2 * 386-specific Win32 dll<->dll snooping functions
4 * Copyright 1998 Marcus Meissner
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
29 #include "stackframe.h"
30 #include "wine/debug.h"
31 #include "wine/exception.h"
32 #include "msvcrt/excpt.h"
34 WINE_DEFAULT_DEBUG_CHANNEL(snoop);
36 static WINE_EXCEPTION_FILTER(page_fault)
38 if (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ||
39 GetExceptionCode() == EXCEPTION_PRIV_INSTRUCTION)
40 return EXCEPTION_EXECUTE_HANDLER;
41 return EXCEPTION_CONTINUE_SEARCH;
44 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
48 extern void WINAPI SNOOP_Entry();
49 extern void WINAPI SNOOP_Return();
51 #ifdef NEED_UNDERSCORE_PREFIX
59 typedef struct tagSNOOP_FUN {
61 BYTE lcall; /* 0xe8 call snoopentry (relative) */
62 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
65 DWORD snoopentry; /* SNOOP_Entry relative */
72 typedef struct tagSNOOP_DLL {
77 struct tagSNOOP_DLL *next;
81 typedef struct tagSNOOP_RETURNENTRY {
83 BYTE lcall; /* 0xe8 call snoopret relative*/
84 /* NOTE: If you move snoopret OR origreturn fix the relative offset
87 DWORD snoopret; /* SNOOP_Ret relative */
93 DWORD *args; /* saved args across a stdcall */
96 typedef struct tagSNOOP_RETURNENTRIES {
97 SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
98 struct tagSNOOP_RETURNENTRIES *next;
99 } SNOOP_RETURNENTRIES;
103 static SNOOP_DLL *firstdll = NULL;
104 static SNOOP_RETURNENTRIES *firstrets = NULL;
106 /***********************************************************************
107 * SNOOP_ShowDebugmsgSnoop
109 * Simple function to decide if a particular debugging message is
112 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
114 if(debug_snoop_excludelist || debug_snoop_includelist) {
117 int len, len2, itemlen, show;
119 if(debug_snoop_excludelist) {
121 listitem = debug_snoop_excludelist;
124 listitem = debug_snoop_includelist;
128 sprintf(buf, "%s.%d", dll, ord);
130 for(; *listitem; listitem++) {
131 itemlen = strlen(*listitem);
132 if((itemlen == len && !strncasecmp(*listitem, buf, len)) ||
133 (itemlen == len2 && !strncasecmp(*listitem, buf, len2)) ||
134 !strcasecmp(*listitem, fname)) {
145 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD ordbase,DWORD nrofordinals) {
146 SNOOP_DLL **dll = &(firstdll);
149 if (!TRACE_ON(snoop)) return;
151 if ((*dll)->hmod == hmod)
152 return; /* already registered */
153 dll = &((*dll)->next);
155 *dll = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL)+strlen(name));
158 (*dll)->ordbase = ordbase;
159 (*dll)->nrofordinals = nrofordinals;
160 strcpy( (*dll)->name, name );
161 if ((s=strrchr((*dll)->name,'.')))
163 (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
164 memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
166 HeapFree(GetProcessHeap(),0,*dll);
167 FIXME("out of memory\n");
173 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
174 SNOOP_DLL *dll = firstdll;
177 IMAGE_SECTION_HEADER *pe_seg = PE_SECTIONS(hmod);
179 if (!TRACE_ON(snoop)) return origfun;
180 if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
182 for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
183 /* 0x42 is special ELF loader tag */
184 if ((pe_seg[j].VirtualAddress==0x42) ||
185 (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
186 ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
187 pe_seg[j].SizeOfRawData
191 /* If we looked through all sections (and didn't find one)
192 * or if the sectionname contains "data", we return the
193 * original function since it is most likely a datareference.
195 if ( (j==PE_HEADER(hmod)->FileHeader.NumberOfSections) ||
196 (strstr(pe_seg[j].Name,"data")) ||
197 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
202 if (hmod == dll->hmod)
206 if (!dll) /* probably internal */
208 if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
210 assert(ordinal < dll->nrofordinals);
211 fun = dll->funs+ordinal;
214 fun->name = HeapAlloc(GetProcessHeap(),0,strlen(name)+1);
215 strcpy( fun->name, name );
217 /* NOTE: origreturn struct member MUST come directly after snoopentry */
218 fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
219 fun->origfun = origfun;
222 return (FARPROC)&(fun->lcall);
226 SNOOP_PrintArg(DWORD x) {
227 static char buf[200];
229 char * volatile ret=0;
231 if ( !HIWORD(x) ) { /* trivial reject to avoid faults */
232 sprintf(buf,"%08lx",x);
240 if (s[i]<0x20) {nostring=1;break;}
241 if (s[i]>=0x80) {nostring=1;break;}
246 snprintf(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
251 __EXCEPT(page_fault){}
260 if (s[i]<0x20) {nostring=1;break;}
261 if (s[i]>0x100) {nostring=1;break;}
266 snprintf(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
271 __EXCEPT(page_fault){}
275 sprintf(buf,"%08lx",x);
279 #define CALLER1REF (*(DWORD*)context->Esp)
281 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
283 DWORD ordinal=0,entry = context->Eip - 5;
284 SNOOP_DLL *dll = firstdll;
285 SNOOP_FUN *fun = NULL;
286 SNOOP_RETURNENTRIES **rets = &firstrets;
287 SNOOP_RETURNENTRY *ret;
291 if ( ((char*)entry>=(char*)dll->funs) &&
292 ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
294 fun = (SNOOP_FUN*)entry;
295 ordinal = fun-dll->funs;
301 FIXME("entrypoint 0x%08lx not found\n",entry);
304 /* guess cdecl ... */
305 if (fun->nrofargs<0) {
306 /* Typical cdecl return frame is:
308 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
309 * (after that 81 C2 xx xx xx xx)
311 LPBYTE reteip = (LPBYTE)CALLER1REF;
314 if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
315 fun->nrofargs=reteip[2]/4;
321 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
322 if (!(*rets)->entry[i].origreturn)
324 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
326 rets = &((*rets)->next);
329 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
330 memset(*rets,0,4096);
331 i = 0; /* entry 0 is free */
333 ret = &((*rets)->entry[i]);
335 /* NOTE: origreturn struct member MUST come directly after snoopret */
336 ret->snoopret = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
337 ret->origreturn = (FARPROC)CALLER1REF;
338 CALLER1REF = (DWORD)&ret->lcall;
341 ret->ordinal = ordinal;
342 ret->origESP = context->Esp;
344 context->Eip = (DWORD)fun->origfun;
346 DPRINTF("%08lx:CALL %s.%ld: %s(",GetCurrentThreadId(),dll->name,dll->ordbase+ordinal,fun->name);
347 if (fun->nrofargs>0) {
348 max = fun->nrofargs; if (max>16) max=16;
350 DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
351 if (max!=fun->nrofargs)
353 } else if (fun->nrofargs<0) {
354 DPRINTF("<unknown, check return>");
355 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(DWORD));
356 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
358 DPRINTF(") ret=%08lx\n",(DWORD)ret->origreturn);
362 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
364 SNOOP_RETURNENTRY *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
366 /* We haven't found out the nrofargs yet. If we called a cdecl
367 * function it is too late anyway and we can just set '0' (which
368 * will be the difference between orig and current ESP
369 * If stdcall -> everything ok.
371 if (ret->dll->funs[ret->ordinal].nrofargs<0)
372 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
373 context->Eip = (DWORD)ret->origreturn;
377 DPRINTF("%08lx:RET %s.%ld: %s(",
378 GetCurrentThreadId(),
379 ret->dll->name,ret->dll->ordbase+ret->ordinal,ret->dll->funs[ret->ordinal].name);
380 max = ret->dll->funs[ret->ordinal].nrofargs;
384 DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
385 DPRINTF(") retval = %08lx ret=%08lx\n",
386 context->Eax,(DWORD)ret->origreturn );
387 HeapFree(GetProcessHeap(),0,ret->args);
390 DPRINTF("%08lx:RET %s.%ld: %s() retval = %08lx ret=%08lx\n",
391 GetCurrentThreadId(),
392 ret->dll->name,ret->dll->ordbase+ret->ordinal,ret->dll->funs[ret->ordinal].name,
393 context->Eax, (DWORD)ret->origreturn);
394 ret->origreturn = NULL; /* mark as empty */
397 /* assembly wrappers that save the context */
398 __ASM_GLOBAL_FUNC( SNOOP_Entry,
399 "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
400 ".long " __ASM_NAME("SNOOP_DoEntry") ",0" );
401 __ASM_GLOBAL_FUNC( SNOOP_Return,
402 "call " __ASM_NAME("__wine_call_from_32_regs") "\n\t"
403 ".long " __ASM_NAME("SNOOP_DoReturn") ",0" );
405 #else /* !__i386__ */
406 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
407 if (!TRACE_ON(snoop)) return;
408 FIXME("snooping works only on i386 for now.\n");
411 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
414 #endif /* !__i386__ */