if1632/snoop.c

   1 /*
   2  * 386-specific Win16 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21 #include <assert.h>
  22 #include <string.h>
  23 #include <stdio.h>
  24 #include "winbase.h"
  25 #include "windef.h"
  26 #include "winnt.h"
  27 #include "wine/winbase16.h"
  28 #include "wine/library.h"
  29 #include "global.h"
  30 #include "stackframe.h"
  31 #include "builtin16.h"
  32 #include "toolhelp.h"
  33 #include "snoop.h"
  34 #include "wine/debug.h"
  35
  36 WINE_DEFAULT_DEBUG_CHANNEL(snoop);
  37
  38 #ifdef __i386__
  39
  40 #include "pshpack1.h"
  41
  42 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context);
  43 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context);
  44
  45 typedef struct tagSNOOP16_FUN {
  46         /* code part */
  47         BYTE            lcall;          /* 0x9a call absolute with segment */
  48         DWORD           snr;
  49         /* unreached */
  50         int             nrofargs;
  51         FARPROC16       origfun;
  52         char            *name;
  53 } SNOOP16_FUN;
  54
  55 typedef struct tagSNOOP16_DLL {
  56         HMODULE16       hmod;
  57         HANDLE16        funhandle;
  58         SNOOP16_FUN     *funs;
  59         struct tagSNOOP16_DLL   *next;
  60         char name[1];
  61 } SNOOP16_DLL;
  62
  63 typedef struct tagSNOOP16_RETURNENTRY {
  64         /* code part */
  65         BYTE            lcall;          /* 0x9a call absolute with segment */
  66         DWORD           snr;
  67         /* unreached */
  68         FARPROC16       origreturn;
  69         SNOOP16_DLL     *dll;
  70         DWORD           ordinal;
  71         WORD            origSP;
  72         WORD            *args;          /* saved args across a stdcall */
  73 } SNOOP16_RETURNENTRY;
  74
  75 typedef struct tagSNOOP16_RETURNENTRIES {
  76         SNOOP16_RETURNENTRY entry[65500/sizeof(SNOOP16_RETURNENTRY)];
  77         HANDLE16        rethandle;
  78         struct tagSNOOP16_RETURNENTRIES *next;
  79 } SNOOP16_RETURNENTRIES;
  80
  81 typedef struct tagSNOOP16_RELAY {
  82         WORD            pushbp;         /* 0x5566 */
  83         BYTE            pusheax;        /* 0x50 */
  84         WORD            pushax;         /* 0x5066 */
  85         BYTE            pushl;          /* 0x68 */
  86         DWORD           realfun;        /* SNOOP16_Return */
  87         BYTE            lcall;          /* 0x9a call absolute with segment */
  88         DWORD           callfromregs;
  89         WORD            seg;
  90         WORD            lret;           /* 0xcb66 */
  91 } SNOOP16_RELAY;
  92
  93 #include "poppack.h"
  94
  95 static  SNOOP16_DLL             *firstdll = NULL;
  96 static  SNOOP16_RETURNENTRIES   *firstrets = NULL;
  97 static  SNOOP16_RELAY           *snr;
  98 static  HANDLE16                xsnr = 0;
  99
 100 void
 101 SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
 102         SNOOP16_DLL     **dll = &(firstdll);
 103         char            *s;
 104
 105         if (!TRACE_ON(snoop)) return;
 106         if (!snr) {
 107                 xsnr=GLOBAL_Alloc(GMEM_ZEROINIT,2*sizeof(*snr),0,WINE_LDT_FLAGS_CODE|WINE_LDT_FLAGS_32BIT);
 108                 snr = GlobalLock16(xsnr);
 109                 snr[0].pushbp   = 0x5566;
 110                 snr[0].pusheax  = 0x50;
 111                 snr[0].pushax   = 0x5066;
 112                 snr[0].pushl    = 0x68;
 113                 snr[0].realfun  = (DWORD)SNOOP16_Entry;
 114                 snr[0].lcall    = 0x9a;
 115                 snr[0].callfromregs = (DWORD)__wine_call_from_16_regs;
 116                 snr[0].seg      = wine_get_cs();
 117                 snr[0].lret     = 0xcb66;
 118
 119                 snr[1].pushbp   = 0x5566;
 120                 snr[1].pusheax  = 0x50;
 121                 snr[1].pushax   = 0x5066;
 122                 snr[1].pushl    = 0x68;
 123                 snr[1].realfun  = (DWORD)SNOOP16_Return;
 124                 snr[1].lcall    = 0x9a;
 125                 snr[1].callfromregs = (DWORD)__wine_call_from_16_regs;
 126                 snr[1].seg      = wine_get_cs();
 127                 snr[1].lret     = 0xcb66;
 128         }
 129         while (*dll) {
 130                 if ((*dll)->hmod == pModule->self)
 131                         return; /* already registered */
 132                 dll = &((*dll)->next);
 133         }
 134         *dll = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP16_DLL)+strlen(name));
 135         (*dll)->next    = NULL;
 136         (*dll)->hmod    = pModule->self;
 137         if ((s=strrchr(name,'\\')))
 138                 name = s+1;
 139         strcpy( (*dll)->name, name );
 140         if ((s=strrchr((*dll)->name,'.')))
 141                 *s='\0';
 142         (*dll)->funhandle = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,WINE_LDT_FLAGS_CODE));
 143         (*dll)->funs = GlobalLock16((*dll)->funhandle);
 144         if (!(*dll)->funs) {
 145                 HeapFree(GetProcessHeap(),0,*dll);
 146                 FIXME("out of memory\n");
 147                 return;
 148         }
 149 }
 150
 151 FARPROC16
 152 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
 153         SNOOP16_DLL                     *dll = firstdll;
 154         SNOOP16_FUN                     *fun;
 155         NE_MODULE                       *pModule = NE_GetPtr(hmod);
 156         unsigned char                   *cpnt;
 157         char                            name[200];
 158
 159         if (!TRACE_ON(snoop) || !pModule || !HIWORD(origfun))
 160                 return origfun;
 161         if (!*(LPBYTE)MapSL((SEGPTR)origfun)) /* 0x00 is an imposs. opcode, poss. dataref. */
 162                 return origfun;
 163         while (dll) {
 164                 if (hmod == dll->hmod)
 165                         break;
 166                 dll=dll->next;
 167         }
 168         if (!dll)       /* probably internal */
 169                 return origfun;
 170         if (ordinal>65535/sizeof(SNOOP16_FUN))
 171                 return origfun;
 172         fun = dll->funs+ordinal;
 173         /* already done? */
 174         fun->lcall      = 0x9a;
 175         fun->snr        = MAKELONG(0,xsnr);
 176         fun->origfun    = origfun;
 177         if (fun->name)
 178                 return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
 179         cpnt = (unsigned char *)pModule + pModule->name_table;
 180         while (*cpnt) {
 181                 cpnt += *cpnt + 1 + sizeof(WORD);
 182                 if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
 183                         sprintf(name,"%.*s",*cpnt,cpnt+1);
 184                         break;
 185                 }
 186         }
 187         /* Now search the non-resident names table */
 188
 189         if (!*cpnt && pModule->nrname_handle) {
 190                 cpnt = (char *)GlobalLock16( pModule->nrname_handle );
 191                 while (*cpnt) {
 192                         cpnt += *cpnt + 1 + sizeof(WORD);
 193                         if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
 194                                     sprintf(name,"%.*s",*cpnt,cpnt+1);
 195                                     break;
 196                         }
 197                 }
 198         }
 199         if (*cpnt)
 200         {
 201             fun->name = HeapAlloc(GetProcessHeap(),0,strlen(name)+1);
 202             strcpy( fun->name, name );
 203         }
 204         else
 205             fun->name = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,1); /* empty string */
 206
 207         if (!SNOOP_ShowDebugmsgSnoop(dll->name, ordinal, fun->name))
 208                 return origfun;
 209
 210         /* more magic. do not try to snoop thunk data entries (MMSYSTEM) */
 211         if (strchr(fun->name,'_')) {
 212                 char *s=strchr(fun->name,'_');
 213
 214                 if (!strncasecmp(s,"_thunkdata",10)) {
 215                         HeapFree(GetProcessHeap(),0,fun->name);
 216                         fun->name = NULL;
 217                         return origfun;
 218                 }
 219         }
 220         fun->lcall      = 0x9a;
 221         fun->snr        = MAKELONG(0,xsnr);
 222         fun->origfun    = origfun;
 223         fun->nrofargs   = -1;
 224         return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
 225 }
 226
 227 #define CALLER1REF (*(DWORD*)(MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)+4))))
 228 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
 229         DWORD           ordinal=0;
 230         DWORD           entry=(DWORD)MapSL( MAKESEGPTR(context->SegCs,LOWORD(context->Eip)) )-5;
 231         WORD            xcs = context->SegCs;
 232         SNOOP16_DLL     *dll = firstdll;
 233         SNOOP16_FUN     *fun = NULL;
 234         SNOOP16_RETURNENTRIES   **rets = &firstrets;
 235         SNOOP16_RETURNENTRY     *ret;
 236         int             i=0, max;
 237
 238         while (dll) {
 239                 if (xcs == dll->funhandle) {
 240                         fun = (SNOOP16_FUN*)entry;
 241                         ordinal = fun-dll->funs;
 242                         break;
 243                 }
 244                 dll=dll->next;
 245         }
 246         if (!dll) {
 247                 FIXME("entrypoint 0x%08lx not found\n",entry);
 248                 return; /* oops */
 249         }
 250         while (*rets) {
 251                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 252                         if (!(*rets)->entry[i].origreturn)
 253                                 break;
 254                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 255                         break;
 256                 rets = &((*rets)->next);
 257         }
 258         if (!*rets) {
 259                 HANDLE16 hand = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,WINE_LDT_FLAGS_CODE));
 260                 *rets = GlobalLock16(hand);
 261                 (*rets)->rethandle = hand;
 262                 i = 0;  /* entry 0 is free */
 263         }
 264         ret = &((*rets)->entry[i]);
 265         ret->lcall      = 0x9a;
 266         ret->snr        = MAKELONG(sizeof(SNOOP16_RELAY),xsnr);
 267         ret->origreturn = (FARPROC16)CALLER1REF;
 268         CALLER1REF      = MAKELONG((char*)&(ret->lcall)-(char*)((*rets)->entry),(*rets)->rethandle);
 269         ret->dll        = dll;
 270         ret->args       = NULL;
 271         ret->ordinal    = ordinal;
 272         ret->origSP     = LOWORD(context->Esp);
 273
 274         context->Eip= LOWORD(fun->origfun);
 275         context->SegCs = HIWORD(fun->origfun);
 276
 277
 278         DPRINTF("CALL %s.%ld: %s(",dll->name,ordinal,fun->name);
 279         if (fun->nrofargs>0) {
 280                 max = fun->nrofargs;
 281                 if (max>16) max=16;
 282                 for (i=max;i--;)
 283                         DPRINTF("%04x%s",*(WORD*)((char *) MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)) )+8+sizeof(WORD)*i),i?",":"");
 284                 if (max!=fun->nrofargs)
 285                         DPRINTF(" ...");
 286         } else if (fun->nrofargs<0) {
 287                 DPRINTF("<unknown, check return>");
 288                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(WORD));
 289                 memcpy(ret->args,(LPBYTE)((char *) MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)) )+8),sizeof(WORD)*16);
 290         }
 291         DPRINTF(") ret=%04x:%04x\n",HIWORD(ret->origreturn),LOWORD(ret->origreturn));
 292 }
 293
 294 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
 295         SNOOP16_RETURNENTRY     *ret = (SNOOP16_RETURNENTRY*)((char *) MapSL( MAKESEGPTR(context->SegCs,LOWORD(context->Eip)) )-5);
 296
 297         /* We haven't found out the nrofargs yet. If we called a cdecl
 298          * function it is too late anyway and we can just set '0' (which
 299          * will be the difference between orig and current SP
 300          * If pascal -> everything ok.
 301          */
 302         if (ret->dll->funs[ret->ordinal].nrofargs<0) {
 303                 ret->dll->funs[ret->ordinal].nrofargs=(LOWORD(context->Esp)-ret->origSP-4)/2;
 304         }
 305         context->Eip = LOWORD(ret->origreturn);
 306         context->SegCs  = HIWORD(ret->origreturn);
 307         if (ret->args) {
 308                 int     i,max;
 309
 310                 DPRINTF("RET  %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
 311                 max = ret->dll->funs[ret->ordinal].nrofargs;
 312                 if (max>16)
 313                         max=16;
 314                 if (max<0)
 315                         max=0;
 316
 317                 for (i=max;i--;)
 318                         DPRINTF("%04x%s",ret->args[i],i?",":"");
 319                 if (max!=ret->dll->funs[ret->ordinal].nrofargs)
 320                         DPRINTF(" ...");
 321                 DPRINTF(") retval = %04x:%04x ret=%04x:%04x\n",
 322                         DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
 323                 );
 324                 HeapFree(GetProcessHeap(),0,ret->args);
 325                 ret->args = NULL;
 326         } else
 327                 DPRINTF("RET  %s.%ld: %s() retval = %04x:%04x ret=%04x:%04x\n",
 328                         ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
 329                         DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
 330                 );
 331         ret->origreturn = NULL; /* mark as empty */
 332 }
 333 #else   /* !__i386__ */
 334 void SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
 335         if (!TRACE_ON(snoop)) return;
 336         FIXME("snooping works only on i386 for now.\n");
 337 }
 338
 339 FARPROC16 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
 340         return origfun;
 341 }
 342 #endif  /* !__i386__ */
 343