2 * KERNEL32 thunks and other undocumented stuff
4 * Copyright 1997-1998 Marcus Meissner
5 * Copyright 1998 Ulrich Weigand
13 #include "wine/winbase16.h"
21 #include "stackframe.h"
23 #include "selectors.h"
26 #include "debugtools.h"
27 #include "flatthunk.h"
31 DECLARE_DEBUG_CHANNEL(dosmem
)
32 DECLARE_DEBUG_CHANNEL(thunk
)
33 DECLARE_DEBUG_CHANNEL(win32
)
36 /***********************************************************************
38 * Win95 internal thunks *
40 ***********************************************************************/
42 /***********************************************************************
43 * Generates a FT_Prolog call.
45 * 0FB6D1 movzbl edx,cl
46 * 8B1495xxxxxxxx mov edx,[4*edx + targetTable]
47 * 68xxxxxxxx push FT_Prolog
50 static void _write_ftprolog(LPBYTE relayCode
,DWORD
*targetTable
) {
54 *x
++ = 0x0f;*x
++=0xb6;*x
++=0xd1; /* movzbl edx,cl */
55 *x
++ = 0x8B;*x
++=0x14;*x
++=0x95;*(DWORD
**)x
= targetTable
;
56 x
+=4; /* mov edx, [4*edx + targetTable] */
57 *x
++ = 0x68; *(DWORD
*)x
= (DWORD
)GetProcAddress(GetModuleHandleA("KERNEL32"),"FT_Prolog");
58 x
+=4; /* push FT_Prolog */
59 *x
++ = 0xC3; /* lret */
60 /* fill rest with 0xCC / int 3 */
63 /***********************************************************************
64 * _write_qtthunk (internal)
65 * Generates a QT_Thunk style call.
68 * 8A4DFC mov cl , [ebp-04]
69 * 8B148Dxxxxxxxx mov edx, [4*ecx + targetTable]
70 * B8yyyyyyyy mov eax, QT_Thunk
73 static void _write_qtthunk(
74 LPBYTE relayCode
, /* [in] start of QT_Thunk stub */
75 DWORD
*targetTable
/* [in] start of thunk (for index lookup) */
80 *x
++ = 0x33;*x
++=0xC9; /* xor ecx,ecx */
81 *x
++ = 0x8A;*x
++=0x4D;*x
++=0xFC; /* movb cl,[ebp-04] */
82 *x
++ = 0x8B;*x
++=0x14;*x
++=0x8D;*(DWORD
**)x
= targetTable
;
83 x
+=4; /* mov edx, [4*ecx + targetTable */
84 *x
++ = 0xB8; *(DWORD
*)x
= (DWORD
)GetProcAddress(GetModuleHandleA("KERNEL32"),"QT_Thunk");
85 x
+=4; /* mov eax , QT_Thunk */
86 *x
++ = 0xFF; *x
++ = 0xE0; /* jmp eax */
87 /* should fill the rest of the 32 bytes with 0xCC */
90 /***********************************************************************
93 static LPVOID
_loadthunk(LPCSTR module
, LPCSTR func
, LPCSTR module32
,
94 struct ThunkDataCommon
*TD32
, DWORD checksum
)
96 struct ThunkDataCommon
*TD16
;
100 if ((hmod
= LoadLibrary16(module
)) <= 32)
102 ERR_(thunk
)("(%s, %s, %s): Unable to load '%s', error %d\n",
103 module
, func
, module32
, module
, hmod
);
107 if ( !(ordinal
= NE_GetOrdinal(hmod
, func
))
108 || !(TD16
= PTR_SEG_TO_LIN(NE_GetEntryPointEx(hmod
, ordinal
, FALSE
))))
110 ERR_(thunk
)("(%s, %s, %s): Unable to find '%s'\n",
111 module
, func
, module32
, func
);
115 if (TD32
&& memcmp(TD16
->magic
, TD32
->magic
, 4))
117 ERR_(thunk
)("(%s, %s, %s): Bad magic %c%c%c%c (should be %c%c%c%c)\n",
118 module
, func
, module32
,
119 TD16
->magic
[0], TD16
->magic
[1], TD16
->magic
[2], TD16
->magic
[3],
120 TD32
->magic
[0], TD32
->magic
[1], TD32
->magic
[2], TD32
->magic
[3]);
124 if (TD32
&& TD16
->checksum
!= TD32
->checksum
)
126 ERR_(thunk
)("(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
127 module
, func
, module32
, TD16
->checksum
, TD32
->checksum
);
131 if (!TD32
&& checksum
&& checksum
!= *(LPDWORD
)TD16
)
133 ERR_(thunk
)("(%s, %s, %s): Wrong checksum %08lx (should be %08lx)\n",
134 module
, func
, module32
, *(LPDWORD
)TD16
, checksum
);
141 /***********************************************************************
142 * GetThunkStuff (KERNEL32.53)
144 LPVOID WINAPI
GetThunkStuff(LPSTR module
, LPSTR func
)
146 return _loadthunk(module
, func
, "<kernel>", NULL
, 0L);
149 /***********************************************************************
150 * GetThunkBuff (KERNEL32.52)
151 * Returns a pointer to ThkBuf in the 16bit library SYSTHUNK.DLL.
153 LPVOID WINAPI
GetThunkBuff(void)
155 return GetThunkStuff("SYSTHUNK.DLL", "ThkBuf");
158 /***********************************************************************
159 * ThunkConnect32 (KERNEL32)
160 * Connects a 32bit and a 16bit thunkbuffer.
162 UINT WINAPI
ThunkConnect32(
163 struct ThunkDataCommon
*TD
, /* [in/out] thunkbuffer */
164 LPSTR thunkfun16
, /* [in] win16 thunkfunction */
165 LPSTR module16
, /* [in] name of win16 dll */
166 LPSTR module32
, /* [in] name of win32 dll */
167 HMODULE hmod32
, /* [in] hmodule of win32 dll */
168 DWORD dwReason
/* [in] initialisation argument */
172 if (!lstrncmpA(TD
->magic
, "SL01", 4))
176 TRACE_(thunk
)("SL01 thunk %s (%lx) <- %s (%s), Reason: %ld\n",
177 module32
, (DWORD
)TD
, module16
, thunkfun16
, dwReason
);
179 else if (!lstrncmpA(TD
->magic
, "LS01", 4))
183 TRACE_(thunk
)("LS01 thunk %s (%lx) -> %s (%s), Reason: %ld\n",
184 module32
, (DWORD
)TD
, module16
, thunkfun16
, dwReason
);
188 ERR_(thunk
)("Invalid magic %c%c%c%c\n",
189 TD
->magic
[0], TD
->magic
[1], TD
->magic
[2], TD
->magic
[3]);
195 case DLL_PROCESS_ATTACH
:
197 struct ThunkDataCommon
*TD16
;
198 if (!(TD16
= _loadthunk(module16
, thunkfun16
, module32
, TD
, 0L)))
203 struct ThunkDataSL32
*SL32
= (struct ThunkDataSL32
*)TD
;
204 struct ThunkDataSL16
*SL16
= (struct ThunkDataSL16
*)TD16
;
205 struct SLTargetDB
*tdb
;
207 if (SL16
->fpData
== NULL
)
209 ERR_(thunk
)("ThunkConnect16 was not called!\n");
213 SL32
->data
= SL16
->fpData
;
215 tdb
= HeapAlloc(GetProcessHeap(), 0, sizeof(*tdb
));
216 tdb
->process
= PROCESS_Current();
217 tdb
->targetTable
= (DWORD
*)(thunkfun16
+ SL32
->offsetTargetTable
);
219 tdb
->next
= SL32
->data
->targetDB
; /* FIXME: not thread-safe! */
220 SL32
->data
->targetDB
= tdb
;
222 TRACE_(thunk
)("Process %08lx allocated TargetDB entry for ThunkDataSL %08lx\n",
223 (DWORD
)PROCESS_Current(), (DWORD
)SL32
->data
);
227 struct ThunkDataLS32
*LS32
= (struct ThunkDataLS32
*)TD
;
228 struct ThunkDataLS16
*LS16
= (struct ThunkDataLS16
*)TD16
;
230 LS32
->targetTable
= PTR_SEG_TO_LIN(LS16
->targetTable
);
232 /* write QT_Thunk and FT_Prolog stubs */
233 _write_qtthunk ((LPBYTE
)TD
+ LS32
->offsetQTThunk
, LS32
->targetTable
);
234 _write_ftprolog((LPBYTE
)TD
+ LS32
->offsetFTProlog
, LS32
->targetTable
);
239 case DLL_PROCESS_DETACH
:
247 /**********************************************************************
248 * QT_Thunk (KERNEL32)
250 * The target address is in EDX.
251 * The 16 bit arguments start at ESP.
252 * The number of 16bit argument bytes is EBP-ESP-0x40 (64 Byte thunksetup).
255 void WINAPI
REGS_FUNC(QT_Thunk
)( CONTEXT
*context
)
259 THDB
*thdb
= THREAD_Current();
261 memcpy(&context16
,context
,sizeof(context16
));
263 CS_reg(&context16
) = HIWORD(EDX_reg(context
));
264 IP_reg(&context16
) = LOWORD(EDX_reg(context
));
265 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
266 + (WORD
)&((STACK16FRAME
*)0)->bp
;
268 argsize
= EBP_reg(context
)-ESP_reg(context
)-0x40;
270 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
271 (LPBYTE
)ESP_reg(context
), argsize
);
273 EAX_reg(context
) = Callbacks
->CallRegisterShortProc( &context16
, argsize
);
274 EDX_reg(context
) = HIWORD(EAX_reg(context
));
275 EAX_reg(context
) = LOWORD(EAX_reg(context
));
279 /**********************************************************************
280 * FT_Prolog (KERNEL32.233)
282 * The set of FT_... thunk routines is used instead of QT_Thunk,
283 * if structures have to be converted from 32-bit to 16-bit
284 * (change of member alignment, conversion of members).
286 * The thunk function (as created by the thunk compiler) calls
287 * FT_Prolog at the beginning, to set up a stack frame and
288 * allocate a 64 byte buffer on the stack.
289 * The input parameters (target address and some flags) are
290 * saved for later use by FT_Thunk.
292 * Input: EDX 16-bit target address (SEGPTR)
293 * CX bits 0..7 target number (in target table)
294 * bits 8..9 some flags (unclear???)
295 * bits 10..15 number of DWORD arguments
297 * Output: A new stackframe is created, and a 64 byte buffer
298 * allocated on the stack. The layout of the stack
299 * on return is as follows:
301 * (ebp+4) return address to caller of thunk function
303 * (ebp-4) saved EBX register of caller
304 * (ebp-8) saved ESI register of caller
305 * (ebp-12) saved EDI register of caller
306 * (ebp-16) saved ECX register, containing flags
307 * (ebp-20) bitmap containing parameters that are to be converted
308 * by FT_Thunk; it is initialized to 0 by FT_Prolog and
309 * filled in by the thunk code before calling FT_Thunk
313 * (ebp-48) saved EAX register of caller (unclear, never restored???)
314 * (ebp-52) saved EDX register, containing 16-bit thunk target
319 * ESP is EBP-64 after return.
323 void WINAPI
REGS_FUNC(FT_Prolog
)( CONTEXT
*context
)
325 /* Build stack frame */
326 STACK32_PUSH(context
, EBP_reg(context
));
327 EBP_reg(context
) = ESP_reg(context
);
329 /* Allocate 64-byte Thunk Buffer */
330 ESP_reg(context
) -= 64;
331 memset((char *)ESP_reg(context
), '\0', 64);
333 /* Store Flags (ECX) and Target Address (EDX) */
334 /* Save other registers to be restored later */
335 *(DWORD
*)(EBP_reg(context
) - 4) = EBX_reg(context
);
336 *(DWORD
*)(EBP_reg(context
) - 8) = ESI_reg(context
);
337 *(DWORD
*)(EBP_reg(context
) - 12) = EDI_reg(context
);
338 *(DWORD
*)(EBP_reg(context
) - 16) = ECX_reg(context
);
340 *(DWORD
*)(EBP_reg(context
) - 48) = EAX_reg(context
);
341 *(DWORD
*)(EBP_reg(context
) - 52) = EDX_reg(context
);
344 /**********************************************************************
345 * FT_Thunk (KERNEL32.234)
347 * This routine performs the actual call to 16-bit code,
348 * similar to QT_Thunk. The differences are:
349 * - The call target is taken from the buffer created by FT_Prolog
350 * - Those arguments requested by the thunk code (by setting the
351 * corresponding bit in the bitmap at EBP-20) are converted
352 * from 32-bit pointers to segmented pointers (those pointers
353 * are guaranteed to point to structures copied to the stack
354 * by the thunk code, so we always use the 16-bit stack selector
355 * for those addresses).
357 * The bit #i of EBP-20 corresponds here to the DWORD starting at
360 * FIXME: It is unclear what happens if there are more than 32 WORDs
361 * of arguments, so that the single DWORD bitmap is no longer
365 void WINAPI
REGS_FUNC(FT_Thunk
)( CONTEXT
*context
)
367 DWORD mapESPrelative
= *(DWORD
*)(EBP_reg(context
) - 20);
368 DWORD callTarget
= *(DWORD
*)(EBP_reg(context
) - 52);
372 LPBYTE newstack
, oldstack
;
373 THDB
*thdb
= THREAD_Current();
375 memcpy(&context16
,context
,sizeof(context16
));
377 CS_reg(&context16
) = HIWORD(callTarget
);
378 IP_reg(&context16
) = LOWORD(callTarget
);
379 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
380 + (WORD
)&((STACK16FRAME
*)0)->bp
;
382 argsize
= EBP_reg(context
)-ESP_reg(context
)-0x40;
383 newstack
= ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
;
384 oldstack
= (LPBYTE
)ESP_reg(context
);
386 memcpy( newstack
, oldstack
, argsize
);
388 for (i
= 0; i
< 32; i
++) /* NOTE: What about > 32 arguments? */
389 if (mapESPrelative
& (1 << i
))
391 SEGPTR
*arg
= (SEGPTR
*)(newstack
+ 2*i
);
392 *arg
= PTR_SEG_OFF_TO_SEGPTR(SELECTOROF(thdb
->cur_stack
),
393 OFFSETOF(thdb
->cur_stack
) - argsize
394 + (*(LPBYTE
*)arg
- oldstack
));
397 EAX_reg(context
) = Callbacks
->CallRegisterShortProc( &context16
, argsize
);
398 EDX_reg(context
) = HIWORD(EAX_reg(context
));
399 EAX_reg(context
) = LOWORD(EAX_reg(context
));
402 /**********************************************************************
403 * FT_ExitNN (KERNEL32.218 - 232)
405 * One of the FT_ExitNN functions is called at the end of the thunk code.
406 * It removes the stack frame created by FT_Prolog, moves the function
407 * return from EBX to EAX (yes, FT_Thunk did use EAX for the return
408 * value, but the thunk code has moved it from EAX to EBX in the
409 * meantime ... :-), restores the caller's EBX, ESI, and EDI registers,
410 * and perform a return to the CALLER of the thunk code (while removing
411 * the given number of arguments from the caller's stack).
414 static void FT_Exit(CONTEXT
*context
, int nPopArgs
)
416 /* Return value is in EBX */
417 EAX_reg(context
) = EBX_reg(context
);
419 /* Restore EBX, ESI, and EDI registers */
420 EBX_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 4);
421 ESI_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 8);
422 EDI_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 12);
424 /* Clean up stack frame */
425 ESP_reg(context
) = EBP_reg(context
);
426 EBP_reg(context
) = STACK32_POP(context
);
428 /* Pop return address to CALLER of thunk code */
429 EIP_reg(context
) = STACK32_POP(context
);
430 /* Remove arguments */
431 ESP_reg(context
) += nPopArgs
;
434 void WINAPI
REGS_FUNC(FT_Exit0
)(CONTEXT
*context
) { FT_Exit(context
, 0); }
435 void WINAPI
REGS_FUNC(FT_Exit4
)(CONTEXT
*context
) { FT_Exit(context
, 4); }
436 void WINAPI
REGS_FUNC(FT_Exit8
)(CONTEXT
*context
) { FT_Exit(context
, 8); }
437 void WINAPI
REGS_FUNC(FT_Exit12
)(CONTEXT
*context
) { FT_Exit(context
, 12); }
438 void WINAPI
REGS_FUNC(FT_Exit16
)(CONTEXT
*context
) { FT_Exit(context
, 16); }
439 void WINAPI
REGS_FUNC(FT_Exit20
)(CONTEXT
*context
) { FT_Exit(context
, 20); }
440 void WINAPI
REGS_FUNC(FT_Exit24
)(CONTEXT
*context
) { FT_Exit(context
, 24); }
441 void WINAPI
REGS_FUNC(FT_Exit28
)(CONTEXT
*context
) { FT_Exit(context
, 28); }
442 void WINAPI
REGS_FUNC(FT_Exit32
)(CONTEXT
*context
) { FT_Exit(context
, 32); }
443 void WINAPI
REGS_FUNC(FT_Exit36
)(CONTEXT
*context
) { FT_Exit(context
, 36); }
444 void WINAPI
REGS_FUNC(FT_Exit40
)(CONTEXT
*context
) { FT_Exit(context
, 40); }
445 void WINAPI
REGS_FUNC(FT_Exit44
)(CONTEXT
*context
) { FT_Exit(context
, 44); }
446 void WINAPI
REGS_FUNC(FT_Exit48
)(CONTEXT
*context
) { FT_Exit(context
, 48); }
447 void WINAPI
REGS_FUNC(FT_Exit52
)(CONTEXT
*context
) { FT_Exit(context
, 52); }
448 void WINAPI
REGS_FUNC(FT_Exit56
)(CONTEXT
*context
) { FT_Exit(context
, 56); }
451 /**********************************************************************
452 * WOWCallback16 (KERNEL32.62)(WOW32.2)
453 * Calls a win16 function with a single DWORD argument.
457 DWORD WINAPI
WOWCallback16(
458 FARPROC16 fproc
, /* [in] win16 function to call */
459 DWORD arg
/* [in] single DWORD argument to function */
462 TRACE_(thunk
)("(%p,0x%08lx)...\n",fproc
,arg
);
463 ret
= Callbacks
->CallWOWCallbackProc(fproc
,arg
);
464 TRACE_(thunk
)("... returns %ld\n",ret
);
468 /**********************************************************************
469 * WOWCallback16Ex (KERNEL32.55)(WOW32.3)
470 * Calls a function in 16bit code.
474 BOOL WINAPI
WOWCallback16Ex(
475 FARPROC16 vpfn16
, /* [in] win16 function to call */
476 DWORD dwFlags
, /* [in] flags */
477 DWORD cbArgs
, /* [in] nr of arguments */
478 LPVOID pArgs
, /* [in] pointer to arguments (LPDWORD) */
479 LPDWORD pdwRetCode
/* [out] return value of win16 function */
481 return Callbacks
->CallWOWCallback16Ex(vpfn16
,dwFlags
,cbArgs
,pArgs
,pdwRetCode
);
484 /***********************************************************************
485 * ThunkInitLS (KERNEL32.43)
486 * A thunkbuffer link routine
487 * The thunkbuf looks like:
489 * 00: DWORD length ? don't know exactly
490 * 04: SEGPTR ptr ? where does it point to?
491 * The pointer ptr is written into the first DWORD of 'thunk'.
492 * (probably correct implemented)
495 * segmented pointer to thunk?
497 DWORD WINAPI
ThunkInitLS(
498 LPDWORD thunk
, /* [in] win32 thunk */
499 LPCSTR thkbuf
, /* [in] thkbuffer name in win16 dll */
500 DWORD len
, /* [in] thkbuffer length */
501 LPCSTR dll16
, /* [in] name of win16 dll */
502 LPCSTR dll32
/* [in] name of win32 dll (FIXME: not used?) */
506 if (!(addr
= _loadthunk( dll16
, thkbuf
, dll32
, NULL
, len
)))
511 *(DWORD
*)thunk
= addr
[1];
516 /***********************************************************************
517 * Common32ThkLS (KERNEL32.45)
519 * This is another 32->16 thunk, independent of the QT_Thunk/FT_Thunk
520 * style thunks. The basic difference is that the parameter conversion
521 * is done completely on the *16-bit* side here. Thus we do not call
522 * the 16-bit target directly, but call a common entry point instead.
523 * This entry function then calls the target according to the target
524 * number passed in the DI register.
526 * Input: EAX SEGPTR to the common 16-bit entry point
527 * CX offset in thunk table (target number * 4)
528 * DX error return value if execution fails (unclear???)
529 * EDX.HI number of DWORD parameters
531 * (Note that we need to move the thunk table offset from CX to DI !)
533 * The called 16-bit stub expects its stack to look like this:
535 * (esp+40) 32-bit arguments
537 * (esp+8) 32 byte of stack space available as buffer
538 * (esp) 8 byte return address for use with 0x66 lret
540 * The called 16-bit stub uses a 0x66 lret to return to 32-bit code,
541 * and uses the EAX register to return a DWORD return value.
542 * Thus we need to use a special assembly glue routine
543 * (CallRegisterLongProc instead of CallRegisterShortProc).
545 * Finally, we return to the caller, popping the arguments off
548 * FIXME: The called function uses EBX to return the number of
549 * arguments that are to be popped off the caller's stack.
550 * This is clobbered by the assembly glue, so we simply use
551 * the original EDX.HI to get the number of arguments.
552 * (Those two values should be equal anyway ...?)
555 void WINAPI
REGS_FUNC(Common32ThkLS
)( CONTEXT
*context
)
559 THDB
*thdb
= THREAD_Current();
561 memcpy(&context16
,context
,sizeof(context16
));
563 DI_reg(&context16
) = CX_reg(context
);
564 CS_reg(&context16
) = HIWORD(EAX_reg(context
));
565 IP_reg(&context16
) = LOWORD(EAX_reg(context
));
566 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
567 + (WORD
)&((STACK16FRAME
*)0)->bp
;
569 argsize
= HIWORD(EDX_reg(context
)) * 4;
571 /* FIXME: hack for stupid USER32 CallbackGlueLS routine */
572 if (EDX_reg(context
) == EIP_reg(context
))
575 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
576 (LPBYTE
)ESP_reg(context
), argsize
);
578 EAX_reg(context
) = Callbacks
->CallRegisterLongProc(&context16
, argsize
+ 32);
580 /* Clean up caller's stack frame */
581 ESP_reg(context
) += argsize
;
584 /***********************************************************************
585 * OT_32ThkLSF (KERNEL32.40)
587 * YET Another 32->16 thunk. The difference to Common32ThkLS is that
588 * argument processing is done on both the 32-bit and the 16-bit side:
589 * The 32-bit side prepares arguments, copying them onto the stack.
591 * When this routine is called, the first word on the stack is the
592 * number of argument bytes prepared by the 32-bit code, and EDX
593 * contains the 16-bit target address.
595 * The called 16-bit routine is another relaycode, doing further
596 * argument processing and then calling the real 16-bit target
597 * whose address is stored at [bp-04].
599 * The call proceeds using a normal CallRegisterShortProc.
600 * After return from the 16-bit relaycode, the arguments need
601 * to be copied *back* to the 32-bit stack, since the 32-bit
602 * relaycode processes output parameters.
604 * Note that we copy twice the number of arguments, since some of the
605 * 16-bit relaycodes in SYSTHUNK.DLL directly access the original
606 * arguments of the caller!
608 * (Note that this function seems only to be used for
609 * OLECLI32 -> OLECLI and OLESVR32 -> OLESVR thunking.)
611 void WINAPI
REGS_FUNC(OT_32ThkLSF
)( CONTEXT
*context
)
615 THDB
*thdb
= THREAD_Current();
617 memcpy(&context16
,context
,sizeof(context16
));
619 CS_reg(&context16
) = HIWORD(EDX_reg(context
));
620 IP_reg(&context16
) = LOWORD(EDX_reg(context
));
621 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
622 + (WORD
)&((STACK16FRAME
*)0)->bp
;
624 argsize
= 2 * *(WORD
*)ESP_reg(context
) + 2;
626 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
627 (LPBYTE
)ESP_reg(context
), argsize
);
629 EAX_reg(context
) = Callbacks
->CallRegisterShortProc(&context16
, argsize
);
631 memcpy( (LPBYTE
)ESP_reg(context
),
632 ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
, argsize
);
635 /***********************************************************************
636 * ThunkInitLSF (KERNEL32.41)
637 * A thunk setup routine.
638 * Expects a pointer to a preinitialized thunkbuffer in the first argument
640 * 00..03: unknown (pointer, check _41, _43, _46)
643 * 06..23: unknown (space for replacement code, check .90)
645 * 24:>E800000000 call offset 29
646 * 29:>58 pop eax ( target of call )
647 * 2A: 2D25000000 sub eax,0x00000025 ( now points to offset 4 )
648 * 2F: BAxxxxxxxx mov edx,xxxxxxxx
649 * 34: 68yyyyyyyy push KERNEL32.90
653 * 3E ... 59: unknown (space for replacement code?)
654 * 5A: E8xxxxxxxx call <32bitoffset xxxxxxxx>
656 * 60: 81EA25xxxxxx sub edx, 0x25xxxxxx
658 * 67: 68xxxxxxxx push xxxxxxxx
659 * 6C: 68yyyyyyyy push KERNEL32.89
662 * This function checks if the code is there, and replaces the yyyyyyyy entries
663 * by the functionpointers.
664 * The thunkbuf looks like:
666 * 00: DWORD length ? don't know exactly
667 * 04: SEGPTR ptr ? where does it point to?
668 * The segpointer ptr is written into the first DWORD of 'thunk'.
671 * unclear, pointer to win16 thkbuffer?
673 LPVOID WINAPI
ThunkInitLSF(
674 LPBYTE thunk
, /* [in] win32 thunk */
675 LPCSTR thkbuf
, /* [in] thkbuffer name in win16 dll */
676 DWORD len
, /* [in] length of thkbuffer */
677 LPCSTR dll16
, /* [in] name of win16 dll */
678 LPCSTR dll32
/* [in] name of win32 dll */
680 HMODULE hkrnl32
= GetModuleHandleA("KERNEL32");
683 /* FIXME: add checks for valid code ... */
684 /* write pointers to kernel32.89 and kernel32.90 (+ordinal base of 1) */
685 *(DWORD
*)(thunk
+0x35) = (DWORD
)GetProcAddress(hkrnl32
,(LPSTR
)90);
686 *(DWORD
*)(thunk
+0x6D) = (DWORD
)GetProcAddress(hkrnl32
,(LPSTR
)89);
689 if (!(addr
= _loadthunk( dll16
, thkbuf
, dll32
, NULL
, len
)))
692 addr2
= PTR_SEG_TO_LIN(addr
[1]);
694 *(DWORD
*)thunk
= (DWORD
)addr2
;
699 /***********************************************************************
700 * FT_PrologPrime (KERNEL32.89)
702 * This function is called from the relay code installed by
703 * ThunkInitLSF. It replaces the location from where it was
704 * called by a standard FT_Prolog call stub (which is 'primed'
705 * by inserting the correct target table pointer).
706 * Finally, it calls that stub.
708 * Input: ECX target number + flags (passed through to FT_Prolog)
709 * (ESP) offset of location where target table pointer
710 * is stored, relative to the start of the relay code
711 * (ESP+4) pointer to start of relay code
712 * (this is where the FT_Prolog call stub gets written to)
714 * Note: The two DWORD arguments get popped off the stack.
717 void WINAPI
REGS_FUNC(FT_PrologPrime
)( CONTEXT
*context
)
719 DWORD targetTableOffset
;
722 /* Compensate for the fact that the Wine register relay code thought
723 we were being called, although we were in fact jumped to */
724 ESP_reg(context
) -= 4;
726 /* Write FT_Prolog call stub */
727 targetTableOffset
= STACK32_POP(context
);
728 relayCode
= (LPBYTE
)STACK32_POP(context
);
729 _write_ftprolog( relayCode
, *(DWORD
**)(relayCode
+targetTableOffset
) );
731 /* Jump to the call stub just created */
732 EIP_reg(context
) = (DWORD
)relayCode
;
735 /***********************************************************************
736 * QT_ThunkPrime (KERNEL32.90)
738 * This function corresponds to FT_PrologPrime, but installs a
739 * call stub for QT_Thunk instead.
741 * Input: (EBP-4) target number (passed through to QT_Thunk)
742 * EDX target table pointer location offset
743 * EAX start of relay code
746 void WINAPI
REGS_FUNC(QT_ThunkPrime
)( CONTEXT
*context
)
748 DWORD targetTableOffset
;
751 /* Compensate for the fact that the Wine register relay code thought
752 we were being called, although we were in fact jumped to */
753 ESP_reg(context
) -= 4;
755 /* Write QT_Thunk call stub */
756 targetTableOffset
= EDX_reg(context
);
757 relayCode
= (LPBYTE
)EAX_reg(context
);
758 _write_qtthunk( relayCode
, *(DWORD
**)(relayCode
+targetTableOffset
) );
760 /* Jump to the call stub just created */
761 EIP_reg(context
) = (DWORD
)relayCode
;
764 /***********************************************************************
766 * Another thunkbuf link routine.
767 * The start of the thunkbuf looks like this:
769 * 04: SEGPTR address for thunkbuffer pointer
772 VOID WINAPI
ThunkInitSL(
773 LPBYTE thunk
, /* [in] start of thunkbuffer */
774 LPCSTR thkbuf
, /* [in] name/ordinal of thunkbuffer in win16 dll */
775 DWORD len
, /* [in] length of thunkbuffer */
776 LPCSTR dll16
, /* [in] name of win16 dll containing the thkbuf */
777 LPCSTR dll32
/* [in] win32 dll. FIXME: strange, unused */
781 if (!(addr
= _loadthunk( dll16
, thkbuf
, dll32
, NULL
, len
)))
784 *(DWORD
*)PTR_SEG_TO_LIN(addr
[1]) = (DWORD
)thunk
;
787 /**********************************************************************
792 BOOL WINAPI
SSInit16()
797 /**********************************************************************
798 * SSOnBigStack KERNEL32.87
799 * Check if thunking is initialized (ss selector set up etc.)
800 * We do that differently, so just return TRUE.
805 BOOL WINAPI
SSOnBigStack()
807 TRACE_(thunk
)("Yes, thunking is initialized\n");
811 /**********************************************************************
813 * One of the real thunking functions. This one seems to be for 32<->32
814 * thunks. It should probably be capable of crossing processboundaries.
816 * And YES, I've seen nr=48 (somewhere in the Win95 32<->16 OLE coupling)
819 DWORD WINAPIV
SSCall(
820 DWORD nr
, /* [in] number of argument bytes */
821 DWORD flags
, /* [in] FIXME: flags ? */
822 FARPROC fun
, /* [in] function to call */
823 ... /* [in/out] arguments */
826 DWORD
*args
= ((DWORD
*)&fun
) + 1;
829 dbg_decl_str(thunk
, 256);
831 dsprintf(thunk
,"0x%08lx,",args
[i
]);
832 TRACE_(thunk
)("(%ld,0x%08lx,%p,[%s])\n",
833 nr
,flags
,fun
,dbg_str(thunk
));
838 case 4: ret
= fun(args
[0]);
840 case 8: ret
= fun(args
[0],args
[1]);
842 case 12: ret
= fun(args
[0],args
[1],args
[2]);
844 case 16: ret
= fun(args
[0],args
[1],args
[2],args
[3]);
846 case 20: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4]);
848 case 24: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5]);
850 case 28: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6]);
852 case 32: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7]);
854 case 36: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8]);
856 case 40: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9]);
858 case 44: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9],args
[10]);
860 case 48: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9],args
[10],args
[11]);
863 WARN_(thunk
)("Unsupported nr of arguments, %ld\n",nr
);
868 TRACE_(thunk
)(" returning %ld ...\n",ret
);
872 /**********************************************************************
873 * W32S_BackTo32 (KERNEL32.51)
875 void WINAPI
REGS_FUNC(W32S_BackTo32
)( CONTEXT
*context
)
877 LPDWORD stack
= (LPDWORD
)ESP_reg( context
);
878 FARPROC proc
= (FARPROC
)EIP_reg(context
);
880 EAX_reg( context
) = proc( stack
[1], stack
[2], stack
[3], stack
[4], stack
[5],
881 stack
[6], stack
[7], stack
[8], stack
[9], stack
[10] );
883 EIP_reg( context
) = STACK32_POP(context
);
886 /**********************************************************************
887 * AllocSLCallback (KERNEL32)
889 * Win95 uses some structchains for callbacks. It allocates them
890 * in blocks of 100 entries, size 32 bytes each, layout:
892 * 0: PTR nextblockstart
894 * 8: WORD sel ( start points to blockstart)
898 * 18: PDB *owning_process;
901 * We ignore this for now. (Just a note for further developers)
902 * FIXME: use this method, so we don't waste selectors...
904 * Following code is then generated by AllocSLCallback. The code is 16 bit, so
905 * the 0x66 prefix switches from word->long registers.
908 * 6668x arg2 x pushl <arg2>
910 * EAx arg1 x jmpf <arg1>
912 * returns the startaddress of this thunk.
914 * Note, that they look very similair to the ones allocates by THUNK_Alloc.
916 * segmented pointer to the start of the thunk
920 DWORD finalizer
, /* [in] finalizer function */
921 DWORD callback
/* [in] callback function */
923 LPBYTE x
,thunk
= HeapAlloc( GetProcessHeap(), 0, 32 );
927 *x
++=0x66;*x
++=0x5a; /* popl edx */
928 *x
++=0x66;*x
++=0x68;*(DWORD
*)x
=finalizer
;x
+=4; /* pushl finalizer */
929 *x
++=0x66;*x
++=0x52; /* pushl edx */
930 *x
++=0xea;*(DWORD
*)x
=callback
;x
+=4; /* jmpf callback */
932 *(PDB
**)(thunk
+18) = PROCESS_Current();
934 sel
= SELECTOR_AllocBlock( thunk
, 32, SEGMENT_CODE
, FALSE
, FALSE
);
938 /**********************************************************************
939 * FreeSLCallback (KERNEL32.274)
940 * Frees the specified 16->32 callback
944 DWORD x
/* [in] 16 bit callback (segmented pointer?) */
946 FIXME_(win32
)("(0x%08lx): stub\n",x
);
950 /**********************************************************************
951 * GetTEBSelectorFS (KERNEL.475)
952 * Set the 16-bit %fs to the 32-bit %fs (current TEB selector)
954 VOID WINAPI
GetTEBSelectorFS16( CONTEXT
*context
)
956 GET_FS( FS_reg(context
) );
959 /**********************************************************************
960 * KERNEL_431 (KERNEL.431)
961 * IsPeFormat (W32SYS.2)
962 * Checks the passed filename if it is a PE format executeable
967 BOOL16 WINAPI
IsPeFormat16(
968 LPSTR fn
, /* [in] filename to executeable */
969 HFILE16 hf16
/* [in] open file, if filename is NULL */
971 IMAGE_DOS_HEADER mzh
;
972 HFILE hf
=FILE_GetHandle(hf16
);
977 hf
= OpenFile(fn
,&ofs
,OF_READ
);
981 _llseek(hf
,0,SEEK_SET
);
982 if (sizeof(mzh
)!=_lread(hf
,&mzh
,sizeof(mzh
))) {
986 if (mzh
.e_magic
!=IMAGE_DOS_SIGNATURE
) {
987 WARN_(dosmem
)("File has not got dos signature!\n");
991 _llseek(hf
,mzh
.e_lfanew
,SEEK_SET
);
992 if (sizeof(DWORD
)!=_lread(hf
,&xmagic
,sizeof(DWORD
))) {
997 return (xmagic
== IMAGE_NT_SIGNATURE
);
1000 /***********************************************************************
1001 * WOWHandle32 (KERNEL32.57)(WOW32.16)
1002 * Converts a win16 handle of type into the respective win32 handle.
1003 * We currently just return this handle, since most handles are the same
1004 * for win16 and win32.
1008 HANDLE WINAPI
WOWHandle32(
1009 WORD handle
, /* [in] win16 handle */
1010 WOW_HANDLE_TYPE type
/* [in] handle type */
1012 TRACE_(win32
)("(0x%04x,%d)\n",handle
,type
);
1013 return (HANDLE
)handle
;
1016 /***********************************************************************
1017 * K32Thk1632Prolog (KERNEL32.492)
1019 void WINAPI
REGS_FUNC(K32Thk1632Prolog
)( CONTEXT
*context
)
1021 LPBYTE code
= (LPBYTE
)EIP_reg(context
) - 5;
1023 /* Arrrgh! SYSTHUNK.DLL just has to re-implement another method
1024 of 16->32 thunks instead of using one of the standard methods!
1025 This means that SYSTHUNK.DLL itself switches to a 32-bit stack,
1026 and does a far call to the 32-bit code segment of OLECLI32/OLESVR32.
1027 Unfortunately, our CallTo/CallFrom mechanism is therefore completely
1028 bypassed, which means it will crash the next time the 32-bit OLE
1029 code thunks down again to 16-bit (this *will* happen!).
1031 The following hack tries to recognize this situation.
1032 This is possible since the called stubs in OLECLI32/OLESVR32 all
1033 look exactly the same:
1034 00 E8xxxxxxxx call K32Thk1632Prolog
1035 05 FF55FC call [ebp-04]
1036 08 E8xxxxxxxx call K32Thk1632Epilog
1039 If we recognize this situation, we try to simulate the actions
1040 of our CallTo/CallFrom mechanism by copying the 16-bit stack
1041 to our 32-bit stack, creating a proper STACK16FRAME and
1042 updating thdb->cur_stack. */
1044 if ( code
[5] == 0xFF && code
[6] == 0x55 && code
[7] == 0xFC
1045 && code
[13] == 0x66 && code
[14] == 0xCB)
1047 WORD stackSel
= NtCurrentTeb()->stack_sel
;
1048 DWORD stackBase
= GetSelectorBase(stackSel
);
1050 THDB
*thdb
= THREAD_Current();
1051 DWORD argSize
= EBP_reg(context
) - ESP_reg(context
);
1052 char *stack16
= (char *)ESP_reg(context
) - 4;
1053 char *stack32
= (char *)thdb
->cur_stack
- argSize
;
1054 STACK16FRAME
*frame16
= (STACK16FRAME
*)stack16
- 1;
1056 TRACE_(thunk
)("before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1057 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1059 memset(frame16
, '\0', sizeof(STACK16FRAME
));
1060 frame16
->frame32
= (STACK32FRAME
*)thdb
->cur_stack
;
1061 frame16
->ebp
= EBP_reg(context
);
1063 memcpy(stack32
, stack16
, argSize
);
1064 thdb
->cur_stack
= PTR_SEG_OFF_TO_SEGPTR(stackSel
, (DWORD
)frame16
- stackBase
);
1066 ESP_reg(context
) = (DWORD
)stack32
+ 4;
1067 EBP_reg(context
) = ESP_reg(context
) + argSize
;
1069 TRACE_(thunk
)("after SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1070 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1073 SYSLEVEL_ReleaseWin16Lock();
1076 /***********************************************************************
1077 * K32Thk1632Epilog (KERNEL32.491)
1079 void WINAPI
REGS_FUNC(K32Thk1632Epilog
)( CONTEXT
*context
)
1081 LPBYTE code
= (LPBYTE
)EIP_reg(context
) - 13;
1083 SYSLEVEL_RestoreWin16Lock();
1085 /* We undo the SYSTHUNK hack if necessary. See K32Thk1632Prolog. */
1087 if ( code
[5] == 0xFF && code
[6] == 0x55 && code
[7] == 0xFC
1088 && code
[13] == 0x66 && code
[14] == 0xCB)
1090 THDB
*thdb
= THREAD_Current();
1091 STACK16FRAME
*frame16
= (STACK16FRAME
*)PTR_SEG_TO_LIN(thdb
->cur_stack
);
1092 char *stack16
= (char *)(frame16
+ 1);
1093 DWORD argSize
= frame16
->ebp
- (DWORD
)stack16
;
1094 char *stack32
= (char *)frame16
->frame32
- argSize
;
1096 DWORD nArgsPopped
= ESP_reg(context
) - (DWORD
)stack32
;
1098 TRACE_(thunk
)("before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1099 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1101 thdb
->cur_stack
= (DWORD
)frame16
->frame32
;
1103 ESP_reg(context
) = (DWORD
)stack16
+ nArgsPopped
;
1104 EBP_reg(context
) = frame16
->ebp
;
1106 TRACE_(thunk
)("after SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1107 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1111 /***********************************************************************
1112 * UpdateResource32A (KERNEL32.707)
1114 BOOL WINAPI
UpdateResourceA(
1122 FIXME_(win32
)(": stub\n");
1123 SetLastError(ERROR_CALL_NOT_IMPLEMENTED
);
1127 /***********************************************************************
1128 * UpdateResource32W (KERNEL32.708)
1130 BOOL WINAPI
UpdateResourceW(
1138 FIXME_(win32
)(": stub\n");
1139 SetLastError(ERROR_CALL_NOT_IMPLEMENTED
);
1144 /***********************************************************************
1145 * WaitNamedPipe32A [KERNEL32.725]
1147 BOOL WINAPI
WaitNamedPipeA (LPCSTR lpNamedPipeName
, DWORD nTimeOut
)
1148 { FIXME_(win32
)("%s 0x%08lx\n",lpNamedPipeName
,nTimeOut
);
1149 SetLastError(ERROR_PIPE_NOT_CONNECTED
);
1152 /***********************************************************************
1153 * WaitNamedPipe32W [KERNEL32.726]
1155 BOOL WINAPI
WaitNamedPipeW (LPCWSTR lpNamedPipeName
, DWORD nTimeOut
)
1156 { FIXME_(win32
)("%s 0x%08lx\n",debugstr_w(lpNamedPipeName
),nTimeOut
);
1157 SetLastError(ERROR_PIPE_NOT_CONNECTED
);
1161 /*********************************************************************
1162 * PK16FNF [KERNEL32.91]
1164 * This routine fills in the supplied 13-byte (8.3 plus terminator)
1165 * string buffer with the 8.3 filename of a recently loaded 16-bit
1166 * module. It is unknown exactly what modules trigger this
1167 * mechanism or what purpose this serves. Win98 Explorer (and
1168 * probably also Win95 with IE 4 shell integration) calls this
1169 * several times during initialization.
1171 * FIXME: find out what this really does and make it work.
1173 void WINAPI
PK16FNF(LPSTR strPtr
)
1175 FIXME_(win32
)("(%p): stub\n", strPtr
);
1177 /* fill in a fake filename that'll be easy to recognize */
1178 lstrcpyA(strPtr
, "WINESTUB.FIX");