn = (FARPROC)CALLER1REF;
 347         CALLER1REF      = (DWORD)&ret->lcall;
 348         ret->dll        = dll;
 349         ret->args       = NULL;
 350         ret->ordinal    = ordinal;
 351         ret->origESP    = context->Esp;
 352
 353         context->Eip = (DWORD)fun->origfun;
 354
 355         if (fun->name) DPRINTF("%04lx:CALL %s.%s(",GetCurrentThreadId(),dll->name,fun->name);
 356         else DPRINTF("%04lx:CALL %s.%ld(",GetCurrentThreadId(),dll->name,dll->ordbase+ordinal);
 357         if (fun->nrofargs>0) {
 358                 max = fun->nrofargs; if (max>16) max=16;
 359                 for (i=0;i<max;i++)
 360                 {
 361                     SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i));
 362                     if (i<fun->nrofargs-1) DPRINTF(",");
 363                 }
 364                 if (max!=fun->nrofargs)
 365                         DPRINTF(" ...");
 366         } else if (fun->nrofargs<0) {
 367                 DPRINTF("<unknown, check return>");
 368                 ret->args = RtlAllocateHeap(ntdll_get_process_heap(),
 369                                             0,16*sizeof(DWORD));
 370                 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
 371         }
 372         DPRINTF(") ret=%08lx\n",(DWORD)ret->origreturn);
 373 }
 374
 375
 376 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
 377 {
 378         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
 379         SNOOP_FUN *fun = &ret->dll->funs[ret->ordinal];
 380
 381         /* We haven't found out the nrofargs yet. If we called a cdecl
 382          * function it is too late anyway and we can just set '0' (which
 383          * will be the difference between orig and current ESP
 384          * If stdcall -> everything ok.
 385          */
 386         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 387                 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
 388         context->Eip = (DWORD)ret->origreturn;
 389         if (ret->args) {
 390                 int     i,max;
 391
 392                 if (fun->name)
 393                     DPRINTF("%04lx:RET  %s.%s(", GetCurrentThreadId(), ret->dll->name, fun->name);
 394                 else
 395                     DPRINTF("%04lx:RET  %s.%ld(", GetCurrentThreadId(),
 396                             ret->dll->name,ret->dll->ordbase+ret->ordinal);
 397
 398                 max = fun->nrofargs;
 399                 if (max>16) max=16;
 400
 401                 for (i=0;i<max;i++)
 402                 {
 403                     SNOOP_PrintArg(ret->args[i]);
 404                     if (i<max-1) DPRINTF(",");
 405                 }
 406                 DPRINTF(") retval=%08lx ret=%08lx\n",
 407                         context->Eax,(DWORD)ret->origreturn );
 408                 RtlFreeHeap(ntdll_get_process_heap(),0,ret->args);
 409                 ret->args = NULL;
 410         }
 411         else
 412         {
 413             if (fun->name)
 414                 DPRINTF("%04lx:RET  %s.%s() retval=%08lx ret=%08lx\n",
 415                         GetCurrentThreadId(),
 416                         ret->dll->name, fun->name, context->Eax, (DWORD)ret->origreturn);
 417             else
 418                 DPRINTF("%04lx:RET  %s.%ld() retval=%08lx ret=%08lx\n",
 419                         GetCurrentThreadId(),
 420                         ret->dll->name,ret->dll->ordbase+ret->ordinal,
 421                         context->Eax, (DWORD)ret->origreturn);
 422         }
 423         ret->origreturn = NULL; /* mark as empty */
 424 }
 425
 426 /* assembly wrappers that save the context */
 427 __ASM_GLOBAL_FUNC( SNOOP_Entry,
 428                    "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
 429                    ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
 430 __ASM_GLOBAL_FUNC( SNOOP_Return,
 431                    "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
 432                    ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
 433
 434 #else   /* !__i386__ */
 435 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals, DWORD dw) {
 436         if (!TRACE_ON(snoop)) return;
 437         FIXME("snooping works only on i386 for now.\n");
 438 }
 439
 440 FARPROC SNOOP_GetProcAddress( HMODULE hmod, IMAGE_EXPORT_DIRECTORY *exports, DWORD exp_size,
 441                               FARPROC origfun, DWORD ordinal )
 442 {
 443     return origfun;
 444 }
 445 #endif  /* !__i386__ */