relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21 #include "config.h"
  22
  23 #include <assert.h>
  24 #include <stdio.h>
  25 #include <string.h>
  26 #include "winbase.h"
  27 #include "winnt.h"
  28 #include "snoop.h"
  29 #include "stackframe.h"
  30 #include "wine/debug.h"
  31 #include "wine/exception.h"
  32 #include "msvcrt/excpt.h"
  33
  34 WINE_DEFAULT_DEBUG_CHANNEL(snoop);
  35
  36 static WINE_EXCEPTION_FILTER(page_fault)
  37 {
  38     if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ||
  39         GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION)
  40         return EXCEPTION_EXECUTE_HANDLER;
  41     return EXCEPTION_CONTINUE_SEARCH;
  42 }
  43
  44 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
  45
  46 #ifdef __i386__
  47
  48 extern void WINAPI SNOOP_Entry();
  49 extern void WINAPI SNOOP_Return();
  50
  51 #ifdef NEED_UNDERSCORE_PREFIX
  52 # define PREFIX "_"
  53 #else
  54 # define PREFIX
  55 #endif
  56
  57 #include "pshpack1.h"
  58
  59 typedef struct tagSNOOP_FUN {
  60         /* code part */
  61         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  62         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  63          * calculation!
  64          */
  65         DWORD           snoopentry;     /* SNOOP_Entry relative */
  66         /* unreached */
  67         int             nrofargs;
  68         FARPROC origfun;
  69         char            *name;
  70 } SNOOP_FUN;
  71
  72 typedef struct tagSNOOP_DLL {
  73         HMODULE hmod;
  74         SNOOP_FUN       *funs;
  75         DWORD           ordbase;
  76         DWORD           nrofordinals;
  77         struct tagSNOOP_DLL     *next;
  78         char name[1];
  79 } SNOOP_DLL;
  80
  81 typedef struct tagSNOOP_RETURNENTRY {
  82         /* code part */
  83         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  84         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  85          * calculation!
  86          */
  87         DWORD           snoopret;       /* SNOOP_Ret relative */
  88         /* unreached */
  89         FARPROC origreturn;
  90         SNOOP_DLL       *dll;
  91         DWORD           ordinal;
  92         DWORD           origESP;
  93         DWORD           *args;          /* saved args across a stdcall */
  94 } SNOOP_RETURNENTRY;
  95
  96 typedef struct tagSNOOP_RETURNENTRIES {
  97         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  98         struct tagSNOOP_RETURNENTRIES   *next;
  99 } SNOOP_RETURNENTRIES;
 100
 101 #include "poppack.h"
 102
 103 static  SNOOP_DLL               *firstdll = NULL;
 104 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
 105
 106 /***********************************************************************
 107  *          SNOOP_ShowDebugmsgSnoop
 108  *
 109  * Simple function to decide if a particular debugging message is
 110  * wanted.
 111  */
 112 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
 113
 114   if(debug_snoop_excludelist || debug_snoop_includelist) {
 115     char **listitem;
 116     char buf[80];
 117     int len, len2, itemlen, show;
 118
 119     if(debug_snoop_excludelist) {
 120       show = 1;
 121       listitem = debug_snoop_excludelist;
 122     } else {
 123       show = 0;
 124       listitem = debug_snoop_includelist;
 125     }
 126     len = strlen(dll);
 127     assert(len < 64);
 128     sprintf(buf, "%s.%d", dll, ord);
 129     len2 = strlen(buf);
 130     for(; *listitem; listitem++) {
 131       itemlen = strlen(*listitem);
 132       if((itemlen == len && !strncasecmp(*listitem, buf, len)) ||
 133          (itemlen == len2 && !strncasecmp(*listitem, buf, len2)) ||
 134          !strcasecmp(*listitem, fname)) {
 135         show = !show;
 136        break;
 137       }
 138     }
 139     return show;
 140   }
 141   return 1;
 142 }
 143
 144 void
 145 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD ordbase,DWORD nrofordinals) {
 146         SNOOP_DLL       **dll = &(firstdll);
 147         char            *s;
 148
 149     TRACE("hmod=%x, name=%s, ordbase=%ld, nrofordinals=%ld\n",
 150            hmod, name, ordbase, nrofordinals);
 151
 152         if (!TRACE_ON(snoop)) return;
 153         while (*dll) {
 154                 if ((*dll)->hmod == hmod)
 155                 {
 156                     /* another dll, loaded at the same address */
 157                     VirtualFree((*dll)->funs, (*dll)->nrofordinals*sizeof(SNOOP_FUN), MEM_RELEASE);
 158                     break;
 159                 }
 160                 dll = &((*dll)->next);
 161         }
 162         *dll = HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, *dll, sizeof(SNOOP_DLL)+strlen(name));
 163         (*dll)->hmod    = hmod;
 164         (*dll)->ordbase = ordbase;
 165         (*dll)->nrofordinals = nrofordinals;
 166         strcpy( (*dll)->name, name );
 167         if ((s=strrchr((*dll)->name,'.')))
 168                 *s='\0';
 169         (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 170         memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
 171         if (!(*dll)->funs) {
 172                 HeapFree(GetProcessHeap(),0,*dll);
 173                 FIXME("out of memory\n");
 174                 return;
 175         }
 176 }
 177
 178 FARPROC
 179 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 180         SNOOP_DLL                       *dll = firstdll;
 181         SNOOP_FUN                       *fun;
 182         int                             j;
 183         IMAGE_SECTION_HEADER            *pe_seg = PE_SECTIONS(hmod);
 184
 185         if (!TRACE_ON(snoop)) return origfun;
 186         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 187                 return origfun;
 188         for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
 189                 /* 0x42 is special ELF loader tag */
 190                 if ((pe_seg[j].VirtualAddress==0x42) ||
 191                     (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
 192                      ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
 193                                    pe_seg[j].SizeOfRawData
 194                    ))
 195                 )
 196                         break;
 197         /* If we looked through all sections (and didn't find one)
 198          * or if the sectionname contains "data", we return the
 199          * original function since it is most likely a datareference.
 200          */
 201         if (    (j==PE_HEADER(hmod)->FileHeader.NumberOfSections)       ||
 202                 (strstr(pe_seg[j].Name,"data"))                         ||
 203                 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
 204         )
 205                 return origfun;
 206
 207         while (dll) {
 208                 if (hmod == dll->hmod)
 209                         break;
 210                 dll=dll->next;
 211         }
 212         if (!dll)       /* probably internal */
 213                 return origfun;
 214         if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
 215                 return origfun;
 216         assert(ordinal < dll->nrofordinals);
 217         fun = dll->funs+ordinal;
 218         if (!fun->name)
 219           {
 220             fun->name = HeapAlloc(GetProcessHeap(),0,strlen(name)+1);
 221             strcpy( fun->name, name );
 222             fun->lcall  = 0xe8;
 223             /* NOTE: origreturn struct member MUST come directly after snoopentry */
 224             fun->snoopentry     = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 225             fun->origfun        = origfun;
 226             fun->nrofargs       = -1;
 227           }
 228         return (FARPROC)&(fun->lcall);
 229 }
 230
 231 static char*
 232 SNOOP_PrintArg(DWORD x) {
 233         static char     buf[200];
 234         int             i,nostring;
 235         char * volatile ret=0;
 236
 237         if ( !HIWORD(x) ) { /* trivial reject to avoid faults */
 238             sprintf(buf,"%08lx",x);
 239             return buf;
 240         }
 241         __TRY{
 242                 LPBYTE  s=(LPBYTE)x;
 243                 i=0;nostring=0;
 244                 while (i<80) {
 245                         if (s[i]==0) break;
 246                         if (s[i]<0x20) {nostring=1;break;}
 247                         if (s[i]>=0x80) {nostring=1;break;}
 248                         i++;
 249                 }
 250                 if (!nostring) {
 251                         if (i>5) {
 252                                 snprintf(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
 253                                 ret=buf;
 254                         }
 255                 }
 256         }
 257         __EXCEPT(page_fault){}
 258         __ENDTRY
 259         if (ret)
 260           return ret;
 261         __TRY{
 262                 LPWSTR  s=(LPWSTR)x;
 263                 i=0;nostring=0;
 264                 while (i<80) {
 265                         if (s[i]==0) break;
 266                         if (s[i]<0x20) {nostring=1;break;}
 267                         if (s[i]>0x100) {nostring=1;break;}
 268                         i++;
 269                 }
 270                 if (!nostring) {
 271                         if (i>5) {
 272                                 snprintf(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
 273                                 ret=buf;
 274                         }
 275                 }
 276         }
 277         __EXCEPT(page_fault){}
 278         __ENDTRY
 279         if (ret)
 280           return ret;
 281         sprintf(buf,"%08lx",x);
 282         return buf;
 283 }
 284
 285 #define CALLER1REF (*(DWORD*)context->Esp)
 286
 287 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
 288 {
 289         DWORD           ordinal=0,entry = context->Eip - 5;
 290         SNOOP_DLL       *dll = firstdll;
 291         SNOOP_FUN       *fun = NULL;
 292         SNOOP_RETURNENTRIES     **rets = &firstrets;
 293         SNOOP_RETURNENTRY       *ret;
 294         int             i=0, max;
 295
 296         while (dll) {
 297                 if (    ((char*)entry>=(char*)dll->funs)        &&
 298                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 299                 ) {
 300                         fun = (SNOOP_FUN*)entry;
 301                         ordinal = fun-dll->funs;
 302                         break;
 303                 }
 304                 dll=dll->next;
 305         }
 306         if (!dll) {
 307                 FIXME("entrypoint 0x%08lx not found\n",entry);
 308                 return; /* oops */
 309         }
 310         /* guess cdecl ... */
 311         if (fun->nrofargs<0) {
 312                 /* Typical cdecl return frame is:
 313                  *      add esp, xxxxxxxx
 314                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 315                  * (after that 81 C2 xx xx xx xx)
 316                  */
 317                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 318
 319                 if (reteip) {
 320                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 321                                 fun->nrofargs=reteip[2]/4;
 322                 }
 323         }
 324
 325
 326         while (*rets) {
 327                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 328                         if (!(*rets)->entry[i].origreturn)
 329                                 break;
 330                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 331                         break;
 332                 rets = &((*rets)->next);
 333         }
 334         if (!*rets) {
 335                 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 336                 memset(*rets,0,4096);
 337                 i = 0;  /* entry 0 is free */
 338         }
 339         ret = &((*rets)->entry[i]);
 340         ret->lcall      = 0xe8;
 341         /* NOTE: origreturn struct member MUST come directly after snoopret */
 342         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 343         ret->origreturn = (FARPROC)CALLER1REF;
 344         CALLER1REF      = (DWORD)&ret->lcall;
 345         ret->dll        = dll;
 346         ret->args       = NULL;
 347         ret->ordinal    = ordinal;
 348         ret->origESP    = context->Esp;
 349
 350         context->Eip = (DWORD)fun->origfun;
 351
 352         DPRINTF("%08lx:CALL %s.%ld: %s(",GetCurrentThreadId(),dll->name,dll->ordbase+ordinal,fun->name);
 353         if (fun->nrofargs>0) {
 354                 max = fun->nrofargs; if (max>16) max=16;
 355                 for (i=0;i<max;i++)
 356                         DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
 357                 if (max!=fun->nrofargs)
 358                         DPRINTF(" ...");
 359         } else if (fun->nrofargs<0) {
 360                 DPRINTF("<unknown, check return>");
 361                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
 362                 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
 363         }
 364         DPRINTF(") ret=%08lx\n",(DWORD)ret->origreturn);
 365 }
 366
 367
 368 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
 369 {
 370         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
 371
 372         /* We haven't found out the nrofargs yet. If we called a cdecl
 373          * function it is too late anyway and we can just set '0' (which
 374          * will be the difference between orig and current ESP
 375          * If stdcall -> everything ok.
 376          */
 377         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 378                 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
 379         context->Eip = (DWORD)ret->origreturn;
 380         if (ret->args) {
 381                 int     i,max;
 382
 383                 DPRINTF("%08lx:RET  %s.%ld: %s(",
 384                         GetCurrentThreadId(),
 385                         ret->dll->name,ret->dll->ordbase+ret->ordinal,ret->dll->funs[ret->ordinal].name);
 386                 max = ret->dll->funs[ret->ordinal].nrofargs;
 387                 if (max>16) max=16;
 388
 389                 for (i=0;i<max;i++)
 390                         DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
 391                 DPRINTF(") retval = %08lx ret=%08lx\n",
 392                         context->Eax,(DWORD)ret->origreturn );
 393                 HeapFree(GetProcessHeap(),0,ret->args);
 394                 ret->args = NULL;
 395         } else
 396                 DPRINTF("%08lx:RET  %s.%ld: %s() retval = %08lx ret=%08lx\n",
 397                         GetCurrentThreadId(),
 398                         ret->dll->name,ret->dll->ordbase+ret->ordinal,ret->dll->funs[ret->ordinal].name,
 399                         context->Eax, (DWORD)ret->origreturn);
 400         ret->origreturn = NULL; /* mark as empty */
 401 }
 402
 403 /* assembly wrappers that save the context */
 404 __ASM_GLOBAL_FUNC( SNOOP_Entry,
 405                    "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
 406                    ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
 407 __ASM_GLOBAL_FUNC( SNOOP_Return,
 408                    "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
 409                    ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
 410
 411 #else   /* !__i386__ */
 412 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
 413         if (!TRACE_ON(snoop)) return;
 414         FIXME("snooping works only on i386 for now.\n");
 415 }
 416
 417 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
 418         return origfun;
 419 }
 420 #endif  /* !__i386__ */