2 * 386-specific Win32 dll<->dll snooping functions
4 * Copyright 1998 Marcus Meissner
13 #include "builtin32.h"
16 #include "selectors.h"
17 #include "stackframe.h"
23 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
25 #ifdef NEED_UNDERSCORE_PREFIX
31 /* Well, not exactly extern since they are in the same file (in the lines
32 * below). But the C Compiler doesn't see them there, so we have to help a bit.
34 extern void SNOOP_Return();
35 extern void SNOOP_Entry();
36 __asm__(".align 4\n\t"
37 ".globl "PREFIX"SNOOP_Entry\n\t"
38 ".type "PREFIX"SNOOP_Entry,@function\n\t"
39 PREFIX"SNOOP_Entry:\n\t"
40 "pushl $"PREFIX"__regs_SNOOP_Entry\n\t"
41 "pushl $"PREFIX"CALL32_Regs\n\t"
44 ".globl "PREFIX"SNOOP_Return\n\t"
45 ".type "PREFIX"SNOOP_Return,@function\n\t"
46 PREFIX"SNOOP_Return:\n\t"
47 "pushl $"PREFIX"__regs_SNOOP_Return\n\t"
48 "pushl $"PREFIX"CALL32_Regs\n\t"
54 typedef struct tagSNOOP_FUN {
56 BYTE lcall; /* 0xe8 call snoopentry (relative) */
57 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
60 DWORD snoopentry; /* SNOOP_Entry relative */
67 typedef struct tagSNOOP_DLL {
72 struct tagSNOOP_DLL *next;
74 typedef struct tagSNOOP_RETURNENTRY {
76 BYTE lcall; /* 0xe8 call snoopret relative*/
77 /* NOTE: If you move snoopret OR origreturn fix the relative offset
80 DWORD snoopret; /* SNOOP_Ret relative */
86 DWORD *args; /* saved args across a stdcall */
89 typedef struct tagSNOOP_RETURNENTRIES {
90 SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
91 struct tagSNOOP_RETURNENTRIES *next;
92 } SNOOP_RETURNENTRIES;
96 static SNOOP_DLL *firstdll = NULL;
97 static SNOOP_RETURNENTRIES *firstrets = NULL;
99 /***********************************************************************
100 * SNOOP_ShowDebugmsgSnoop
102 * Simple function to decide if a particular debugging message is
105 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
107 if(debug_snoop_excludelist || debug_snoop_includelist) {
110 int len, len2, itemlen, show;
112 if(debug_snoop_excludelist) {
114 listitem = debug_snoop_excludelist;
117 listitem = debug_snoop_includelist;
121 sprintf(buf, "%s.%d", dll, ord);
123 for(; *listitem; listitem++) {
124 itemlen = strlen(*listitem);
125 if((itemlen == len && !strncmp(*listitem, buf, len)) ||
126 (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
127 !strcmp(*listitem, fname)) {
138 SNOOP_RegisterDLL(HMODULE32 hmod,LPCSTR name,DWORD nrofordinals) {
139 SNOOP_DLL **dll = &(firstdll);
142 if (!TRACE_ON(snoop)) return;
144 if ((*dll)->hmod == hmod)
145 return; /* already registered */
146 dll = &((*dll)->next);
148 *dll = (SNOOP_DLL*)HeapAlloc(SystemHeap,HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
151 (*dll)->nrofordinals = nrofordinals;
152 (*dll)->name = HEAP_strdupA(SystemHeap,0,name);
153 if ((s=strrchr((*dll)->name,'.')))
155 (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
156 memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
158 HeapFree(SystemHeap,0,*dll);
159 FIXME(snoop,"out of memory\n");
165 SNOOP_GetProcAddress32(HMODULE32 hmod,LPCSTR name,DWORD ordinal,FARPROC32 origfun) {
166 SNOOP_DLL *dll = firstdll;
169 IMAGE_SECTION_HEADER *pe_seg = PE_SECTIONS(hmod);
171 if (!TRACE_ON(snoop)) return origfun;
172 if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
174 for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
175 /* 0x42 is special ELF loader tag */
176 if ((pe_seg[j].VirtualAddress==0x42) ||
177 (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
178 ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
179 pe_seg[j].SizeOfRawData
183 /* If we looked through all sections (and didn't find one)
184 * or if the sectionname contains "data", we return the
185 * original function since it is most likely a datareference.
187 if ( (j==PE_HEADER(hmod)->FileHeader.NumberOfSections) ||
188 (strstr(pe_seg[j].Name,"data")) ||
189 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
194 if (hmod == dll->hmod)
198 if (!dll) /* probably internal */
200 assert(ordinal<dll->nrofordinals);
201 fun = dll->funs+ordinal;
202 if (!fun->name) fun->name = HEAP_strdupA(SystemHeap,0,name);
204 /* NOTE: origreturn struct member MUST come directly after snoopentry */
205 fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
206 fun->origfun = origfun;
208 return (FARPROC32)&(fun->lcall);
212 SNOOP_PrintArg(DWORD x) {
213 static char buf[200];
215 MEMORY_BASIC_INFORMATION mbi;
218 !VirtualQuery((LPVOID)x,&mbi,sizeof(mbi)) ||
221 sprintf(buf,"%08lx",x);
225 if (!IsBadStringPtr32A((LPSTR)x,80)) {
230 if (s[i]<0x20) {nostring=1;break;}
231 if (s[i]>=0x80) {nostring=1;break;}
236 sprintf(buf,"%08lx \"",x);
237 strncat(buf,(LPSTR)x,198-strlen(buf)-2);
244 if (!IsBadStringPtr32W((LPWSTR)x,80)) {
249 if (s[i]<0x20) {nostring=1;break;}
250 if (s[i]>0x100) {nostring=1;break;}
255 sprintf(buf,"%08lx L",x);
256 strcat(buf,debugstr_wn((LPWSTR)x,198-strlen(buf)-2));
261 sprintf(buf,"%08lx",x);
265 #define CALLER1REF (*(DWORD*)(ESP_reg(context)+4))
266 REGS_ENTRYPOINT(SNOOP_Entry) {
267 DWORD ordinal=0,entry = EIP_reg(context)-5;
268 SNOOP_DLL *dll = firstdll;
269 SNOOP_FUN *fun = NULL;
270 SNOOP_RETURNENTRIES **rets = &firstrets;
271 SNOOP_RETURNENTRY *ret;
275 if ( ((char*)entry>=(char*)dll->funs) &&
276 ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
278 fun = (SNOOP_FUN*)entry;
279 ordinal = fun-dll->funs;
285 FIXME(snoop,"entrypoint 0x%08lx not found\n",entry);
288 if (!SNOOP_ShowDebugmsgSnoop(dll->name, ordinal, fun->name)) {
289 /* we don't display, so we don't need returndisplay either */
290 EIP_reg(context)= (DWORD)fun->origfun;
293 /* guess cdecl ... */
294 if (fun->nrofargs<0) {
295 /* Typical cdecl return frame is:
297 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
298 * (after that 81 C2 xx xx xx xx)
300 LPBYTE reteip = (LPBYTE)CALLER1REF;
303 if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
304 fun->nrofargs=reteip[2]/4;
310 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
311 if (!(*rets)->entry[i].origreturn)
313 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
315 rets = &((*rets)->next);
318 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
319 memset(*rets,0,4096);
320 i = 0; /* entry 0 is free */
322 ret = &((*rets)->entry[i]);
324 /* NOTE: origreturn struct member MUST come directly after snoopret */
325 ret->snoopret = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
326 ret->origreturn = (FARPROC32)CALLER1REF;
327 CALLER1REF = (DWORD)&ret->lcall;
330 ret->ordinal = ordinal;
331 ret->origESP = ESP_reg(context);
333 EIP_reg(context)= (DWORD)fun->origfun;
335 DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
336 if (fun->nrofargs>0) {
337 max = fun->nrofargs; if (max>16) max=16;
339 DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(ESP_reg(context)+8+sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
340 if (max!=fun->nrofargs)
342 } else if (fun->nrofargs<0) {
343 DPRINTF("<unknown, check return>");
344 ret->args = HeapAlloc(SystemHeap,0,16*sizeof(DWORD));
345 memcpy(ret->args,(LPBYTE)(ESP_reg(context)+8),sizeof(DWORD)*16);
347 DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD)ret->origreturn,FS_reg(context));
350 REGS_ENTRYPOINT(SNOOP_Return) {
351 SNOOP_RETURNENTRY *ret = (SNOOP_RETURNENTRY*)(EIP_reg(context)-5);
353 /* We haven't found out the nrofargs yet. If we called a cdecl
354 * function it is too late anyway and we can just set '0' (which
355 * will be the difference between orig and current ESP
356 * If stdcall -> everything ok.
358 if (ret->dll->funs[ret->ordinal].nrofargs<0)
359 ret->dll->funs[ret->ordinal].nrofargs=(ESP_reg(context)-ret->origESP-4)/4;
360 EIP_reg(context) = (DWORD)ret->origreturn;
364 DPRINTF("Ret %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
365 max = ret->dll->funs[ret->ordinal].nrofargs;
369 DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
370 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
371 EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
373 HeapFree(SystemHeap,0,ret->args);
376 DPRINTF("Ret %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
377 ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
378 EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
380 ret->origreturn = NULL; /* mark as empty */
382 #else /* !__i386__ */
383 void SNOOP_RegisterDLL(HMODULE32 hmod,LPCSTR name,DWORD nrofordinals) {
384 FIXME(snoop,"snooping works only on i386 for now.\n");
388 FARPROC32 SNOOP_GetProcAddress32(HMODULE32 hmod,LPCSTR name,DWORD ordinal,FARPROC32 origfun) {
391 #endif /* !__i386__ */