win32/kernel32.c

   1 /*
   2  * KERNEL32 thunks and other undocumented stuff
   3  *
   4  * Copyright 1997-1998 Marcus Meissner
   5  * Copyright 1998      Ulrich Weigand
   6  *
   7  */
   8
   9 #include <string.h>
  10
  11 #include "windef.h"
  12 #include "winbase.h"
  13 #include "wine/winbase16.h"
  14 #include "callback.h"
  15 #include "task.h"
  16 #include "user.h"
  17 #include "heap.h"
  18 #include "module.h"
  19 #include "neexe.h"
  20 #include "process.h"
  21 #include "stackframe.h"
  22 #include "heap.h"
  23 #include "selectors.h"
  24 #include "task.h"
  25 #include "file.h"
  26 #include "debugtools.h"
  27 #include "flatthunk.h"
  28 #include "syslevel.h"
  29 #include "winerror.h"
  30
  31 DECLARE_DEBUG_CHANNEL(dosmem)
  32 DECLARE_DEBUG_CHANNEL(thunk)
  33 DECLARE_DEBUG_CHANNEL(win32)
  34
  35
  36 /***********************************************************************
  37  *                                                                     *
  38  *                 Win95 internal thunks                               *
  39  *                                                                     *
  40  ***********************************************************************/
  41
  42 /***********************************************************************
  43  * Generates a FT_Prolog call.
  44  *
  45  *  0FB6D1                  movzbl edx,cl
  46  *  8B1495xxxxxxxx          mov edx,[4*edx + targetTable]
  47  *  68xxxxxxxx              push FT_Prolog
  48  *  C3                      lret
  49  */
  50 static void _write_ftprolog(LPBYTE relayCode ,DWORD *targetTable) {
  51         LPBYTE  x;
  52
  53         x       = relayCode;
  54         *x++    = 0x0f;*x++=0xb6;*x++=0xd1; /* movzbl edx,cl */
  55         *x++    = 0x8B;*x++=0x14;*x++=0x95;*(DWORD**)x= targetTable;
  56         x+=4;   /* mov edx, [4*edx + targetTable] */
  57         *x++    = 0x68; *(DWORD*)x = (DWORD)GetProcAddress(GetModuleHandleA("KERNEL32"),"FT_Prolog");
  58         x+=4;   /* push FT_Prolog */
  59         *x++    = 0xC3;         /* lret */
  60         /* fill rest with 0xCC / int 3 */
  61 }
  62
  63 /***********************************************************************
  64  *      _write_qtthunk                                  (internal)
  65  * Generates a QT_Thunk style call.
  66  *
  67  *  33C9                    xor ecx, ecx
  68  *  8A4DFC                  mov cl , [ebp-04]
  69  *  8B148Dxxxxxxxx          mov edx, [4*ecx + targetTable]
  70  *  B8yyyyyyyy              mov eax, QT_Thunk
  71  *  FFE0                    jmp eax
  72  */
  73 static void _write_qtthunk(
  74         LPBYTE relayCode,       /* [in] start of QT_Thunk stub */
  75         DWORD *targetTable      /* [in] start of thunk (for index lookup) */
  76 ) {
  77         LPBYTE  x;
  78
  79         x       = relayCode;
  80         *x++    = 0x33;*x++=0xC9; /* xor ecx,ecx */
  81         *x++    = 0x8A;*x++=0x4D;*x++=0xFC; /* movb cl,[ebp-04] */
  82         *x++    = 0x8B;*x++=0x14;*x++=0x8D;*(DWORD**)x= targetTable;
  83         x+=4;   /* mov edx, [4*ecx + targetTable */
  84         *x++    = 0xB8; *(DWORD*)x = (DWORD)GetProcAddress(GetModuleHandleA("KERNEL32"),"QT_Thunk");
  85         x+=4;   /* mov eax , QT_Thunk */
  86         *x++    = 0xFF; *x++ = 0xE0;    /* jmp eax */
  87         /* should fill the rest of the 32 bytes with 0xCC */
  88 }
  89
  90 /***********************************************************************
  91  *           _loadthunk
  92  */
  93 static LPVOID _loadthunk(LPCSTR module, LPCSTR func, LPCSTR module32,
  94                          struct ThunkDataCommon *TD32, DWORD checksum)
  95 {
  96     struct ThunkDataCommon *TD16;
  97     HMODULE hmod;
  98     int ordinal;
  99
 100     if ((hmod = LoadLibrary16(module)) <= 32)
 101     {
 102         ERR_(thunk)("(%s, %s, %s): Unable to load '%s', error %d\n",
 103                    module, func, module32, module, hmod);
 104         return 0;
 105     }
 106
 107     if (   !(ordinal = NE_GetOrdinal(hmod, func))
 108         || !(TD16 = PTR_SEG_TO_LIN(NE_GetEntryPointEx(hmod, ordinal, FALSE))))
 109     {
 110         ERR_(thunk)("(%s, %s, %s): Unable to find '%s'\n",
 111                    module, func, module32, func);
 112         return 0;
 113     }
 114
 115     if (TD32 && memcmp(TD16->magic, TD32->magic, 4))
 116     {
 117         ERR_(thunk)("(%s, %s, %s): Bad magic %c%c%c%c (should be %c%c%c%c)\n",
 118                    module, func, module32,
 119                    TD16->magic[0], TD16->magic[1], TD16->magic[2], TD16->magic[3],
 120                    TD32->magic[0], TD32->magic[1], TD32->magic[2], TD32->magic[3]);
 121         return 0;
 122     }
 123
 124     if (TD32 && TD16->checksum != TD32->checksum)
 125     {
 126         ERR_(thunk)("(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
 127                    module, func, module32, TD16->checksum, TD32->checksum);
 128         return 0;
 129     }
 130
 131     if (!TD32 && checksum && checksum != *(LPDWORD)TD16)
 132     {
 133         ERR_(thunk)("(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
 134                    module, func, module32, *(LPDWORD)TD16, checksum);
 135         return 0;
 136     }
 137
 138     return TD16;
 139 }
 140
 141 /***********************************************************************
 142  *           GetThunkStuff    (KERNEL32.53)
 143  */
 144 LPVOID WINAPI GetThunkStuff(LPSTR module, LPSTR func)
 145 {
 146     return _loadthunk(module, func, "<kernel>", NULL, 0L);
 147 }
 148
 149 /***********************************************************************
 150  *           GetThunkBuff    (KERNEL32.52)
 151  * Returns a pointer to ThkBuf in the 16bit library SYSTHUNK.DLL.
 152  */
 153 LPVOID WINAPI GetThunkBuff(void)
 154 {
 155     return GetThunkStuff("SYSTHUNK.DLL", "ThkBuf");
 156 }
 157
 158 /***********************************************************************
 159  *              ThunkConnect32          (KERNEL32)
 160  * Connects a 32bit and a 16bit thunkbuffer.
 161  */
 162 UINT WINAPI ThunkConnect32(
 163         struct ThunkDataCommon *TD,  /* [in/out] thunkbuffer */
 164         LPSTR thunkfun16,            /* [in] win16 thunkfunction */
 165         LPSTR module16,              /* [in] name of win16 dll */
 166         LPSTR module32,              /* [in] name of win32 dll */
 167         HMODULE hmod32,            /* [in] hmodule of win32 dll */
 168         DWORD dwReason               /* [in] initialisation argument */
 169 ) {
 170     BOOL directionSL;
 171
 172     if (!lstrncmpA(TD->magic, "SL01", 4))
 173     {
 174         directionSL = TRUE;
 175
 176         TRACE_(thunk)("SL01 thunk %s (%lx) <- %s (%s), Reason: %ld\n",
 177                      module32, (DWORD)TD, module16, thunkfun16, dwReason);
 178     }
 179     else if (!lstrncmpA(TD->magic, "LS01", 4))
 180     {
 181         directionSL = FALSE;
 182
 183         TRACE_(thunk)("LS01 thunk %s (%lx) -> %s (%s), Reason: %ld\n",
 184                      module32, (DWORD)TD, module16, thunkfun16, dwReason);
 185     }
 186     else
 187     {
 188         ERR_(thunk)("Invalid magic %c%c%c%c\n",
 189                    TD->magic[0], TD->magic[1], TD->magic[2], TD->magic[3]);
 190         return 0;
 191     }
 192
 193     switch (dwReason)
 194     {
 195         case DLL_PROCESS_ATTACH:
 196         {
 197             struct ThunkDataCommon *TD16;
 198             if (!(TD16 = _loadthunk(module16, thunkfun16, module32, TD, 0L)))
 199                 return 0;
 200
 201             if (directionSL)
 202             {
 203                 struct ThunkDataSL32 *SL32 = (struct ThunkDataSL32 *)TD;
 204                 struct ThunkDataSL16 *SL16 = (struct ThunkDataSL16 *)TD16;
 205                 struct SLTargetDB *tdb;
 206
 207                 if (SL16->fpData == NULL)
 208                 {
 209                     ERR_(thunk)("ThunkConnect16 was not called!\n");
 210                     return 0;
 211                 }
 212
 213                 SL32->data = SL16->fpData;
 214
 215                 tdb = HeapAlloc(GetProcessHeap(), 0, sizeof(*tdb));
 216                 tdb->process = PROCESS_Current();
 217                 tdb->targetTable = (DWORD *)(thunkfun16 + SL32->offsetTargetTable);
 218
 219                 tdb->next = SL32->data->targetDB;   /* FIXME: not thread-safe! */
 220                 SL32->data->targetDB = tdb;
 221
 222                 TRACE_(thunk)("Process %08lx allocated TargetDB entry for ThunkDataSL %08lx\n",
 223                              (DWORD)PROCESS_Current(), (DWORD)SL32->data);
 224             }
 225             else
 226             {
 227                 struct ThunkDataLS32 *LS32 = (struct ThunkDataLS32 *)TD;
 228                 struct ThunkDataLS16 *LS16 = (struct ThunkDataLS16 *)TD16;
 229
 230                 LS32->targetTable = PTR_SEG_TO_LIN(LS16->targetTable);
 231
 232                 /* write QT_Thunk and FT_Prolog stubs */
 233                 _write_qtthunk ((LPBYTE)TD + LS32->offsetQTThunk,  LS32->targetTable);
 234                 _write_ftprolog((LPBYTE)TD + LS32->offsetFTProlog, LS32->targetTable);
 235             }
 236             break;
 237         }
 238
 239         case DLL_PROCESS_DETACH:
 240             /* FIXME: cleanup */
 241             break;
 242     }
 243
 244     return 1;
 245 }
 246
 247 /**********************************************************************
 248  *              QT_Thunk                        (KERNEL32)
 249  *
 250  * The target address is in EDX.
 251  * The 16 bit arguments start at ESP+4.
 252  * The number of 16bit argumentbytes is EBP-ESP-0x44 (68 Byte thunksetup).
 253  * [ok]
 254  */
 255 REGS_ENTRYPOINT(QT_Thunk)
 256 {
 257     CONTEXT context16;
 258     DWORD argsize;
 259     THDB *thdb = THREAD_Current();
 260
 261     memcpy(&context16,context,sizeof(context16));
 262
 263     CS_reg(&context16)  = HIWORD(EDX_reg(context));
 264     IP_reg(&context16)  = LOWORD(EDX_reg(context));
 265     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 266                            + (WORD)&((STACK16FRAME*)0)->bp;
 267
 268     argsize = EBP_reg(context)-ESP_reg(context)-0x44;
 269
 270     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 271             (LPBYTE)ESP_reg(context)+4, argsize );
 272
 273     EAX_reg(context) = Callbacks->CallRegisterShortProc( &context16, argsize );
 274     EDX_reg(context) = HIWORD(EAX_reg(context));
 275     EAX_reg(context) = LOWORD(EAX_reg(context));
 276 }
 277
 278
 279 /**********************************************************************
 280  *              FT_Prolog                       (KERNEL32.233)
 281  *
 282  * The set of FT_... thunk routines is used instead of QT_Thunk,
 283  * if structures have to be converted from 32-bit to 16-bit
 284  * (change of member alignment, conversion of members).
 285  *
 286  * The thunk function (as created by the thunk compiler) calls
 287  * FT_Prolog at the beginning, to set up a stack frame and
 288  * allocate a 64 byte buffer on the stack.
 289  * The input parameters (target address and some flags) are
 290  * saved for later use by FT_Thunk.
 291  *
 292  * Input:  EDX  16-bit target address (SEGPTR)
 293  *         CX   bits  0..7   target number (in target table)
 294  *              bits  8..9   some flags (unclear???)
 295  *              bits 10..15  number of DWORD arguments
 296  *
 297  * Output: A new stackframe is created, and a 64 byte buffer
 298  *         allocated on the stack. The layout of the stack
 299  *         on return is as follows:
 300  *
 301  *  (ebp+4)  return address to caller of thunk function
 302  *  (ebp)    old EBP
 303  *  (ebp-4)  saved EBX register of caller
 304  *  (ebp-8)  saved ESI register of caller
 305  *  (ebp-12) saved EDI register of caller
 306  *  (ebp-16) saved ECX register, containing flags
 307  *  (ebp-20) bitmap containing parameters that are to be converted
 308  *           by FT_Thunk; it is initialized to 0 by FT_Prolog and
 309  *           filled in by the thunk code before calling FT_Thunk
 310  *  (ebp-24)
 311  *    ...    (unclear)
 312  *  (ebp-44)
 313  *  (ebp-48) saved EAX register of caller (unclear, never restored???)
 314  *  (ebp-52) saved EDX register, containing 16-bit thunk target
 315  *  (ebp-56)
 316  *    ...    (unclear)
 317  *  (ebp-64)
 318  *
 319  *  ESP is EBP-68 on return.
 320  *
 321  */
 322
 323 REGS_ENTRYPOINT(FT_Prolog)
 324 {
 325     /* Pop return address to thunk code */
 326     EIP_reg(context) = STACK32_POP(context);
 327
 328     /* Build stack frame */
 329     STACK32_PUSH(context, EBP_reg(context));
 330     EBP_reg(context) = ESP_reg(context);
 331
 332     /* Allocate 64-byte Thunk Buffer */
 333     ESP_reg(context) -= 64;
 334     memset((char *)ESP_reg(context), '\0', 64);
 335
 336     /* Store Flags (ECX) and Target Address (EDX) */
 337     /* Save other registers to be restored later */
 338     *(DWORD *)(EBP_reg(context) -  4) = EBX_reg(context);
 339     *(DWORD *)(EBP_reg(context) -  8) = ESI_reg(context);
 340     *(DWORD *)(EBP_reg(context) - 12) = EDI_reg(context);
 341     *(DWORD *)(EBP_reg(context) - 16) = ECX_reg(context);
 342
 343     *(DWORD *)(EBP_reg(context) - 48) = EAX_reg(context);
 344     *(DWORD *)(EBP_reg(context) - 52) = EDX_reg(context);
 345
 346     /* Push return address back onto stack */
 347     STACK32_PUSH(context, EIP_reg(context));
 348 }
 349
 350 /**********************************************************************
 351  *              FT_Thunk                        (KERNEL32.234)
 352  *
 353  * This routine performs the actual call to 16-bit code,
 354  * similar to QT_Thunk. The differences are:
 355  *  - The call target is taken from the buffer created by FT_Prolog
 356  *  - Those arguments requested by the thunk code (by setting the
 357  *    corresponding bit in the bitmap at EBP-20) are converted
 358  *    from 32-bit pointers to segmented pointers (those pointers
 359  *    are guaranteed to point to structures copied to the stack
 360  *    by the thunk code, so we always use the 16-bit stack selector
 361  *    for those addresses).
 362  *
 363  *    The bit #i of EBP-20 corresponds here to the DWORD starting at
 364  *    ESP+4 + 2*i.
 365  *
 366  * FIXME: It is unclear what happens if there are more than 32 WORDs
 367  *        of arguments, so that the single DWORD bitmap is no longer
 368  *        sufficient ...
 369  */
 370
 371 REGS_ENTRYPOINT(FT_Thunk)
 372 {
 373     DWORD mapESPrelative = *(DWORD *)(EBP_reg(context) - 20);
 374     DWORD callTarget     = *(DWORD *)(EBP_reg(context) - 52);
 375
 376     CONTEXT context16;
 377     DWORD i, argsize;
 378     LPBYTE newstack, oldstack;
 379     THDB *thdb = THREAD_Current();
 380
 381     memcpy(&context16,context,sizeof(context16));
 382
 383     CS_reg(&context16)  = HIWORD(callTarget);
 384     IP_reg(&context16)  = LOWORD(callTarget);
 385     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 386                            + (WORD)&((STACK16FRAME*)0)->bp;
 387
 388     argsize  = EBP_reg(context)-ESP_reg(context)-0x44;
 389     newstack = ((LPBYTE)THREAD_STACK16(thdb))-argsize;
 390     oldstack = (LPBYTE)ESP_reg(context)+4;
 391
 392     memcpy( newstack, oldstack, argsize );
 393
 394     for (i = 0; i < 32; i++)    /* NOTE: What about > 32 arguments? */
 395         if (mapESPrelative & (1 << i))
 396         {
 397             SEGPTR *arg = (SEGPTR *)(newstack + 2*i);
 398             *arg = PTR_SEG_OFF_TO_SEGPTR(SELECTOROF(thdb->cur_stack),
 399                                          OFFSETOF(thdb->cur_stack) - argsize
 400                                          + (*(LPBYTE *)arg - oldstack));
 401         }
 402
 403     EAX_reg(context) = Callbacks->CallRegisterShortProc( &context16, argsize );
 404     EDX_reg(context) = HIWORD(EAX_reg(context));
 405     EAX_reg(context) = LOWORD(EAX_reg(context));
 406 }
 407
 408 /**********************************************************************
 409  *              FT_ExitNN               (KERNEL32.218 - 232)
 410  *
 411  * One of the FT_ExitNN functions is called at the end of the thunk code.
 412  * It removes the stack frame created by FT_Prolog, moves the function
 413  * return from EBX to EAX (yes, FT_Thunk did use EAX for the return
 414  * value, but the thunk code has moved it from EAX to EBX in the
 415  * meantime ... :-), restores the caller's EBX, ESI, and EDI registers,
 416  * and perform a return to the CALLER of the thunk code (while removing
 417  * the given number of arguments from the caller's stack).
 418  */
 419
 420 static void FT_Exit(CONTEXT *context, int nPopArgs)
 421 {
 422     /* Return value is in EBX */
 423     EAX_reg(context) = EBX_reg(context);
 424
 425     /* Restore EBX, ESI, and EDI registers */
 426     EBX_reg(context) = *(DWORD *)(EBP_reg(context) -  4);
 427     ESI_reg(context) = *(DWORD *)(EBP_reg(context) -  8);
 428     EDI_reg(context) = *(DWORD *)(EBP_reg(context) - 12);
 429
 430     /* Clean up stack frame */
 431     ESP_reg(context) = EBP_reg(context);
 432     EBP_reg(context) = STACK32_POP(context);
 433
 434     /* Pop return address to CALLER of thunk code */
 435     EIP_reg(context) = STACK32_POP(context);
 436     /* Remove arguments */
 437     ESP_reg(context) += nPopArgs;
 438     /* Push return address back onto stack */
 439     STACK32_PUSH(context, EIP_reg(context));
 440 }
 441
 442 REGS_ENTRYPOINT(FT_Exit0)  { FT_Exit(context,  0); }
 443 REGS_ENTRYPOINT(FT_Exit4)  { FT_Exit(context,  4); }
 444 REGS_ENTRYPOINT(FT_Exit8)  { FT_Exit(context,  8); }
 445 REGS_ENTRYPOINT(FT_Exit12) { FT_Exit(context, 12); }
 446 REGS_ENTRYPOINT(FT_Exit16) { FT_Exit(context, 16); }
 447 REGS_ENTRYPOINT(FT_Exit20) { FT_Exit(context, 20); }
 448 REGS_ENTRYPOINT(FT_Exit24) { FT_Exit(context, 24); }
 449 REGS_ENTRYPOINT(FT_Exit28) { FT_Exit(context, 28); }
 450 REGS_ENTRYPOINT(FT_Exit32) { FT_Exit(context, 32); }
 451 REGS_ENTRYPOINT(FT_Exit36) { FT_Exit(context, 36); }
 452 REGS_ENTRYPOINT(FT_Exit40) { FT_Exit(context, 40); }
 453 REGS_ENTRYPOINT(FT_Exit44) { FT_Exit(context, 44); }
 454 REGS_ENTRYPOINT(FT_Exit48) { FT_Exit(context, 48); }
 455 REGS_ENTRYPOINT(FT_Exit52) { FT_Exit(context, 52); }
 456 REGS_ENTRYPOINT(FT_Exit56) { FT_Exit(context, 56); }
 457
 458
 459 /**********************************************************************
 460  *           WOWCallback16 (KERNEL32.62)(WOW32.2)
 461  * Calls a win16 function with a single DWORD argument.
 462  * RETURNS
 463  *      the return value
 464  */
 465 DWORD WINAPI WOWCallback16(
 466         FARPROC16 fproc,        /* [in] win16 function to call */
 467         DWORD arg               /* [in] single DWORD argument to function */
 468 ) {
 469         DWORD   ret;
 470         TRACE_(thunk)("(%p,0x%08lx)...\n",fproc,arg);
 471         ret =  Callbacks->CallWOWCallbackProc(fproc,arg);
 472         TRACE_(thunk)("... returns %ld\n",ret);
 473         return ret;
 474 }
 475
 476 /**********************************************************************
 477  *           WOWCallback16Ex (KERNEL32.55)(WOW32.3)
 478  * Calls a function in 16bit code.
 479  * RETURNS
 480  *      TRUE for success
 481  */
 482 BOOL WINAPI WOWCallback16Ex(
 483         FARPROC16 vpfn16,       /* [in] win16 function to call */
 484         DWORD dwFlags,          /* [in] flags */
 485         DWORD cbArgs,           /* [in] nr of arguments */
 486         LPVOID pArgs,           /* [in] pointer to arguments (LPDWORD) */
 487         LPDWORD pdwRetCode      /* [out] return value of win16 function */
 488 ) {
 489         return Callbacks->CallWOWCallback16Ex(vpfn16,dwFlags,cbArgs,pArgs,pdwRetCode);
 490 }
 491
 492 /***********************************************************************
 493  *              ThunkInitLS     (KERNEL32.43)
 494  * A thunkbuffer link routine
 495  * The thunkbuf looks like:
 496  *
 497  *      00: DWORD       length          ? don't know exactly
 498  *      04: SEGPTR      ptr             ? where does it point to?
 499  * The pointer ptr is written into the first DWORD of 'thunk'.
 500  * (probably correct implemented)
 501  * [ok probably]
 502  * RETURNS
 503  *      segmented pointer to thunk?
 504  */
 505 DWORD WINAPI ThunkInitLS(
 506         LPDWORD thunk,  /* [in] win32 thunk */
 507         LPCSTR thkbuf,  /* [in] thkbuffer name in win16 dll */
 508         DWORD len,      /* [in] thkbuffer length */
 509         LPCSTR dll16,   /* [in] name of win16 dll */
 510         LPCSTR dll32    /* [in] name of win32 dll (FIXME: not used?) */
 511 ) {
 512         LPDWORD         addr;
 513
 514         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 515                 return 0;
 516
 517         if (!addr[1])
 518                 return 0;
 519         *(DWORD*)thunk = addr[1];
 520
 521         return addr[1];
 522 }
 523
 524 /***********************************************************************
 525  *              Common32ThkLS   (KERNEL32.45)
 526  *
 527  * This is another 32->16 thunk, independent of the QT_Thunk/FT_Thunk
 528  * style thunks. The basic difference is that the parameter conversion
 529  * is done completely on the *16-bit* side here. Thus we do not call
 530  * the 16-bit target directly, but call a common entry point instead.
 531  * This entry function then calls the target according to the target
 532  * number passed in the DI register.
 533  *
 534  * Input:  EAX    SEGPTR to the common 16-bit entry point
 535  *         CX     offset in thunk table (target number * 4)
 536  *         DX     error return value if execution fails (unclear???)
 537  *         EDX.HI number of DWORD parameters
 538  *
 539  * (Note that we need to move the thunk table offset from CX to DI !)
 540  *
 541  * The called 16-bit stub expects its stack to look like this:
 542  *     ...
 543  *   (esp+40)  32-bit arguments
 544  *     ...
 545  *   (esp+8)   32 byte of stack space available as buffer
 546  *   (esp)     8 byte return address for use with 0x66 lret
 547  *
 548  * The called 16-bit stub uses a 0x66 lret to return to 32-bit code,
 549  * and uses the EAX register to return a DWORD return value.
 550  * Thus we need to use a special assembly glue routine
 551  * (CallRegisterLongProc instead of CallRegisterShortProc).
 552  *
 553  * Finally, we return to the caller, popping the arguments off
 554  * the stack.
 555  *
 556  * FIXME: The called function uses EBX to return the number of
 557  *        arguments that are to be popped off the caller's stack.
 558  *        This is clobbered by the assembly glue, so we simply use
 559  *        the original EDX.HI to get the number of arguments.
 560  *        (Those two values should be equal anyway ...?)
 561  *
 562  */
 563 REGS_ENTRYPOINT(Common32ThkLS)
 564 {
 565     CONTEXT context16;
 566     DWORD argsize;
 567     THDB *thdb = THREAD_Current();
 568
 569     memcpy(&context16,context,sizeof(context16));
 570
 571     DI_reg(&context16)  = CX_reg(context);
 572     CS_reg(&context16)  = HIWORD(EAX_reg(context));
 573     IP_reg(&context16)  = LOWORD(EAX_reg(context));
 574     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 575                            + (WORD)&((STACK16FRAME*)0)->bp;
 576
 577     argsize = HIWORD(EDX_reg(context)) * 4;
 578
 579     /* FIXME: hack for stupid USER32 CallbackGlueLS routine */
 580     if (EDX_reg(context) == EIP_reg(context))
 581         argsize = 6 * 4;
 582
 583     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 584             (LPBYTE)ESP_reg(context)+4, argsize );
 585
 586     EAX_reg(context) = Callbacks->CallRegisterLongProc(&context16, argsize + 32);
 587
 588     /* Clean up caller's stack frame */
 589
 590     EIP_reg(context) = STACK32_POP(context);
 591     ESP_reg(context) += argsize;
 592     STACK32_PUSH(context, EIP_reg(context));
 593 }
 594
 595 /***********************************************************************
 596  *              OT_32ThkLSF     (KERNEL32.40)
 597  *
 598  * YET Another 32->16 thunk. The difference to Common32ThkLS is that
 599  * argument processing is done on both the 32-bit and the 16-bit side:
 600  * The 32-bit side prepares arguments, copying them onto the stack.
 601  *
 602  * When this routine is called, the first word on the stack is the
 603  * number of argument bytes prepared by the 32-bit code, and EDX
 604  * contains the 16-bit target address.
 605  *
 606  * The called 16-bit routine is another relaycode, doing further
 607  * argument processing and then calling the real 16-bit target
 608  * whose address is stored at [bp-04].
 609  *
 610  * The call proceeds using a normal CallRegisterShortProc.
 611  * After return from the 16-bit relaycode, the arguments need
 612  * to be copied *back* to the 32-bit stack, since the 32-bit
 613  * relaycode processes output parameters.
 614  *
 615  * Note that we copy twice the number of arguments, since some of the
 616  * 16-bit relaycodes in SYSTHUNK.DLL directly access the original
 617  * arguments of the caller!
 618  *
 619  * (Note that this function seems only to be used for
 620  *  OLECLI32 -> OLECLI and OLESVR32 -> OLESVR thunking.)
 621  */
 622 REGS_ENTRYPOINT(OT_32ThkLSF)
 623 {
 624     CONTEXT context16;
 625     DWORD argsize;
 626     THDB *thdb = THREAD_Current();
 627
 628     memcpy(&context16,context,sizeof(context16));
 629
 630     CS_reg(&context16)  = HIWORD(EDX_reg(context));
 631     IP_reg(&context16)  = LOWORD(EDX_reg(context));
 632     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 633                            + (WORD)&((STACK16FRAME*)0)->bp;
 634
 635     argsize = 2 * *(WORD *)(ESP_reg(context) + 4) + 2;
 636
 637     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 638             (LPBYTE)ESP_reg(context)+4, argsize );
 639
 640     EAX_reg(context) = Callbacks->CallRegisterShortProc(&context16, argsize);
 641
 642     memcpy( (LPBYTE)ESP_reg(context)+4,
 643             ((LPBYTE)THREAD_STACK16(thdb))-argsize, argsize );
 644 }
 645
 646 /***********************************************************************
 647  *              ThunkInitLSF            (KERNEL32.41)
 648  * A thunk setup routine.
 649  * Expects a pointer to a preinitialized thunkbuffer in the first argument
 650  * looking like:
 651  *      00..03:         unknown (pointer, check _41, _43, _46)
 652  *      04: EB1E                jmp +0x20
 653  *
 654  *      06..23:         unknown (space for replacement code, check .90)
 655  *
 656  *      24:>E800000000          call offset 29
 657  *      29:>58                  pop eax            ( target of call )
 658  *      2A: 2D25000000          sub eax,0x00000025 ( now points to offset 4 )
 659  *      2F: BAxxxxxxxx          mov edx,xxxxxxxx
 660  *      34: 68yyyyyyyy          push KERNEL32.90
 661  *      39: C3                  ret
 662  *
 663  *      3A: EB1E                jmp +0x20
 664  *      3E ... 59:      unknown (space for replacement code?)
 665  *      5A: E8xxxxxxxx          call <32bitoffset xxxxxxxx>
 666  *      5F: 5A                  pop edx
 667  *      60: 81EA25xxxxxx        sub edx, 0x25xxxxxx
 668  *      66: 52                  push edx
 669  *      67: 68xxxxxxxx          push xxxxxxxx
 670  *      6C: 68yyyyyyyy          push KERNEL32.89
 671  *      71: C3                  ret
 672  *      72: end?
 673  * This function checks if the code is there, and replaces the yyyyyyyy entries
 674  * by the functionpointers.
 675  * The thunkbuf looks like:
 676  *
 677  *      00: DWORD       length          ? don't know exactly
 678  *      04: SEGPTR      ptr             ? where does it point to?
 679  * The segpointer ptr is written into the first DWORD of 'thunk'.
 680  * [ok probably]
 681  * RETURNS
 682  *      unclear, pointer to win16 thkbuffer?
 683  */
 684 LPVOID WINAPI ThunkInitLSF(
 685         LPBYTE thunk,   /* [in] win32 thunk */
 686         LPCSTR thkbuf,  /* [in] thkbuffer name in win16 dll */
 687         DWORD len,      /* [in] length of thkbuffer */
 688         LPCSTR dll16,   /* [in] name of win16 dll */
 689         LPCSTR dll32    /* [in] name of win32 dll */
 690 ) {
 691         HMODULE hkrnl32 = GetModuleHandleA("KERNEL32");
 692         LPDWORD         addr,addr2;
 693
 694         /* FIXME: add checks for valid code ... */
 695         /* write pointers to kernel32.89 and kernel32.90 (+ordinal base of 1) */
 696         *(DWORD*)(thunk+0x35) = (DWORD)GetProcAddress(hkrnl32,(LPSTR)90);
 697         *(DWORD*)(thunk+0x6D) = (DWORD)GetProcAddress(hkrnl32,(LPSTR)89);
 698
 699
 700         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 701                 return 0;
 702
 703         addr2 = PTR_SEG_TO_LIN(addr[1]);
 704         if (HIWORD(addr2))
 705                 *(DWORD*)thunk = (DWORD)addr2;
 706
 707         return addr2;
 708 }
 709
 710 /***********************************************************************
 711  *              FT_PrologPrime                  (KERNEL32.89)
 712  *
 713  * This function is called from the relay code installed by
 714  * ThunkInitLSF. It replaces the location from where it was
 715  * called by a standard FT_Prolog call stub (which is 'primed'
 716  * by inserting the correct target table pointer).
 717  * Finally, it calls that stub.
 718  *
 719  * Input:  ECX    target number + flags (passed through to FT_Prolog)
 720  *        (ESP)   offset of location where target table pointer
 721  *                is stored, relative to the start of the relay code
 722  *        (ESP+4) pointer to start of relay code
 723  *                (this is where the FT_Prolog call stub gets written to)
 724  *
 725  * Note: The two DWORD arguments get popped from the stack.
 726  *
 727  */
 728 REGS_ENTRYPOINT(FT_PrologPrime)
 729 {
 730     DWORD  targetTableOffset = STACK32_POP(context);
 731     LPBYTE relayCode = (LPBYTE)STACK32_POP(context);
 732     DWORD *targetTable = *(DWORD **)(relayCode+targetTableOffset);
 733     DWORD  targetNr = LOBYTE(ECX_reg(context));
 734
 735     _write_ftprolog(relayCode, targetTable);
 736
 737     /* We should actually call the relay code now, */
 738     /* but we skip it and go directly to FT_Prolog */
 739     EDX_reg(context) = targetTable[targetNr];
 740     __regs_FT_Prolog(context);
 741 }
 742
 743 /***********************************************************************
 744  *              QT_ThunkPrime                   (KERNEL32.90)
 745  *
 746  * This function corresponds to FT_PrologPrime, but installs a
 747  * call stub for QT_Thunk instead.
 748  *
 749  * Input: (EBP-4) target number (passed through to QT_Thunk)
 750  *         EDX    target table pointer location offset
 751  *         EAX    start of relay code
 752  *
 753  */
 754 REGS_ENTRYPOINT(QT_ThunkPrime)
 755 {
 756     DWORD  targetTableOffset = EDX_reg(context);
 757     LPBYTE relayCode = (LPBYTE)EAX_reg(context);
 758     DWORD *targetTable = *(DWORD **)(relayCode+targetTableOffset);
 759     DWORD  targetNr = LOBYTE(*(DWORD *)(EBP_reg(context) - 4));
 760
 761     _write_qtthunk(relayCode, targetTable);
 762
 763     /* We should actually call the relay code now, */
 764     /* but we skip it and go directly to QT_Thunk */
 765     EDX_reg(context) = targetTable[targetNr];
 766     __regs_QT_Thunk(context);
 767 }
 768
 769 /***********************************************************************
 770  *                                                      (KERNEL32.46)
 771  * Another thunkbuf link routine.
 772  * The start of the thunkbuf looks like this:
 773  *      00: DWORD       length
 774  *      04: SEGPTR      address for thunkbuffer pointer
 775  * [ok probably]
 776  */
 777 VOID WINAPI ThunkInitSL(
 778         LPBYTE thunk,           /* [in] start of thunkbuffer */
 779         LPCSTR thkbuf,          /* [in] name/ordinal of thunkbuffer in win16 dll */
 780         DWORD len,              /* [in] length of thunkbuffer */
 781         LPCSTR dll16,           /* [in] name of win16 dll containing the thkbuf */
 782         LPCSTR dll32            /* [in] win32 dll. FIXME: strange, unused */
 783 ) {
 784         LPDWORD         addr;
 785
 786         if (!(addr = _loadthunk( dll16, thkbuf, dll32, NULL, len )))
 787                 return;
 788
 789         *(DWORD*)PTR_SEG_TO_LIN(addr[1]) = (DWORD)thunk;
 790 }
 791
 792 /**********************************************************************
 793  *           SSInit             KERNEL.700
 794  * RETURNS
 795  *      TRUE for success.
 796  */
 797 BOOL WINAPI SSInit16()
 798 {
 799     return TRUE;
 800 }
 801
 802 /**********************************************************************
 803  *           SSOnBigStack       KERNEL32.87
 804  * Check if thunking is initialized (ss selector set up etc.)
 805  * We do that differently, so just return TRUE.
 806  * [ok]
 807  * RETURNS
 808  *      TRUE for success.
 809  */
 810 BOOL WINAPI SSOnBigStack()
 811 {
 812     TRACE_(thunk)("Yes, thunking is initialized\n");
 813     return TRUE;
 814 }
 815
 816 /**********************************************************************
 817  *           SSCall
 818  * One of the real thunking functions. This one seems to be for 32<->32
 819  * thunks. It should probably be capable of crossing processboundaries.
 820  *
 821  * And YES, I've seen nr=48 (somewhere in the Win95 32<->16 OLE coupling)
 822  * [ok]
 823  */
 824 DWORD WINAPIV SSCall(
 825         DWORD nr,       /* [in] number of argument bytes */
 826         DWORD flags,    /* [in] FIXME: flags ? */
 827         FARPROC fun,    /* [in] function to call */
 828         ...             /* [in/out] arguments */
 829 ) {
 830     DWORD i,ret;
 831     DWORD *args = ((DWORD *)&fun) + 1;
 832
 833     if(TRACE_ON(thunk)){
 834       dbg_decl_str(thunk, 256);
 835       for (i=0;i<nr/4;i++)
 836         dsprintf(thunk,"0x%08lx,",args[i]);
 837       TRACE_(thunk)("(%ld,0x%08lx,%p,[%s])\n",
 838                     nr,flags,fun,dbg_str(thunk));
 839     }
 840     switch (nr) {
 841     case 0:     ret = fun();
 842                 break;
 843     case 4:     ret = fun(args[0]);
 844                 break;
 845     case 8:     ret = fun(args[0],args[1]);
 846                 break;
 847     case 12:    ret = fun(args[0],args[1],args[2]);
 848                 break;
 849     case 16:    ret = fun(args[0],args[1],args[2],args[3]);
 850                 break;
 851     case 20:    ret = fun(args[0],args[1],args[2],args[3],args[4]);
 852                 break;
 853     case 24:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5]);
 854                 break;
 855     case 28:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6]);
 856                 break;
 857     case 32:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7]);
 858                 break;
 859     case 36:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8]);
 860                 break;
 861     case 40:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9]);
 862                 break;
 863     case 44:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9],args[10]);
 864                 break;
 865     case 48:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9],args[10],args[11]);
 866                 break;
 867     default:
 868         WARN_(thunk)("Unsupported nr of arguments, %ld\n",nr);
 869         ret = 0;
 870         break;
 871
 872     }
 873     TRACE_(thunk)(" returning %ld ...\n",ret);
 874     return ret;
 875 }
 876
 877 /**********************************************************************
 878  *           W32S_BackTo32                      (KERNEL32.51)
 879  */
 880 REGS_ENTRYPOINT(W32S_BackTo32)
 881 {
 882     LPDWORD stack = (LPDWORD)ESP_reg( context );
 883     FARPROC proc = (FARPROC) stack[0];
 884
 885     EAX_reg( context ) = proc( stack[2], stack[3], stack[4], stack[5], stack[6],
 886                                stack[7], stack[8], stack[9], stack[10], stack[11] );
 887
 888     EIP_reg( context ) = stack[1];
 889 }
 890
 891 /**********************************************************************
 892  *                      AllocSLCallback         (KERNEL32)
 893  *
 894  * Win95 uses some structchains for callbacks. It allocates them
 895  * in blocks of 100 entries, size 32 bytes each, layout:
 896  * blockstart:
 897  *      0:      PTR     nextblockstart
 898  *      4:      entry   *first;
 899  *      8:      WORD    sel ( start points to blockstart)
 900  *      A:      WORD    unknown
 901  * 100xentry:
 902  *      00..17:         Code
 903  *      18:     PDB     *owning_process;
 904  *      1C:     PTR     blockstart
 905  *
 906  * We ignore this for now. (Just a note for further developers)
 907  * FIXME: use this method, so we don't waste selectors...
 908  *
 909  * Following code is then generated by AllocSLCallback. The code is 16 bit, so
 910  * the 0x66 prefix switches from word->long registers.
 911  *
 912  *      665A            pop     edx
 913  *      6668x arg2 x    pushl   <arg2>
 914  *      6652            push    edx
 915  *      EAx arg1 x      jmpf    <arg1>
 916  *
 917  * returns the startaddress of this thunk.
 918  *
 919  * Note, that they look very similair to the ones allocates by THUNK_Alloc.
 920  * RETURNS
 921  *      segmented pointer to the start of the thunk
 922  */
 923 DWORD WINAPI
 924 AllocSLCallback(
 925         DWORD finalizer,        /* [in] finalizer function */
 926         DWORD callback          /* [in] callback function */
 927 ) {
 928         LPBYTE  x,thunk = HeapAlloc( GetProcessHeap(), 0, 32 );
 929         WORD    sel;
 930
 931         x=thunk;
 932         *x++=0x66;*x++=0x5a;                            /* popl edx */
 933         *x++=0x66;*x++=0x68;*(DWORD*)x=finalizer;x+=4;  /* pushl finalizer */
 934         *x++=0x66;*x++=0x52;                            /* pushl edx */
 935         *x++=0xea;*(DWORD*)x=callback;x+=4;             /* jmpf callback */
 936
 937         *(PDB**)(thunk+18) = PROCESS_Current();
 938
 939         sel = SELECTOR_AllocBlock( thunk , 32, SEGMENT_CODE, FALSE, FALSE );
 940         return (sel<<16)|0;
 941 }
 942
 943 /**********************************************************************
 944  *              FreeSLCallback          (KERNEL32.274)
 945  * Frees the specified 16->32 callback
 946  */
 947 void WINAPI
 948 FreeSLCallback(
 949         DWORD x /* [in] 16 bit callback (segmented pointer?) */
 950 ) {
 951         FIXME_(win32)("(0x%08lx): stub\n",x);
 952 }
 953
 954
 955 /**********************************************************************
 956  *              GetTEBSelectorFS        (KERNEL.475)
 957  *      Set the 16-bit %fs to the 32-bit %fs (current TEB selector)
 958  */
 959 VOID WINAPI GetTEBSelectorFS16( CONTEXT *context )
 960 {
 961     GET_FS( FS_reg(context) );
 962 }
 963
 964 /**********************************************************************
 965  *              KERNEL_431              (KERNEL.431)
 966  *              IsPeFormat              (W32SYS.2)
 967  * Checks the passed filename if it is a PE format executeable
 968  * RETURNS
 969  *  TRUE, if it is.
 970  *  FALSE if not.
 971  */
 972 BOOL16 WINAPI IsPeFormat16(
 973         LPSTR   fn,     /* [in] filename to executeable */
 974         HFILE16 hf16    /* [in] open file, if filename is NULL */
 975 ) {
 976         IMAGE_DOS_HEADER        mzh;
 977         HFILE                 hf=FILE_GetHandle(hf16);
 978         OFSTRUCT                ofs;
 979         DWORD                   xmagic;
 980
 981         if (fn) {
 982                 hf = OpenFile(fn,&ofs,OF_READ);
 983                 if (hf==HFILE_ERROR)
 984                         return FALSE;
 985         }
 986         _llseek(hf,0,SEEK_SET);
 987         if (sizeof(mzh)!=_lread(hf,&mzh,sizeof(mzh))) {
 988                 _lclose(hf);
 989                 return FALSE;
 990         }
 991         if (mzh.e_magic!=IMAGE_DOS_SIGNATURE) {
 992                 WARN_(dosmem)("File has not got dos signature!\n");
 993                 _lclose(hf);
 994                 return FALSE;
 995         }
 996         _llseek(hf,mzh.e_lfanew,SEEK_SET);
 997         if (sizeof(DWORD)!=_lread(hf,&xmagic,sizeof(DWORD))) {
 998                 _lclose(hf);
 999                 return FALSE;
1000         }
1001         _lclose(hf);
1002         return (xmagic == IMAGE_NT_SIGNATURE);
1003 }
1004
1005 /***********************************************************************
1006  *           WOWHandle32                        (KERNEL32.57)(WOW32.16)
1007  * Converts a win16 handle of type into the respective win32 handle.
1008  * We currently just return this handle, since most handles are the same
1009  * for win16 and win32.
1010  * RETURNS
1011  *      The new handle
1012  */
1013 HANDLE WINAPI WOWHandle32(
1014         WORD handle,            /* [in] win16 handle */
1015         WOW_HANDLE_TYPE type    /* [in] handle type */
1016 ) {
1017         TRACE_(win32)("(0x%04x,%d)\n",handle,type);
1018         return (HANDLE)handle;
1019 }
1020
1021 /***********************************************************************
1022  *           K32Thk1632Prolog                   (KERNEL32.492)
1023  */
1024 REGS_ENTRYPOINT(K32Thk1632Prolog)
1025 {
1026    LPBYTE code = (LPBYTE)EIP_reg(context) - 5;
1027
1028    /* Arrrgh! SYSTHUNK.DLL just has to re-implement another method
1029       of 16->32 thunks instead of using one of the standard methods!
1030       This means that SYSTHUNK.DLL itself switches to a 32-bit stack,
1031       and does a far call to the 32-bit code segment of OLECLI32/OLESVR32.
1032       Unfortunately, our CallTo/CallFrom mechanism is therefore completely
1033       bypassed, which means it will crash the next time the 32-bit OLE
1034       code thunks down again to 16-bit (this *will* happen!).
1035
1036       The following hack tries to recognize this situation.
1037       This is possible since the called stubs in OLECLI32/OLESVR32 all
1038       look exactly the same:
1039         00   E8xxxxxxxx    call K32Thk1632Prolog
1040         05   FF55FC        call [ebp-04]
1041         08   E8xxxxxxxx    call K32Thk1632Epilog
1042         0D   66CB          retf
1043
1044       If we recognize this situation, we try to simulate the actions
1045       of our CallTo/CallFrom mechanism by copying the 16-bit stack
1046       to our 32-bit stack, creating a proper STACK16FRAME and
1047       updating thdb->cur_stack. */
1048
1049    if (   code[5] == 0xFF && code[6] == 0x55 && code[7] == 0xFC
1050        && code[13] == 0x66 && code[14] == 0xCB)
1051    {
1052       WORD  stackSel  = NtCurrentTeb()->stack_sel;
1053       DWORD stackBase = GetSelectorBase(stackSel);
1054
1055       THDB *thdb = THREAD_Current();
1056       DWORD argSize = EBP_reg(context) - ESP_reg(context);
1057       char *stack16 = (char *)ESP_reg(context);
1058       char *stack32 = (char *)thdb->cur_stack - argSize;
1059       STACK16FRAME *frame16 = (STACK16FRAME *)stack16 - 1;
1060
1061       TRACE_(thunk)("before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1062                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1063
1064       memset(frame16, '\0', sizeof(STACK16FRAME));
1065       frame16->frame32 = (STACK32FRAME *)thdb->cur_stack;
1066       frame16->ebp = EBP_reg(context);
1067
1068       memcpy(stack32, stack16, argSize);
1069       thdb->cur_stack = PTR_SEG_OFF_TO_SEGPTR(stackSel, (DWORD)frame16 - stackBase);
1070
1071       ESP_reg(context) = (DWORD)stack32;
1072       EBP_reg(context) = ESP_reg(context) + argSize;
1073
1074       TRACE_(thunk)("after  SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1075                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1076    }
1077
1078    SYSLEVEL_ReleaseWin16Lock();
1079 }
1080
1081 /***********************************************************************
1082  *           K32Thk1632Epilog                   (KERNEL32.491)
1083  */
1084 REGS_ENTRYPOINT(K32Thk1632Epilog)
1085 {
1086    LPBYTE code = (LPBYTE)EIP_reg(context) - 13;
1087
1088    SYSLEVEL_RestoreWin16Lock();
1089
1090    /* We undo the SYSTHUNK hack if necessary. See K32Thk1632Prolog. */
1091
1092    if (   code[5] == 0xFF && code[6] == 0x55 && code[7] == 0xFC
1093        && code[13] == 0x66 && code[14] == 0xCB)
1094    {
1095       THDB *thdb = THREAD_Current();
1096       STACK16FRAME *frame16 = (STACK16FRAME *)PTR_SEG_TO_LIN(thdb->cur_stack);
1097       char *stack16 = (char *)(frame16 + 1);
1098       DWORD argSize = frame16->ebp - (DWORD)stack16;
1099       char *stack32 = (char *)frame16->frame32 - argSize;
1100
1101       DWORD nArgsPopped = ESP_reg(context) - (DWORD)stack32;
1102
1103       TRACE_(thunk)("before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1104                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1105
1106       thdb->cur_stack = (DWORD)frame16->frame32;
1107
1108       ESP_reg(context) = (DWORD)stack16 + nArgsPopped;
1109       EBP_reg(context) = frame16->ebp;
1110
1111       TRACE_(thunk)("after  SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1112                    EBP_reg(context), ESP_reg(context), thdb->cur_stack);
1113    }
1114 }
1115
1116 /***********************************************************************
1117  *           UpdateResource32A                 (KERNEL32.707)
1118  */
1119 BOOL WINAPI UpdateResourceA(
1120   HANDLE  hUpdate,
1121   LPCSTR  lpType,
1122   LPCSTR  lpName,
1123   WORD    wLanguage,
1124   LPVOID  lpData,
1125   DWORD   cbData) {
1126
1127   FIXME_(win32)(": stub\n");
1128   SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
1129   return FALSE;
1130 }
1131
1132 /***********************************************************************
1133  *           UpdateResource32W                 (KERNEL32.708)
1134  */
1135 BOOL WINAPI UpdateResourceW(
1136   HANDLE  hUpdate,
1137   LPCWSTR lpType,
1138   LPCWSTR lpName,
1139   WORD    wLanguage,
1140   LPVOID  lpData,
1141   DWORD   cbData) {
1142
1143   FIXME_(win32)(": stub\n");
1144   SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
1145   return FALSE;
1146 }
1147
1148
1149 /***********************************************************************
1150  *           WaitNamedPipe32A                 [KERNEL32.725]
1151  */
1152 BOOL WINAPI WaitNamedPipeA (LPCSTR lpNamedPipeName, DWORD nTimeOut)
1153 {       FIXME_(win32)("%s 0x%08lx\n",lpNamedPipeName,nTimeOut);
1154         SetLastError(ERROR_PIPE_NOT_CONNECTED);
1155         return FALSE;
1156 }
1157 /***********************************************************************
1158  *           WaitNamedPipe32W                 [KERNEL32.726]
1159  */
1160 BOOL WINAPI WaitNamedPipeW (LPCWSTR lpNamedPipeName, DWORD nTimeOut)
1161 {       FIXME_(win32)("%s 0x%08lx\n",debugstr_w(lpNamedPipeName),nTimeOut);
1162         SetLastError(ERROR_PIPE_NOT_CONNECTED);
1163         return FALSE;
1164 }
1165
1166 /*********************************************************************
1167  *                   PK16FNF [KERNEL32.91]
1168  *
1169  *  This routine fills in the supplied 13-byte (8.3 plus terminator)
1170  *  string buffer with the 8.3 filename of a recently loaded 16-bit
1171  *  module.  It is unknown exactly what modules trigger this
1172  *  mechanism or what purpose this serves.  Win98 Explorer (and
1173  *  probably also Win95 with IE 4 shell integration) calls this
1174  *  several times during initialization.
1175  *
1176  *  FIXME: find out what this really does and make it work.
1177  */
1178 void WINAPI PK16FNF(LPSTR strPtr)
1179 {
1180        FIXME_(win32)("(%p): stub\n", strPtr);
1181
1182        /* fill in a fake filename that'll be easy to recognize */
1183        lstrcpyA(strPtr, "WINESTUB.FIX");
1184 }