If VerQueryValueA is called with a PE resource, translate the call to
[wine] / if1632 / snoop.c
1 /*
2  * 386-specific Win16 dll<->dll snooping functions
3  *
4  * Copyright 1998 Marcus Meissner
5  */
6
7 #include <assert.h>
8 #include <string.h>
9 #include <stdio.h>
10 #include "winbase.h"
11 #include "windef.h"
12 #include "winnt.h"
13 #include "wine/winbase16.h"
14 #include "wine/library.h"
15 #include "heap.h"
16 #include "global.h"
17 #include "stackframe.h"
18 #include "builtin16.h"
19 #include "toolhelp.h"
20 #include "snoop.h"
21 #include "debugtools.h"
22
23 DEFAULT_DEBUG_CHANNEL(snoop);
24
25 #ifdef __i386__
26
27 #include "pshpack1.h"
28
29 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context);
30 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context);
31
32 typedef struct tagSNOOP16_FUN {
33         /* code part */
34         BYTE            lcall;          /* 0x9a call absolute with segment */
35         DWORD           snr;
36         /* unreached */
37         int             nrofargs;
38         FARPROC16       origfun;
39         char            *name;
40 } SNOOP16_FUN;
41
42 typedef struct tagSNOOP16_DLL {
43         HMODULE16       hmod;
44         HANDLE16        funhandle;
45         SNOOP16_FUN     *funs;
46         LPCSTR          name;
47         struct tagSNOOP16_DLL   *next;
48 } SNOOP16_DLL;
49
50 typedef struct tagSNOOP16_RETURNENTRY {
51         /* code part */
52         BYTE            lcall;          /* 0x9a call absolute with segment */
53         DWORD           snr;
54         /* unreached */
55         FARPROC16       origreturn;
56         SNOOP16_DLL     *dll;
57         DWORD           ordinal;
58         WORD            origSP;
59         WORD            *args;          /* saved args across a stdcall */
60 } SNOOP16_RETURNENTRY;
61
62 typedef struct tagSNOOP16_RETURNENTRIES {
63         SNOOP16_RETURNENTRY entry[65500/sizeof(SNOOP16_RETURNENTRY)];
64         HANDLE16        rethandle;
65         struct tagSNOOP16_RETURNENTRIES *next;
66 } SNOOP16_RETURNENTRIES;
67
68 typedef struct tagSNOOP16_RELAY {
69         WORD            pushbp;         /* 0x5566 */
70         BYTE            pusheax;        /* 0x50 */
71         WORD            pushax;         /* 0x5066 */
72         BYTE            pushl;          /* 0x68 */
73         DWORD           realfun;        /* SNOOP16_Return */
74         BYTE            lcall;          /* 0x9a call absolute with segment */
75         DWORD           callfromregs;
76         WORD            seg;
77         WORD            lret;           /* 0xcb66 */
78 } SNOOP16_RELAY;
79
80 #include "poppack.h"
81
82 static  SNOOP16_DLL             *firstdll = NULL;
83 static  SNOOP16_RETURNENTRIES   *firstrets = NULL;
84 static  SNOOP16_RELAY           *snr;
85 static  HANDLE16                xsnr = 0;
86
87 void
88 SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
89         SNOOP16_DLL     **dll = &(firstdll);
90         char            *s;
91
92         if (!TRACE_ON(snoop)) return;
93         if (!snr) {
94                 xsnr=GLOBAL_Alloc(GMEM_ZEROINIT,2*sizeof(*snr),0,WINE_LDT_FLAGS_CODE|WINE_LDT_FLAGS_32BIT);
95                 snr = GlobalLock16(xsnr);
96                 snr[0].pushbp   = 0x5566;
97                 snr[0].pusheax  = 0x50;
98                 snr[0].pushax   = 0x5066;
99                 snr[0].pushl    = 0x68;
100                 snr[0].realfun  = (DWORD)SNOOP16_Entry;
101                 snr[0].lcall    = 0x9a;
102                 snr[0].callfromregs = (DWORD)__wine_call_from_16_regs;
103                 snr[0].seg      = __get_cs();
104                 snr[0].lret     = 0xcb66;
105
106                 snr[1].pushbp   = 0x5566;
107                 snr[1].pusheax  = 0x50;
108                 snr[1].pushax   = 0x5066;
109                 snr[1].pushl    = 0x68;
110                 snr[1].realfun  = (DWORD)SNOOP16_Return;
111                 snr[1].lcall    = 0x9a;
112                 snr[1].callfromregs = (DWORD)__wine_call_from_16_regs;
113                 snr[1].seg      = __get_cs();
114                 snr[1].lret     = 0xcb66;
115         }
116         while (*dll) {
117                 if ((*dll)->hmod == pModule->self)
118                         return; /* already registered */
119                 dll = &((*dll)->next);
120         }
121         *dll = (SNOOP16_DLL*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(SNOOP16_DLL));
122         (*dll)->next    = NULL;
123         (*dll)->hmod    = pModule->self;
124         if ((s=strrchr(name,'\\')))
125                 name = s+1;
126         (*dll)->name    = HEAP_strdupA(GetProcessHeap(),0,name);
127         if ((s=strrchr((*dll)->name,'.')))
128                 *s='\0';
129         (*dll)->funhandle = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,WINE_LDT_FLAGS_CODE));
130         (*dll)->funs = GlobalLock16((*dll)->funhandle);
131         if (!(*dll)->funs) {
132                 HeapFree(GetProcessHeap(),0,*dll);
133                 FIXME("out of memory\n");
134                 return;
135         }
136 }
137
138 FARPROC16
139 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
140         SNOOP16_DLL                     *dll = firstdll;
141         SNOOP16_FUN                     *fun;
142         NE_MODULE                       *pModule = NE_GetPtr(hmod);
143         unsigned char                   *cpnt;
144         char                            name[200];
145
146         if (!TRACE_ON(snoop) || !pModule || !HIWORD(origfun))
147                 return origfun;
148         if (!*(LPBYTE)MapSL((SEGPTR)origfun)) /* 0x00 is an imposs. opcode, poss. dataref. */
149                 return origfun;
150         while (dll) {
151                 if (hmod == dll->hmod)
152                         break;
153                 dll=dll->next;
154         }
155         if (!dll)       /* probably internal */
156                 return origfun;
157         if (ordinal>65535/sizeof(SNOOP16_FUN))
158                 return origfun;
159         fun = dll->funs+ordinal;
160         /* already done? */
161         fun->lcall      = 0x9a;
162         fun->snr        = MAKELONG(0,xsnr);
163         fun->origfun    = origfun;
164         if (fun->name)
165                 return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
166         cpnt = (unsigned char *)pModule + pModule->name_table;
167         while (*cpnt) {
168                 cpnt += *cpnt + 1 + sizeof(WORD);
169                 if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
170                         sprintf(name,"%.*s",*cpnt,cpnt+1);
171                         break;
172                 }
173         }
174         /* Now search the non-resident names table */
175
176         if (!*cpnt && pModule->nrname_handle) {
177                 cpnt = (char *)GlobalLock16( pModule->nrname_handle );
178                 while (*cpnt) {
179                         cpnt += *cpnt + 1 + sizeof(WORD);
180                         if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
181                                     sprintf(name,"%.*s",*cpnt,cpnt+1);
182                                     break;
183                         }
184                 }
185         }
186         if (*cpnt)
187                 fun->name = HEAP_strdupA(GetProcessHeap(),0,name);
188         else
189                 fun->name = HEAP_strdupA(GetProcessHeap(),0,"");
190         if (!SNOOP_ShowDebugmsgSnoop(dll->name, ordinal, fun->name))
191                 return origfun;
192
193         /* more magic. do not try to snoop thunk data entries (MMSYSTEM) */
194         if (strchr(fun->name,'_')) {
195                 char *s=strchr(fun->name,'_');
196
197                 if (!strncasecmp(s,"_thunkdata",10)) {
198                         HeapFree(GetProcessHeap(),0,fun->name);
199                         fun->name = NULL;
200                         return origfun;
201                 }
202         }
203         fun->lcall      = 0x9a;
204         fun->snr        = MAKELONG(0,xsnr);
205         fun->origfun    = origfun;
206         fun->nrofargs   = -1;
207         return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
208 }
209
210 #define CALLER1REF (*(DWORD*)(MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)+4))))
211 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
212         DWORD           ordinal=0;
213         DWORD           entry=(DWORD)MapSL( MAKESEGPTR(context->SegCs,LOWORD(context->Eip)) )-5;
214         WORD            xcs = context->SegCs;
215         SNOOP16_DLL     *dll = firstdll;
216         SNOOP16_FUN     *fun = NULL;
217         SNOOP16_RETURNENTRIES   **rets = &firstrets;
218         SNOOP16_RETURNENTRY     *ret;
219         int             i=0, max;
220
221         while (dll) {
222                 if (xcs == dll->funhandle) {
223                         fun = (SNOOP16_FUN*)entry;
224                         ordinal = fun-dll->funs;
225                         break;
226                 }
227                 dll=dll->next;
228         }
229         if (!dll) {
230                 FIXME("entrypoint 0x%08lx not found\n",entry);
231                 return; /* oops */
232         }
233         while (*rets) {
234                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
235                         if (!(*rets)->entry[i].origreturn)
236                                 break;
237                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
238                         break;
239                 rets = &((*rets)->next);
240         }
241         if (!*rets) {
242                 HANDLE16 hand = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,WINE_LDT_FLAGS_CODE));
243                 *rets = GlobalLock16(hand);
244                 (*rets)->rethandle = hand;
245                 i = 0;  /* entry 0 is free */
246         }
247         ret = &((*rets)->entry[i]);
248         ret->lcall      = 0x9a;
249         ret->snr        = MAKELONG(sizeof(SNOOP16_RELAY),xsnr);
250         ret->origreturn = (FARPROC16)CALLER1REF;
251         CALLER1REF      = MAKELONG((char*)&(ret->lcall)-(char*)((*rets)->entry),(*rets)->rethandle);
252         ret->dll        = dll;
253         ret->args       = NULL;
254         ret->ordinal    = ordinal;
255         ret->origSP     = LOWORD(context->Esp);
256
257         context->Eip= LOWORD(fun->origfun);
258         context->SegCs = HIWORD(fun->origfun);
259
260
261         DPRINTF("CALL %s.%ld: %s(",dll->name,ordinal,fun->name);
262         if (fun->nrofargs>0) {
263                 max = fun->nrofargs;
264                 if (max>16) max=16;
265                 for (i=max;i--;)
266                         DPRINTF("%04x%s",*(WORD*)((char *) MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)) )+8+sizeof(WORD)*i),i?",":"");
267                 if (max!=fun->nrofargs)
268                         DPRINTF(" ...");
269         } else if (fun->nrofargs<0) {
270                 DPRINTF("<unknown, check return>");
271                 ret->args = HeapAlloc(GetProcessHeap(),0,16*sizeof(WORD));
272                 memcpy(ret->args,(LPBYTE)((char *) MapSL( MAKESEGPTR(context->SegSs,LOWORD(context->Esp)) )+8),sizeof(WORD)*16);
273         }
274         DPRINTF(") ret=%04x:%04x\n",HIWORD(ret->origreturn),LOWORD(ret->origreturn));
275 }
276
277 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
278         SNOOP16_RETURNENTRY     *ret = (SNOOP16_RETURNENTRY*)((char *) MapSL( MAKESEGPTR(context->SegCs,LOWORD(context->Eip)) )-5);
279
280         /* We haven't found out the nrofargs yet. If we called a cdecl
281          * function it is too late anyway and we can just set '0' (which 
282          * will be the difference between orig and current SP
283          * If pascal -> everything ok.
284          */
285         if (ret->dll->funs[ret->ordinal].nrofargs<0) {
286                 ret->dll->funs[ret->ordinal].nrofargs=(LOWORD(context->Esp)-ret->origSP-4)/2;
287         }
288         context->Eip = LOWORD(ret->origreturn);
289         context->SegCs  = HIWORD(ret->origreturn);
290         if (ret->args) {
291                 int     i,max;
292
293                 DPRINTF("RET  %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
294                 max = ret->dll->funs[ret->ordinal].nrofargs;
295                 if (max>16)
296                         max=16;
297                 if (max<0) 
298                         max=0;
299
300                 for (i=max;i--;)
301                         DPRINTF("%04x%s",ret->args[i],i?",":"");
302                 if (max!=ret->dll->funs[ret->ordinal].nrofargs)
303                         DPRINTF(" ...");
304                 DPRINTF(") retval = %04x:%04x ret=%04x:%04x\n",
305                         DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
306                 );
307                 HeapFree(GetProcessHeap(),0,ret->args);
308                 ret->args = NULL;
309         } else
310                 DPRINTF("RET  %s.%ld: %s() retval = %04x:%04x ret=%04x:%04x\n",
311                         ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
312                         DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
313                 );
314         ret->origreturn = NULL; /* mark as empty */
315 }
316 #else   /* !__i386__ */
317 void SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
318         if (!TRACE_ON(snoop)) return;
319         FIXME("snooping works only on i386 for now.\n");
320 }
321
322 FARPROC16 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
323         return origfun;
324 }
325 #endif  /* !__i386__ */
326