relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  */
   6
   7 #include "config.h"
   8
   9 #include <assert.h>
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include "winbase.h"
  13 #include "wingdi.h"
  14 #include "winuser.h"
  15 #include "winnt.h"
  16 #include "heap.h"
  17 #include "builtin32.h"
  18 #include "snoop.h"
  19 #include "neexe.h"
  20 #include "peexe.h"
  21 #include "selectors.h"
  22 #include "stackframe.h"
  23 #include "debugtools.h"
  24
  25 DEFAULT_DEBUG_CHANNEL(snoop);
  26
  27 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
  28
  29 #ifdef __i386__
  30
  31 extern void WINAPI SNOOP_Entry();
  32 extern void WINAPI SNOOP_Return();
  33
  34 #ifdef NEED_UNDERSCORE_PREFIX
  35 # define PREFIX "_"
  36 #else
  37 # define PREFIX
  38 #endif
  39
  40 #include "pshpack1.h"
  41
  42 typedef struct tagSNOOP_FUN {
  43         /* code part */
  44         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  45         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  46          * calculation!
  47          */
  48         DWORD           snoopentry;     /* SNOOP_Entry relative */
  49         /* unreached */
  50         int             nrofargs;
  51         FARPROC origfun;
  52         char            *name;
  53 } SNOOP_FUN;
  54
  55 typedef struct tagSNOOP_DLL {
  56         HMODULE hmod;
  57         SNOOP_FUN       *funs;
  58         LPCSTR          name;
  59         int             nrofordinals;
  60         struct tagSNOOP_DLL     *next;
  61 } SNOOP_DLL;
  62 typedef struct tagSNOOP_RETURNENTRY {
  63         /* code part */
  64         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  65         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  66          * calculation!
  67          */
  68         DWORD           snoopret;       /* SNOOP_Ret relative */
  69         /* unreached */
  70         FARPROC origreturn;
  71         SNOOP_DLL       *dll;
  72         DWORD           ordinal;
  73         DWORD           origESP;
  74         DWORD           *args;          /* saved args across a stdcall */
  75 } SNOOP_RETURNENTRY;
  76
  77 typedef struct tagSNOOP_RETURNENTRIES {
  78         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  79         struct tagSNOOP_RETURNENTRIES   *next;
  80 } SNOOP_RETURNENTRIES;
  81
  82 #include "poppack.h"
  83
  84 static  SNOOP_DLL               *firstdll = NULL;
  85 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
  86
  87 /***********************************************************************
  88  *          SNOOP_ShowDebugmsgSnoop
  89  *
  90  * Simple function to decide if a particular debugging message is
  91  * wanted.
  92  */
  93 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
  94
  95   if(debug_snoop_excludelist || debug_snoop_includelist) {
  96     char **listitem;
  97     char buf[80];
  98     int len, len2, itemlen, show;
  99
 100     if(debug_snoop_excludelist) {
 101       show = 1;
 102       listitem = debug_snoop_excludelist;
 103     } else {
 104       show = 0;
 105       listitem = debug_snoop_includelist;
 106     }
 107     len = strlen(dll);
 108     assert(len < 64);
 109     sprintf(buf, "%s.%d", dll, ord);
 110     len2 = strlen(buf);
 111     for(; *listitem; listitem++) {
 112       itemlen = strlen(*listitem);
 113       if((itemlen == len && !strncmp(*listitem, buf, len)) ||
 114          (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
 115          !strcmp(*listitem, fname)) {
 116         show = !show;
 117        break;
 118       }
 119     }
 120     return show;
 121   }
 122   return 1;
 123 }
 124
 125 void
 126 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
 127         SNOOP_DLL       **dll = &(firstdll);
 128         char            *s;
 129
 130         if (!TRACE_ON(snoop)) return;
 131         while (*dll) {
 132                 if ((*dll)->hmod == hmod)
 133                         return; /* already registered */
 134                 dll = &((*dll)->next);
 135         }
 136         *dll = (SNOOP_DLL*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
 137         (*dll)->next    = NULL;
 138         (*dll)->hmod    = hmod;
 139         (*dll)->nrofordinals = nrofordinals;
 140         (*dll)->name    = HEAP_strdupA(GetProcessHeap(),0,name);
 141         if ((s=strrchr((*dll)->name,'.')))
 142                 *s='\0';
 143         (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 144         memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
 145         if (!(*dll)->funs) {
 146                 HeapFree(GetProcessHeap(),0,*dll);
 147                 FIXME("out of memory\n");
 148                 return;
 149         }
 150 }
 151
 152 FARPROC
 153 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 154         SNOOP_DLL                       *dll = firstdll;
 155         SNOOP_FUN                       *fun;
 156         int                             j;
 157         IMAGE_SECTION_HEADER            *pe_seg = PE_SECTIONS(hmod);
 158
 159         if (!TRACE_ON(snoop)) return origfun;
 160         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 161                 return origfun;
 162         for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
 163                 /* 0x42 is special ELF loader tag */
 164                 if ((pe_seg[j].VirtualAddress==0x42) ||
 165                     (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
 166                      ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
 167                                    pe_seg[j].SizeOfRawData
 168                    ))
 169                 )
 170                         break;
 171         /* If we looked through all sections (and didn't find one)
 172          * or if the sectionname contains "data", we return the
 173          * original function since it is most likely a datareference.
 174          */
 175         if (    (j==PE_HEADER(hmod)->FileHeader.NumberOfSections)       ||
 176                 (strstr(pe_seg[j].Name,"data"))                         ||
 177                 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
 178         )
 179                 return origfun;
 180
 181         while (dll) {
 182                 if (hmod == dll->hmod)
 183                         break;
 184                 dll=dll->next;
 185         }
 186         if (!dll)       /* probably internal */
 187                 return origfun;
 188         if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
 189                 return origfun;
 190         assert(ordinal<dll->nrofordinals);
 191         fun = dll->funs+ordinal;
 192         if (!fun->name) fun->name = HEAP_strdupA(GetProcessHeap(),0,name);
 193         fun->lcall      = 0xe8;
 194         /* NOTE: origreturn struct member MUST come directly after snoopentry */
 195         fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 196         fun->origfun    = origfun;
 197         fun->nrofargs   = -1;
 198         return (FARPROC)&(fun->lcall);
 199 }
 200
 201 static char*
 202 SNOOP_PrintArg(DWORD x) {
 203         static char     buf[200];
 204         int             i,nostring;
 205         MEMORY_BASIC_INFORMATION        mbi;
 206
 207         if (    !HIWORD(x)                                      ||
 208                 !VirtualQuery((LPVOID)x,&mbi,sizeof(mbi))       ||
 209                 !mbi.Type
 210         ) {
 211                 sprintf(buf,"%08lx",x);
 212                 return buf;
 213         }
 214         if (!IsBadStringPtrA((LPSTR)x,80)) {
 215                 LPBYTE  s=(LPBYTE)x;
 216                 i=0;nostring=0;
 217                 while (i<80) {
 218                         if (s[i]==0) break;
 219                         if (s[i]<0x20) {nostring=1;break;}
 220                         if (s[i]>=0x80) {nostring=1;break;}
 221                         i++;
 222                 }
 223                 if (!nostring) {
 224                         if (i>5) {
 225                                 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
 226                                 return buf;
 227                         }
 228                 }
 229         }
 230         if (!IsBadStringPtrW((LPWSTR)x,80)) {
 231                 LPWSTR  s=(LPWSTR)x;
 232                 i=0;nostring=0;
 233                 while (i<80) {
 234                         if (s[i]==0) break;
 235                         if (s[i]<0x20) {nostring=1;break;}
 236                         if (s[i]>0x100) {nostring=1;break;}
 237                         i++;
 238                 }
 239                 if (!nostring) {
 240                         if (i>5) {
 241                                 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
 242                                 return buf;
 243                         }
 244                 }
 245         }
 246         sprintf(buf,"%08lx",x);
 247         return buf;
 248 }
 249
 250 #define CALLER1REF (*(DWORD*)ESP_reg(context))
 251
 252 void WINAPI SNOOP_DoEntry( CONTEXT86 *context );
 253 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Entry, SNOOP_DoEntry );
 254 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
 255 {
 256         DWORD           ordinal=0,entry = EIP_reg(context)-5;
 257         SNOOP_DLL       *dll = firstdll;
 258         SNOOP_FUN       *fun = NULL;
 259         SNOOP_RETURNENTRIES     **rets = &firstrets;
 260         SNOOP_RETURNENTRY       *ret;
 261         int             i,max;
 262
 263         while (dll) {
 264                 if (    ((char*)entry>=(char*)dll->funs)        &&
 265                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 266                 ) {
 267                         fun = (SNOOP_FUN*)entry;
 268                         ordinal = fun-dll->funs;
 269                         break;
 270                 }
 271                 dll=dll->next;
 272         }
 273         if (!dll) {
 274                 FIXME("entrypoint 0x%08lx not found\n",entry);
 275                 return; /* oops */
 276         }
 277         /* guess cdecl ... */
 278         if (fun->nrofargs<0) {
 279                 /* Typical cdecl return frame is:
 280                  *      add esp, xxxxxxxx
 281                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 282                  * (after that 81 C2 xx xx xx xx)
 283                  */
 284                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 285
 286                 if (reteip) {
 287                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 288                                 fun->nrofargs=reteip[2]/4;
 289                 }
 290         }
 291
 292
 293         while (*rets) {
 294                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 295                         if (!(*rets)->entry[i].origreturn)
 296                                 break;
 297                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 298                         break;
 299                 rets = &((*rets)->next);
 300         }
 301         if (!*rets) {
 302                 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 303                 memset(*rets,0,4096);
 304                 i = 0;  /* entry 0 is free */
 305         }
 306         ret = &((*rets)->entry[i]);
 307         ret->lcall      = 0xe8;
 308         /* NOTE: origreturn struct member MUST come directly after snoopret */
 309         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 310         ret->origreturn = (FARPROC)CALLER1REF;
 311         CALLER1REF      = (DWORD)&ret->lcall;
 312         ret->dll        = dll;
 313         ret->args       = NULL;
 314         ret->ordinal    = ordinal;
 315         ret->origESP    = ESP_reg(context);
 316
 317         EIP_reg(context)= (DWORD)fun->origfun;
 318
 319         DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
 320         if (fun->nrofargs>0) {
 321                 max = fun->nrofargs; if (max>16) max=16;
 322                 for (i=0;i<max;i++)
 323                         DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(ESP_reg(context)+4+sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
 324                 if (max!=fun->nrofargs)
 325                         DPRINTF(" ...");
 326         } else if (fun->nrofargs<0) {
 327                 DPRINTF("<unknown, check return>");
 328                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
 329                 memcpy(ret->args,(LPBYTE)(ESP_reg(context)+4),sizeof(DWORD)*16);
 330         }
 331         DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD)ret->origreturn,FS_reg(context));
 332 }
 333
 334 void WINAPI SNOOP_DoReturn( CONTEXT86 *context );
 335 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Return, SNOOP_DoReturn );
 336 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
 337 {
 338         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(EIP_reg(context)-5);
 339
 340         /* We haven't found out the nrofargs yet. If we called a cdecl
 341          * function it is too late anyway and we can just set '0' (which
 342          * will be the difference between orig and current ESP
 343          * If stdcall -> everything ok.
 344          */
 345         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 346                 ret->dll->funs[ret->ordinal].nrofargs=(ESP_reg(context)-ret->origESP-4)/4;
 347         EIP_reg(context) = (DWORD)ret->origreturn;
 348         if (ret->args) {
 349                 int     i,max;
 350
 351                 DPRINTF("Ret  %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
 352                 max = ret->dll->funs[ret->ordinal].nrofargs;
 353                 if (max>16) max=16;
 354
 355                 for (i=0;i<max;i++)
 356                         DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
 357                 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
 358                         EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
 359                 );
 360                 HeapFree(GetProcessHeap(),0,ret->args);
 361                 ret->args = NULL;
 362         } else
 363                 DPRINTF("Ret  %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
 364                         ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
 365                         EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
 366                 );
 367         ret->origreturn = NULL; /* mark as empty */
 368 }
 369 #else   /* !__i386__ */
 370 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
 371         FIXME("snooping works only on i386 for now.\n");
 372         return;
 373 }
 374
 375 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 376         return origfun;
 377 }
 378 #endif  /* !__i386__ */