?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fixed header dependencies to be fully compatible with the Windows
[wine/multimedia.git] / relay32 / snoop.c
blob94f997bfd75a1d6bb6fa7dc7c53ede1a308f455d
1 /*
2 * 386-specific Win32 dll<->dll snooping functions
3 *
4 * Copyright 1998 Marcus Meissner
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19 */
20
21 #include "config.h"
22 #include "wine/port.h"
23
24 #include <assert.h>
25 #include <stdarg.h>
26 #include <stdio.h>
27 #include <string.h>
28 #include "ntstatus.h"
29 #include "windef.h"
30 #include "winbase.h"
31 #include "winreg.h"
32 #include "winternl.h"
33 #include "snoop.h"
34 #include "wine/debug.h"
35 #include "wine/exception.h"
36 #include "excpt.h"
37 #include "ntdll_misc.h"
38
39 WINE_DEFAULT_DEBUG_CHANNEL(snoop);
40 WINE_DECLARE_DEBUG_CHANNEL(seh);
41
42 static WINE_EXCEPTION_FILTER(page_fault)
43 {
44 if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ||
45 GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION)
46 return EXCEPTION_EXECUTE_HANDLER;
47 return EXCEPTION_CONTINUE_SEARCH;
48 }
49
50 extern const char **debug_snoop_excludelist;
51 extern const char **debug_snoop_includelist;
52
53 #ifdef __i386__
54
55 extern void WINAPI SNOOP_Entry();
56 extern void WINAPI SNOOP_Return();
57
58 #include "pshpack1.h"
59
60 typedef struct tagSNOOP_FUN {
61 /* code part */
62 BYTE lcall; /* 0xe8 call snoopentry (relative) */
63 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
64 * calculation!
65 */
66 DWORD snoopentry; /* SNOOP_Entry relative */
67 /* unreached */
68 int nrofargs;
69 FARPROC origfun;
70 const char *name;
71 } SNOOP_FUN;
72
73 typedef struct tagSNOOP_DLL {
74 HMODULE hmod;
75 SNOOP_FUN *funs;
76 DWORD ordbase;
77 DWORD nrofordinals;
78 struct tagSNOOP_DLL *next;
79 char name[1];
80 } SNOOP_DLL;
81
82 typedef struct tagSNOOP_RETURNENTRY {
83 /* code part */
84 BYTE lcall; /* 0xe8 call snoopret relative*/
85 /* NOTE: If you move snoopret OR origreturn fix the relative offset
86 * calculation!
87 */
88 DWORD snoopret; /* SNOOP_Ret relative */
89 /* unreached */
90 FARPROC origreturn;
91 SNOOP_DLL *dll;
92 DWORD ordinal;
93 DWORD origESP;
94 DWORD *args; /* saved args across a stdcall */
95 } SNOOP_RETURNENTRY;
96
97 typedef struct tagSNOOP_RETURNENTRIES {
98 SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
99 struct tagSNOOP_RETURNENTRIES *next;
100 } SNOOP_RETURNENTRIES;
101
102 #include "poppack.h"
103
104 static SNOOP_DLL *firstdll = NULL;
105 static SNOOP_RETURNENTRIES *firstrets = NULL;
106
107 /***********************************************************************
108 * SNOOP_ShowDebugmsgSnoop
109 *
110 * Simple function to decide if a particular debugging message is
111 * wanted.
112 */
113 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
114
115 if(debug_snoop_excludelist || debug_snoop_includelist) {
116 const char **listitem;
117 char buf[80];
118 int len, len2, itemlen, show;
119
120 if(debug_snoop_excludelist) {
121 show = 1;
122 listitem = debug_snoop_excludelist;
123 } else {
124 show = 0;
125 listitem = debug_snoop_includelist;
126 }
127 len = strlen(dll);
128 assert(len < 64);
129 sprintf(buf, "%s.%d", dll, ord);
130 len2 = strlen(buf);
131 for(; *listitem; listitem++) {
132 itemlen = strlen(*listitem);
133 if((itemlen == len && !strncasecmp(*listitem, buf, len)) ||
134 (itemlen == len2 && !strncasecmp(*listitem, buf, len2)) ||
135 !strcasecmp(*listitem, fname)) {
136 show = !show;
137 break;
138 }
139 }
140 return show;
141 }
142 return 1;
143 }
144
145 void
146 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD ordbase,DWORD nrofordinals) {
147 SNOOP_DLL **dll = &(firstdll);
148 char *s;
149 void *addr;
150 SIZE_T size;
151
152 TRACE("hmod=%p, name=%s, ordbase=%ld, nrofordinals=%ld\n",
153 hmod, name, ordbase, nrofordinals);
154
155 if (!TRACE_ON(snoop)) return;
156 while (*dll) {
157 if ((*dll)->hmod == hmod)
158 {
159 /* another dll, loaded at the same address */
160 addr = (*dll)->funs;
161 size = (*dll)->nrofordinals * sizeof(SNOOP_FUN);
162 NtFreeVirtualMemory(GetCurrentProcess(), &addr, &size, MEM_RELEASE);
163 break;
164 }
165 dll = &((*dll)->next);
166 }
167 *dll = RtlReAllocateHeap(ntdll_get_process_heap(),
168 HEAP_ZERO_MEMORY, *dll,
169 sizeof(SNOOP_DLL) + strlen(name));
170 (*dll)->hmod = hmod;
171 (*dll)->ordbase = ordbase;
172 (*dll)->nrofordinals = nrofordinals;
173 strcpy( (*dll)->name, name );
174 if ((s=strrchr((*dll)->name,'.')))
175 *s='\0';
176 size = nrofordinals * sizeof(SNOOP_FUN);
177 NtAllocateVirtualMemory(GetCurrentProcess(), &addr, NULL, &size,
178 MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
179 if (!addr) {
180 RtlFreeHeap(ntdll_get_process_heap(),0,*dll);
181 FIXME("out of memory\n");
182 return;
183 }
184 (*dll)->funs = addr;
185 memset((*dll)->funs,0,size);
186 }
187
188 FARPROC SNOOP_GetProcAddress( HMODULE hmod, IMAGE_EXPORT_DIRECTORY *exports, DWORD exp_size,
189 FARPROC origfun, DWORD ordinal )
190 {
191 int i;
192 const char *ename;
193 WORD *ordinals;
194 DWORD *names;
195 SNOOP_DLL *dll = firstdll;
196 SNOOP_FUN *fun;
197 IMAGE_SECTION_HEADER *sec;
198
199 if (!TRACE_ON(snoop)) return origfun;
200 if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
201 return origfun;
202
203 sec = RtlImageRvaToSection( RtlImageNtHeader(hmod), hmod, (char *)origfun - (char *)hmod );
204
205 if (!sec || !(sec->Characteristics & IMAGE_SCN_CNT_CODE))
206 return origfun; /* most likely a data reference */
207
208 while (dll) {
209 if (hmod == dll->hmod)
210 break;
211 dll=dll->next;
212 }
213 if (!dll) /* probably internal */
214 return origfun;
215
216 /* try to find a name for it */
217 ename = NULL;
218 names = (DWORD *)((char *)hmod + exports->AddressOfNames);
219 ordinals = (WORD *)((char *)hmod + exports->AddressOfNameOrdinals);
220 if (names) for (i = 0; i < exports->NumberOfNames; i++)
221 {
222 if (ordinals[i] == ordinal)
223 {
224 ename = (char *)hmod + names[i];
225 break;
226 }
227 }
228 if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,ename))
229 return origfun;
230 assert(ordinal < dll->nrofordinals);
231 fun = dll->funs+ordinal;
232 if (!fun->name)
233 {
234 fun->name = ename;
235 fun->lcall = 0xe8;
236 /* NOTE: origreturn struct member MUST come directly after snoopentry */
237 fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
238 fun->origfun = origfun;
239 fun->nrofargs = -1;
240 }
241 return (FARPROC)&(fun->lcall);
242 }
243
244 static void SNOOP_PrintArg(DWORD x)
245 {
246 int i,nostring;
247
248 DPRINTF("%08lx",x);
249 if (!HIWORD(x) || TRACE_ON(seh)) return; /* trivial reject to avoid faults */
250 __TRY
251 {
252 LPBYTE s=(LPBYTE)x;
253 i=0;nostring=0;
254 while (i<80) {
255 if (s[i]==0) break;
256 if (s[i]<0x20) {nostring=1;break;}
257 if (s[i]>=0x80) {nostring=1;break;}
258 i++;
259 }
260 if (!nostring && i > 5)
261 DPRINTF(" %s",debugstr_an((LPSTR)x,i));
262 else /* try unicode */
263 {
264 LPWSTR s=(LPWSTR)x;
265 i=0;nostring=0;
266 while (i<80) {
267 if (s[i]==0) break;
268 if (s[i]<0x20) {nostring=1;break;}
269 if (s[i]>0x100) {nostring=1;break;}
270 i++;
271 }
272 if (!nostring && i > 5) DPRINTF(" %s",debugstr_wn((LPWSTR)x,i));
273 }
274 }
275 __EXCEPT(page_fault)
276 {
277 }
278 __ENDTRY
279 }
280
281 #define CALLER1REF (*(DWORD*)context->Esp)
282
283 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
284 {
285 DWORD ordinal=0,entry = context->Eip - 5;
286 SNOOP_DLL *dll = firstdll;
287 SNOOP_FUN *fun = NULL;
288 SNOOP_RETURNENTRIES **rets = &firstrets;
289 SNOOP_RETURNENTRY *ret;
290 int i=0, max;
291
292 while (dll) {
293 if ( ((char*)entry>=(char*)dll->funs) &&
294 ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
295 ) {
296 fun = (SNOOP_FUN*)entry;
297 ordinal = fun-dll->funs;
298 break;
299 }
300 dll=dll->next;
301 }
302 if (!dll) {
303 FIXME("entrypoint 0x%08lx not found\n",entry);
304 return; /* oops */
305 }
306 /* guess cdecl ... */
307 if (fun->nrofargs<0) {
308 /* Typical cdecl return frame is:
309 * add esp, xxxxxxxx
310 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
311 * (after that 81 C2 xx xx xx xx)
312 */
313 LPBYTE reteip = (LPBYTE)CALLER1REF;
314
315 if (reteip) {
316 if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
317 fun->nrofargs=reteip[2]/4;
318 }
319 }
320
321
322 while (*rets) {
323 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
324 if (!(*rets)->entry[i].origreturn)
325 break;
326 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
327 break;
328 rets = &((*rets)->next);
329 }
330 if (!*rets) {
331 SIZE_T size = 4096;
332 VOID* addr;
333
334 NtAllocateVirtualMemory(GetCurrentProcess(), &addr, NULL, &size,
335 MEM_COMMIT | MEM_RESERVE,
336 PAGE_EXECUTE_READWRITE);
337 if (!addr) return;
338 *rets = addr;
339 memset(*rets,0,4096);
340 i = 0; /* entry 0 is free */
341 }
342 ret = &((*rets)->entry[i]);
343 ret->lcall = 0xe8;
344 /* NOTE: origreturn struct member MUST come directly after snoopret */
345 ret->snoopret = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
346 ret->origreturn = (FARPROC)CALLER1REF;
347 CALLER1REF = (DWORD)&ret->lcall;
348 ret->dll = dll;
349 ret->args = NULL;
350 ret->ordinal = ordinal;
351 ret->origESP = context->Esp;
352
353 context->Eip = (DWORD)fun->origfun;
354
355 if (fun->name) DPRINTF("%04lx:CALL %s.%s(",GetCurrentThreadId(),dll->name,fun->name);
356 else DPRINTF("%04lx:CALL %s.%ld(",GetCurrentThreadId(),dll->name,dll->ordbase+ordinal);
357 if (fun->nrofargs>0) {
358 max = fun->nrofargs; if (max>16) max=16;
359 for (i=0;i<max;i++)
360 {
361 SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i));
362 if (i<fun->nrofargs-1) DPRINTF(",");
363 }
364 if (max!=fun->nrofargs)
365 DPRINTF(" ...");
366 } else if (fun->nrofargs<0) {
367 DPRINTF("<unknown, check return>");
368 ret->args = RtlAllocateHeap(ntdll_get_process_heap(),
369 0,16*sizeof(DWORD));
370 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
371 }
372 DPRINTF(") ret=%08lx\n",(DWORD)ret->origreturn);
373 }
374
375
376 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
377 {
378 SNOOP_RETURNENTRY *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
379 SNOOP_FUN *fun = &ret->dll->funs[ret->ordinal];
380
381 /* We haven't found out the nrofargs yet. If we called a cdecl
382 * function it is too late anyway and we can just set '0' (which
383 * will be the difference between orig and current ESP
384 * If stdcall -> everything ok.
385 */
386 if (ret->dll->funs[ret->ordinal].nrofargs<0)
387 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
388 context->Eip = (DWORD)ret->origreturn;
389 if (ret->args) {
390 int i,max;
391
392 if (fun->name)
393 DPRINTF("%04lx:RET %s.%s(", GetCurrentThreadId(), ret->dll->name, fun->name);
394 else
395 DPRINTF("%04lx:RET %s.%ld(", GetCurrentThreadId(),
396 ret->dll->name,ret->dll->ordbase+ret->ordinal);
397
398 max = fun->nrofargs;
399 if (max>16) max=16;
400
401 for (i=0;i<max;i++)
402 {
403 SNOOP_PrintArg(ret->args[i]);
404 if (i<max-1) DPRINTF(",");
405 }
406 DPRINTF(") retval=%08lx ret=%08lx\n",
407 context->Eax,(DWORD)ret->origreturn );
408 RtlFreeHeap(ntdll_get_process_heap(),0,ret->args);
409 ret->args = NULL;
410 }
411 else
412 {
413 if (fun->name)
414 DPRINTF("%04lx:RET %s.%s() retval=%08lx ret=%08lx\n",
415 GetCurrentThreadId(),
416 ret->dll->name, fun->name, context->Eax, (DWORD)ret->origreturn);
417 else
418 DPRINTF("%04lx:RET %s.%ld() retval=%08lx ret=%08lx\n",
419 GetCurrentThreadId(),
420 ret->dll->name,ret->dll->ordbase+ret->ordinal,
421 context->Eax, (DWORD)ret->origreturn);
422 }
423 ret->origreturn = NULL; /* mark as empty */
424 }
425
426 /* assembly wrappers that save the context */
427 __ASM_GLOBAL_FUNC( SNOOP_Entry,
428 "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
429 ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
430 __ASM_GLOBAL_FUNC( SNOOP_Return,
431 "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
432 ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
433
434 #else /* !__i386__ */
435 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals, DWORD dw) {
436 if (!TRACE_ON(snoop)) return;
437 FIXME("snooping works only on i386 for now.\n");
438 }
439
440 FARPROC SNOOP_GetProcAddress( HMODULE hmod, IMAGE_EXPORT_DIRECTORY *exports, DWORD exp_size,
441 FARPROC origfun, DWORD ordinal )
442 {
443 return origfun;
444 }
445 #endif /* !__i386__ */
Maarten's multimedia branch