if1632/snoop.c

   1 /*
   2  * 386-specific Win16 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  */
   6
   7 #include <assert.h>
   8 #include <string.h>
   9 #include <stdio.h>
  10 #include "winbase.h"
  11 #include "windef.h"
  12 #include "winnt.h"
  13 #include "wine/winbase16.h"
  14 #include "wine/library.h"
  15 #include "global.h"
  16 #include "stackframe.h"
  17 #include "builtin16.h"
  18 #include "toolhelp.h"
  19 #include "snoop.h"
  20 #include "debugtools.h"
  21
  22 DEFAULT_DEBUG_CHANNEL(snoop);
  23
  24 #ifdef __i386__
  25
  26 #include "pshpack1.h"
  27
  28 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context);
  29 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context);
  30
  31 typedef struct tagSNOOP16_FUN {
  32         /* code part */
  33         BYTE            lcall;          /* 0x9a call absolute with segment */
  34         DWORD           snr;
  35         /* unreached */
  36         int             nrofargs;
  37         FARPROC16       origfun;
  38         char            *name;
  39 } SNOOP16_FUN;
  40
  41 typedef struct tagSNOOP16_DLL {
  42         HMODULE16       hmod;
  43         HANDLE16        funhandle;
  44         SNOOP16_FUN     *funs;
  45         struct tagSNOOP16_DLL   *next;
  46         char name[1];
  47 } SNOOP16_DLL;
  48
  49 typedef struct tagSNOOP16_RETURNENTRY {
  50         /* code part */
  51         BYTE            lcall;          /* 0x9a call absolute with segment */
  52         DWORD           snr;
  53         /* unreached */
  54         FARPROC16       origreturn;
  55         SNOOP16_DLL     *dll;
  56         DWORD           ordinal;
  57         WORD            origSP;
  58         WORD            *args;          /* saved args across a stdcall */
  59 } SNOOP16_RETURNENTRY;
  60
  61 typedef struct tagSNOOP16_RETURNENTRIES {
  62         SNOOP16_RETURNENTRY entry[65500/sizeof(SNOOP16_RETURNENTRY)];
  63         HANDLE16        rethandle;
  64         struct tagSNOOP16_RETURNENTRIES *next;
  65 } SNOOP16_RETURNENTRIES;
  66
  67 typedef struct tagSNOOP16_RELAY {
  68         WORD            pushbp;         /* 0x5566 */
  69         BYTE            pusheax;        /* 0x50 */
  70         WORD            pushax;         /* 0x5066 */
  71         BYTE            pushl;          /* 0x68 */
  72         DWORD           realfun;        /* SNOOP16_Return */
  73         BYTE            lcall;          /* 0x9a call absolute with segment */
  74         DWORD           callfromregs;
  75         WORD            seg;
  76         WORD            lret;           /* 0xcb66 */
  77 } SNOOP16_RELAY;
  78
  79 #include "poppack.h"
  80
  81 static  SNOOP16_DLL             *firstdll = NULL;
  82 static  SNOOP16_RETURNENTRIES   *firstrets = NULL;
  83 static  SNOOP16_RELAY           *snr;
  84 static  HANDLE16                xsnr = 0;
  85
  86 void
  87 SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
  88         SNOOP16_DLL     **dll = &(firstdll);
  89         char            *s;
  90
  91         if (!TRACE_ON(snoop)) return;
  92         if (!snr) {
  93                 xsnr=GLOBAL_Alloc(GMEM_ZEROINIT,2*sizeof(*snr),0,WINE_LDT_FLAGS_CODE|WINE_LDT_FLAGS_32BIT);
  94                 snr = GlobalLock16(xsnr);
  95                 snr[0].pushbp   = 0x5566;
  96                 snr[0].pusheax  = 0x50;
  97                 snr[0].pushax   = 0x5066;
  98                 snr[0].pushl    = 0x68;
  99                 snr[0].realfun  = (DWORD)SNOOP16_Entry;
 100                 snr[0].lcall    = 0x9a;
 101                 snr[0].callfromregs = (DWORD)__wine_call_from_16_regs;
 102                 snr[0].seg      = __get_cs();
 103                 snr[0].lret     = 0xcb66;
 104
 105                 snr[1].pushbp   = 0x5566;
 106                 snr[1].pusheax  = 0x50;
 107                 snr[1].pushax   = 0x5066;
 108                 snr[1].pushl    = 0x68;
 109                 snr[1].realfun  = (DWORD)SNOOP16_Return;
 110                 snr[1].lcall    = 0x9a;
 111                 snr[1].callfromregs = (DWORD)__wine_call_from_16_regs;
 112                 snr[1].seg      = __get_cs();
 113                 snr[1].lret     = 0xcb66;
 114         }
 115         while (*dll) {
 116                 if ((*dll)->hmod == pModule->self)
 117                         return; /* already registered */
 118                 dll = &((*dll)->next);
 119         }
 120         *dll = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP16_DLL)+strlen(name));
 121         (*dll)->next    = NULL;
 122         (*dll)->hmod    = pModule->self;
 123         if ((s=strrchr(name,'\\')))
 124                 name = s+1;
 125         strcpy( (*dll)->name, name );
 126         if ((s=strrchr((*dll)->name,'.')))
 127                 *s='\0';
 128         (*dll)->funhandle = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,WINE_LDT_FLAGS_CODE));
 129         (*dll)->funs = GlobalLock16((*dll)->funhandle);
 130         if (!(*dll)->funs) {
 131                 HeapFree(GetProcessHeap(),0,*dll);
 132                 FIXME("out of memory\n");
 133                 return;
 134         }
 135 }
 136
 137 FARPROC16
 138 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
 139         SNOOP16_DLL                     *dll = firstdll;
 140         SNOOP16_FUN                     *fun;
 141         NE_MODULE                       *pModule = NE_GetPtr(hmod);
 142         unsigned char                   *cpnt;
 143         char                            name[200];
 144
 145         if (!TRACE_ON(snoop) || !pModule || !HIWORD(origfun))
 146                 return origfun;
 147         if (!*(LPBYTE)MapSL((SEGPTR)origfun)) /* 0x00 is an imposs. opcode, poss. dataref. */
 148                 return origfun;
 149         while (dll) {
 150                 if (hmod == dll->hmod)
 151                         break;
 152                 dll=dll->next;
 153         }
 154         if (!dll)       /* probably internal */
 155                 return origfun;
 156         if (ordinal>65535/sizeof(SNOOP16_FUN))
 157                 return origfun;
 158         fun = dll->funs+ordinal;
 159         /* already done? */
 160         fun->lcall      = 0x9a;
 161         fun->snr        = MAKELONG(0,xsnr);
 162         fun->origfun    = origfun;
 163         if (fun->name)
 164                 return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
 165         cpnt = (unsigned char *)pModule + pModule->name_table;
 166         while (*cpnt) {
 167                 cpnt += *cpnt + 1 + sizeof(WORD);
 168                 if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
 169                         sprintf(name,"%.*s",*cpnt,cpnt+1);
 170                         break;
 171                 }
 172         }
 173         /* Now search the non-resident names table */
 174
 175         if (!*cpnt && pModule->nrname_handle) {
 176                 cpnt = (char *)GlobalLock16( pModule->nrname_handle );
 177                 while (*cpnt) {
 178                         cpnt += *cpnt + 1 + sizeof(WORD);
 179                         if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
 180                                     sprintf(name,"%.*s",*cpnt,cpnt+1);
 181                                     break;
 182                         }
 183                 }
 184         }
 185         if (*cpnt)
 186         {
 187             fun->name = HeapAlloc(GetProcessHeap(),0,strlen(name)+1);
 188             strcpy( fun->name, name );
 189         }
 190         else
 191             fun->name = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,1); /* empty string */
 192
 193         if (!SNOOP_ShowDebugmsgSnoop(dll->name, ordinal, fun->name))
 194                 return origfun;
 195
 196         /* more magic. do not try to snoop thunk data entries (MMSYSTEM) */
 197         if (strchr(fun->name,'_')) {
 198                 char *s=strchr(fun->name,'_');
 199
 200                 if (!strncasecmp(s,"_thunkdata",10)) {
 201                         HeapFree(GetProcessHeap(),0,fun->name);
 202                         fun->name = NULL;
 203                         return origfun;
 204                 }
 205         }
 206         fun->lcall      = 0x9a;
 207         fun->snr        = MAKELONG(0,xsnr);
 208         fun->origfun    = origfun;
 209         fun->nrofargs   = -1;
 210         return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
 211 }
 212
 213 #define CALLER1REF (*(DWORD*)(MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)+4))))
 214 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
 215         DWORD           ordinal=0;
 216         DWORD           entry=(DWORD)MapSL( MAKESEGPTR(context->SegCs,LOWORD(context->Eip)) )-5;
 217         WORD            xcs = context->SegCs;
 218         SNOOP16_DLL     *dll = firstdll;
 219         SNOOP16_FUN     *fun = NULL;
 220         SNOOP16_RETURNENTRIES   **rets = &firstrets;
 221         SNOOP16_RETURNENTRY     *ret;
 222         int             i=0, max;
 223
 224         while (dll) {
 225                 if (xcs == dll->funhandle) {
 226                         fun = (SNOOP16_FUN*)entry;
 227                         ordinal = fun-dll->funs;
 228                         break;
 229                 }
 230                 dll=dll->next;
 231         }
 232         if (!dll) {
 233                 FIXME("entrypoint 0x%08lx not found\n",entry);
 234                 return; /* oops */
 235         }
 236         while (*rets) {
 237                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 238                         if (!(*rets)->entry[i].origreturn)
 239                                 break;
 240                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 241                         break;
 242                 rets = &((*rets)->next);
 243         }
 244         if (!*rets) {
 245                 HANDLE16 hand = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,WINE_LDT_FLAGS_CODE));
 246                 *rets = GlobalLock16(hand);
 247                 (*rets)->rethandle = hand;
 248                 i = 0;  /* entry 0 is free */
 249         }
 250         ret = &((*rets)->entry[i]);
 251         ret->lcall      = 0x9a;
 252         ret->snr        = MAKELONG(sizeof(SNOOP16_RELAY),xsnr);
 253         ret->origreturn = (FARPROC16)CALLER1REF;
 254         CALLER1REF      = MAKELONG((char*)&(ret->lcall)-(char*)((*rets)->entry),(*rets)->rethandle);
 255         ret->dll        = dll;
 256         ret->args       = NULL;
 257         ret->ordinal    = ordinal;
 258         ret->origSP     = LOWORD(context->Esp);
 259
 260         context->Eip= LOWORD(fun->origfun);
 261         context->SegCs = HIWORD(fun->origfun);
 262
 263
 264         DPRINTF("CALL %s.%ld: %s(",dll->name,ordinal,fun->name);
 265         if (fun->nrofargs>0) {
 266                 max = fun->nrofargs;
 267                 if (max>16) max=16;
 268                 for (i=max;i--;)
 269                         DPRINTF("%04x%s",*(WORD*)((char *) MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)) )+8+sizeof(WORD)*i),i?",":"");
 270                 if (max!=fun->nrofargs)
 271                         DPRINTF(" ...");
 272         } else if (fun->nrofargs<0) {
 273                 DPRINTF("<unknown, check return>");
 274                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(WORD));
 275                 memcpy(ret->args,(LPBYTE)((char *) MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)) )+8),sizeof(WORD)*16);
 276         }
 277         DPRINTF(") ret=%04x:%04x\n",HIWORD(ret->origreturn),LOWORD(ret->origreturn));
 278 }
 279
 280 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
 281         SNOOP16_RETURNENTRY     *ret = (SNOOP16_RETURNENTRY*)((char *) MapSL( MAKESEGPTR(context->SegCs,LOWORD(context->Eip)) )-5);
 282
 283         /* We haven't found out the nrofargs yet. If we called a cdecl
 284          * function it is too late anyway and we can just set '0' (which
 285          * will be the difference between orig and current SP
 286          * If pascal -> everything ok.
 287          */
 288         if (ret->dll->funs[ret->ordinal].nrofargs<0) {
 289                 ret->dll->funs[ret->ordinal].nrofargs=(LOWORD(context->Esp)-ret->origSP-4)/2;
 290         }
 291         context->Eip = LOWORD(ret->origreturn);
 292         context->SegCs  = HIWORD(ret->origreturn);
 293         if (ret->args) {
 294                 int     i,max;
 295
 296                 DPRINTF("RET  %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
 297                 max = ret->dll->funs[ret->ordinal].nrofargs;
 298                 if (max>16)
 299                         max=16;
 300                 if (max<0)
 301                         max=0;
 302
 303                 for (i=max;i--;)
 304                         DPRINTF("%04x%s",ret->args[i],i?",":"");
 305                 if (max!=ret->dll->funs[ret->ordinal].nrofargs)
 306                         DPRINTF(" ...");
 307                 DPRINTF(") retval = %04x:%04x ret=%04x:%04x\n",
 308                         DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
 309                 );
 310                 HeapFree(GetProcessHeap(),0,ret->args);
 311                 ret->args = NULL;
 312         } else
 313                 DPRINTF("RET  %s.%ld: %s() retval = %04x:%04x ret=%04x:%04x\n",
 314                         ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
 315                         DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
 316                 );
 317         ret->origreturn = NULL; /* mark as empty */
 318 }
 319 #else   /* !__i386__ */
 320 void SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
 321         if (!TRACE_ON(snoop)) return;
 322         FIXME("snooping works only on i386 for now.\n");
 323 }
 324
 325 FARPROC16 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
 326         return origfun;
 327 }
 328 #endif  /* !__i386__ */
 329