Removed winmm from import list.
[wine/multimedia.git] / relay32 / snoop.c
blob4c92fcfacadd7fb43f026c7b5d786e5ff2fca2ee
1 /*
2 * 386-specific Win32 dll<->dll snooping functions
4 * Copyright 1998 Marcus Meissner
5 */
7 #include "config.h"
9 #include <assert.h>
10 #include <stdio.h>
11 #include <string.h>
12 #include "winbase.h"
13 #include "wingdi.h"
14 #include "winuser.h"
15 #include "winnt.h"
16 #include "heap.h"
17 #include "builtin32.h"
18 #include "snoop.h"
19 #include "neexe.h"
20 #include "selectors.h"
21 #include "stackframe.h"
22 #include "debugtools.h"
24 DEFAULT_DEBUG_CHANNEL(snoop);
26 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
28 #ifdef __i386__
30 extern void WINAPI SNOOP_Entry();
31 extern void WINAPI SNOOP_Return();
33 #ifdef NEED_UNDERSCORE_PREFIX
34 # define PREFIX "_"
35 #else
36 # define PREFIX
37 #endif
39 #include "pshpack1.h"
41 typedef struct tagSNOOP_FUN {
42 /* code part */
43 BYTE lcall; /* 0xe8 call snoopentry (relative) */
44 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
45 * calculation!
47 DWORD snoopentry; /* SNOOP_Entry relative */
48 /* unreached */
49 int nrofargs;
50 FARPROC origfun;
51 char *name;
52 } SNOOP_FUN;
54 typedef struct tagSNOOP_DLL {
55 HMODULE hmod;
56 SNOOP_FUN *funs;
57 LPCSTR name;
58 int nrofordinals;
59 struct tagSNOOP_DLL *next;
60 } SNOOP_DLL;
61 typedef struct tagSNOOP_RETURNENTRY {
62 /* code part */
63 BYTE lcall; /* 0xe8 call snoopret relative*/
64 /* NOTE: If you move snoopret OR origreturn fix the relative offset
65 * calculation!
67 DWORD snoopret; /* SNOOP_Ret relative */
68 /* unreached */
69 FARPROC origreturn;
70 SNOOP_DLL *dll;
71 DWORD ordinal;
72 DWORD origESP;
73 DWORD *args; /* saved args across a stdcall */
74 } SNOOP_RETURNENTRY;
76 typedef struct tagSNOOP_RETURNENTRIES {
77 SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
78 struct tagSNOOP_RETURNENTRIES *next;
79 } SNOOP_RETURNENTRIES;
81 #include "poppack.h"
83 static SNOOP_DLL *firstdll = NULL;
84 static SNOOP_RETURNENTRIES *firstrets = NULL;
86 /***********************************************************************
87 * SNOOP_ShowDebugmsgSnoop
89 * Simple function to decide if a particular debugging message is
90 * wanted.
92 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
94 if(debug_snoop_excludelist || debug_snoop_includelist) {
95 char **listitem;
96 char buf[80];
97 int len, len2, itemlen, show;
99 if(debug_snoop_excludelist) {
100 show = 1;
101 listitem = debug_snoop_excludelist;
102 } else {
103 show = 0;
104 listitem = debug_snoop_includelist;
106 len = strlen(dll);
107 assert(len < 64);
108 sprintf(buf, "%s.%d", dll, ord);
109 len2 = strlen(buf);
110 for(; *listitem; listitem++) {
111 itemlen = strlen(*listitem);
112 if((itemlen == len && !strncmp(*listitem, buf, len)) ||
113 (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
114 !strcmp(*listitem, fname)) {
115 show = !show;
116 break;
119 return show;
121 return 1;
124 void
125 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
126 SNOOP_DLL **dll = &(firstdll);
127 char *s;
129 if (!TRACE_ON(snoop)) return;
130 while (*dll) {
131 if ((*dll)->hmod == hmod)
132 return; /* already registered */
133 dll = &((*dll)->next);
135 *dll = (SNOOP_DLL*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
136 (*dll)->next = NULL;
137 (*dll)->hmod = hmod;
138 (*dll)->nrofordinals = nrofordinals;
139 (*dll)->name = HEAP_strdupA(GetProcessHeap(),0,name);
140 if ((s=strrchr((*dll)->name,'.')))
141 *s='\0';
142 (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
143 memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
144 if (!(*dll)->funs) {
145 HeapFree(GetProcessHeap(),0,*dll);
146 FIXME("out of memory\n");
147 return;
151 FARPROC
152 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
153 SNOOP_DLL *dll = firstdll;
154 SNOOP_FUN *fun;
155 int j;
156 IMAGE_SECTION_HEADER *pe_seg = PE_SECTIONS(hmod);
158 if (!TRACE_ON(snoop)) return origfun;
159 if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
160 return origfun;
161 for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
162 /* 0x42 is special ELF loader tag */
163 if ((pe_seg[j].VirtualAddress==0x42) ||
164 (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
165 ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
166 pe_seg[j].SizeOfRawData
169 break;
170 /* If we looked through all sections (and didn't find one)
171 * or if the sectionname contains "data", we return the
172 * original function since it is most likely a datareference.
174 if ( (j==PE_HEADER(hmod)->FileHeader.NumberOfSections) ||
175 (strstr(pe_seg[j].Name,"data")) ||
176 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
178 return origfun;
180 while (dll) {
181 if (hmod == dll->hmod)
182 break;
183 dll=dll->next;
185 if (!dll) /* probably internal */
186 return origfun;
187 if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
188 return origfun;
189 assert(ordinal<dll->nrofordinals);
190 fun = dll->funs+ordinal;
191 if (!fun->name) fun->name = HEAP_strdupA(GetProcessHeap(),0,name);
192 fun->lcall = 0xe8;
193 /* NOTE: origreturn struct member MUST come directly after snoopentry */
194 fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
195 fun->origfun = origfun;
196 fun->nrofargs = -1;
197 return (FARPROC)&(fun->lcall);
200 static char*
201 SNOOP_PrintArg(DWORD x) {
202 static char buf[200];
203 int i,nostring;
204 MEMORY_BASIC_INFORMATION mbi;
206 if ( !HIWORD(x) ||
207 !VirtualQuery((LPVOID)x,&mbi,sizeof(mbi)) ||
208 !mbi.Type
210 sprintf(buf,"%08lx",x);
211 return buf;
213 if (!IsBadStringPtrA((LPSTR)x,80)) {
214 LPBYTE s=(LPBYTE)x;
215 i=0;nostring=0;
216 while (i<80) {
217 if (s[i]==0) break;
218 if (s[i]<0x20) {nostring=1;break;}
219 if (s[i]>=0x80) {nostring=1;break;}
220 i++;
222 if (!nostring) {
223 if (i>5) {
224 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
225 return buf;
229 if (!IsBadStringPtrW((LPWSTR)x,80)) {
230 LPWSTR s=(LPWSTR)x;
231 i=0;nostring=0;
232 while (i<80) {
233 if (s[i]==0) break;
234 if (s[i]<0x20) {nostring=1;break;}
235 if (s[i]>0x100) {nostring=1;break;}
236 i++;
238 if (!nostring) {
239 if (i>5) {
240 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
241 return buf;
245 sprintf(buf,"%08lx",x);
246 return buf;
249 #define CALLER1REF (*(DWORD*)ESP_reg(context))
251 void WINAPI SNOOP_DoEntry( CONTEXT86 *context );
252 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Entry, SNOOP_DoEntry );
253 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
255 DWORD ordinal=0,entry = EIP_reg(context)-5;
256 SNOOP_DLL *dll = firstdll;
257 SNOOP_FUN *fun = NULL;
258 SNOOP_RETURNENTRIES **rets = &firstrets;
259 SNOOP_RETURNENTRY *ret;
260 int i,max;
262 while (dll) {
263 if ( ((char*)entry>=(char*)dll->funs) &&
264 ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
266 fun = (SNOOP_FUN*)entry;
267 ordinal = fun-dll->funs;
268 break;
270 dll=dll->next;
272 if (!dll) {
273 FIXME("entrypoint 0x%08lx not found\n",entry);
274 return; /* oops */
276 /* guess cdecl ... */
277 if (fun->nrofargs<0) {
278 /* Typical cdecl return frame is:
279 * add esp, xxxxxxxx
280 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
281 * (after that 81 C2 xx xx xx xx)
283 LPBYTE reteip = (LPBYTE)CALLER1REF;
285 if (reteip) {
286 if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
287 fun->nrofargs=reteip[2]/4;
292 while (*rets) {
293 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
294 if (!(*rets)->entry[i].origreturn)
295 break;
296 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
297 break;
298 rets = &((*rets)->next);
300 if (!*rets) {
301 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
302 memset(*rets,0,4096);
303 i = 0; /* entry 0 is free */
305 ret = &((*rets)->entry[i]);
306 ret->lcall = 0xe8;
307 /* NOTE: origreturn struct member MUST come directly after snoopret */
308 ret->snoopret = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
309 ret->origreturn = (FARPROC)CALLER1REF;
310 CALLER1REF = (DWORD)&ret->lcall;
311 ret->dll = dll;
312 ret->args = NULL;
313 ret->ordinal = ordinal;
314 ret->origESP = ESP_reg(context);
316 EIP_reg(context)= (DWORD)fun->origfun;
318 DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
319 if (fun->nrofargs>0) {
320 max = fun->nrofargs; if (max>16) max=16;
321 for (i=0;i<max;i++)
322 DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(ESP_reg(context)+4+sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
323 if (max!=fun->nrofargs)
324 DPRINTF(" ...");
325 } else if (fun->nrofargs<0) {
326 DPRINTF("<unknown, check return>");
327 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
328 memcpy(ret->args,(LPBYTE)(ESP_reg(context)+4),sizeof(DWORD)*16);
330 DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD)ret->origreturn,FS_reg(context));
333 void WINAPI SNOOP_DoReturn( CONTEXT86 *context );
334 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Return, SNOOP_DoReturn );
335 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
337 SNOOP_RETURNENTRY *ret = (SNOOP_RETURNENTRY*)(EIP_reg(context)-5);
339 /* We haven't found out the nrofargs yet. If we called a cdecl
340 * function it is too late anyway and we can just set '0' (which
341 * will be the difference between orig and current ESP
342 * If stdcall -> everything ok.
344 if (ret->dll->funs[ret->ordinal].nrofargs<0)
345 ret->dll->funs[ret->ordinal].nrofargs=(ESP_reg(context)-ret->origESP-4)/4;
346 EIP_reg(context) = (DWORD)ret->origreturn;
347 if (ret->args) {
348 int i,max;
350 DPRINTF("Ret %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
351 max = ret->dll->funs[ret->ordinal].nrofargs;
352 if (max>16) max=16;
354 for (i=0;i<max;i++)
355 DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
356 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
357 EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
359 HeapFree(GetProcessHeap(),0,ret->args);
360 ret->args = NULL;
361 } else
362 DPRINTF("Ret %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
363 ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
364 EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
366 ret->origreturn = NULL; /* mark as empty */
368 #else /* !__i386__ */
369 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
370 FIXME("snooping works only on i386 for now.\n");
371 return;
374 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
375 return origfun;
377 #endif /* !__i386__ */