2 * 386-specific Win16 dll<->dll snooping functions
4 * Copyright 1998 Marcus Meissner
13 #include "selectors.h"
14 #include "stackframe.h"
15 #include "builtin16.h"
18 #include "debugtools.h"
20 DEFAULT_DEBUG_CHANNEL(snoop)
26 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context);
27 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context);
29 typedef struct tagSNOOP16_FUN {
31 BYTE lcall; /* 0x9a call absolute with segment */
39 typedef struct tagSNOOP16_DLL {
44 struct tagSNOOP16_DLL *next;
47 typedef struct tagSNOOP16_RETURNENTRY {
49 BYTE lcall; /* 0x9a call absolute with segment */
56 WORD *args; /* saved args across a stdcall */
57 } SNOOP16_RETURNENTRY;
59 typedef struct tagSNOOP16_RETURNENTRIES {
60 SNOOP16_RETURNENTRY entry[65500/sizeof(SNOOP16_RETURNENTRY)];
62 struct tagSNOOP16_RETURNENTRIES *next;
63 } SNOOP16_RETURNENTRIES;
65 typedef struct tagSNOOP16_RELAY {
66 WORD pushbp; /* 0x5566 */
67 BYTE pusheax; /* 0x50 */
68 WORD pushax; /* 0x5066 */
69 BYTE pushl; /* 0x68 */
70 DWORD realfun; /* SNOOP16_Return */
71 BYTE lcall; /* 0x9a call absolute with segment */
74 WORD lret; /* 0xcb66 */
79 static SNOOP16_DLL *firstdll = NULL;
80 static SNOOP16_RETURNENTRIES *firstrets = NULL;
81 static SNOOP16_RELAY *snr;
82 static HANDLE16 xsnr = 0;
85 SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
86 SNOOP16_DLL **dll = &(firstdll);
89 if (!TRACE_ON(snoop)) return;
91 xsnr=GLOBAL_Alloc(GMEM_ZEROINIT,2*sizeof(*snr),0,TRUE,TRUE,FALSE);
92 snr = GlobalLock16(xsnr);
93 snr[0].pushbp = 0x5566;
94 snr[0].pusheax = 0x50;
95 snr[0].pushax = 0x5066;
97 snr[0].realfun = (DWORD)SNOOP16_Entry;
99 snr[0].callfromregs = (DWORD)CallFrom16Register;
101 snr[0].lret = 0xcb66;
103 snr[1].pushbp = 0x5566;
104 snr[1].pusheax = 0x50;
105 snr[1].pushax = 0x5066;
107 snr[1].realfun = (DWORD)SNOOP16_Return;
109 snr[1].callfromregs = (DWORD)CallFrom16Register;
111 snr[1].lret = 0xcb66;
114 if ((*dll)->hmod == pModule->self)
115 return; /* already registered */
116 dll = &((*dll)->next);
118 *dll = (SNOOP16_DLL*)HeapAlloc(SystemHeap,HEAP_ZERO_MEMORY,sizeof(SNOOP16_DLL));
120 (*dll)->hmod = pModule->self;
121 if ((s=strrchr(name,'\\')))
123 (*dll)->name = HEAP_strdupA(SystemHeap,0,name);
124 if ((s=strrchr((*dll)->name,'.')))
126 (*dll)->funhandle = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,TRUE,FALSE,FALSE));
127 (*dll)->funs = GlobalLock16((*dll)->funhandle);
129 HeapFree(SystemHeap,0,*dll);
130 FIXME("out of memory\n");
133 memset((*dll)->funs,0,65535);
137 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
138 SNOOP16_DLL *dll = firstdll;
140 NE_MODULE *pModule = NE_GetPtr(hmod);
144 if (!TRACE_ON(snoop) || !pModule || !HIWORD(origfun))
146 if (!*(LPBYTE)PTR_SEG_TO_LIN(origfun)) /* 0x00 is an imposs. opcode, poss. dataref. */
149 if (hmod == dll->hmod)
153 if (!dll) /* probably internal */
155 if (ordinal>65535/sizeof(SNOOP16_FUN))
157 fun = dll->funs+ordinal;
160 fun->snr = MAKELONG(0,xsnr);
161 fun->origfun = origfun;
163 return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
164 cpnt = (unsigned char *)pModule + pModule->name_table;
166 cpnt += *cpnt + 1 + sizeof(WORD);
167 if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
168 sprintf(name,"%.*s",*cpnt,cpnt+1);
172 /* Now search the non-resident names table */
174 if (!*cpnt && pModule->nrname_handle) {
175 cpnt = (char *)GlobalLock16( pModule->nrname_handle );
177 cpnt += *cpnt + 1 + sizeof(WORD);
178 if (*(WORD*)(cpnt+*cpnt+1) == ordinal) {
179 sprintf(name,"%.*s",*cpnt,cpnt+1);
185 fun->name = HEAP_strdupA(SystemHeap,0,name);
187 fun->name = HEAP_strdupA(SystemHeap,0,"");
188 if (!SNOOP_ShowDebugmsgSnoop(dll->name, ordinal, fun->name))
191 /* more magic. do not try to snoop thunk data entries (MMSYSTEM) */
192 if (strchr(fun->name,'_')) {
193 char *s=strchr(fun->name,'_');
195 if (!strncasecmp(s,"_thunkdata",10)) {
196 HeapFree(SystemHeap,0,fun->name);
202 fun->snr = MAKELONG(0,xsnr);
203 fun->origfun = origfun;
205 return (FARPROC16)(SEGPTR)MAKELONG(((char*)fun-(char*)dll->funs),dll->funhandle);
208 #define CALLER1REF (*(DWORD*)(PTR_SEG_OFF_TO_LIN(SS_reg(context),LOWORD(ESP_reg(context))+4)))
209 void WINAPI SNOOP16_Entry(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
211 DWORD entry=(DWORD)PTR_SEG_OFF_TO_LIN(CS_reg(context),LOWORD(EIP_reg(context)))-5;
212 WORD xcs = CS_reg(context);
213 SNOOP16_DLL *dll = firstdll;
214 SNOOP16_FUN *fun = NULL;
215 SNOOP16_RETURNENTRIES **rets = &firstrets;
216 SNOOP16_RETURNENTRY *ret;
220 if (xcs == dll->funhandle) {
221 fun = (SNOOP16_FUN*)entry;
222 ordinal = fun-dll->funs;
228 FIXME("entrypoint 0x%08lx not found\n",entry);
232 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
233 if (!(*rets)->entry[i].origreturn)
235 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
237 rets = &((*rets)->next);
240 HANDLE16 hand = GlobalHandleToSel16(GLOBAL_Alloc(GMEM_ZEROINIT,65535,0,TRUE,FALSE,FALSE));
241 *rets = GlobalLock16(hand);
242 memset(*rets,0,65535);
243 (*rets)->rethandle = hand;
244 i = 0; /* entry 0 is free */
246 ret = &((*rets)->entry[i]);
248 ret->snr = MAKELONG(sizeof(SNOOP16_RELAY),xsnr);
249 ret->origreturn = (FARPROC16)CALLER1REF;
250 CALLER1REF = MAKELONG((char*)&(ret->lcall)-(char*)((*rets)->entry),(*rets)->rethandle);
253 ret->ordinal = ordinal;
254 ret->origSP = LOWORD(ESP_reg(context));
256 EIP_reg(context)= LOWORD(fun->origfun);
257 CS_reg(context) = HIWORD(fun->origfun);
260 DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
261 if (fun->nrofargs>0) {
265 DPRINTF("%04x%s",*(WORD*)((char *) PTR_SEG_OFF_TO_LIN(SS_reg(context),LOWORD(ESP_reg(context)))+8+sizeof(WORD)*i),i?",":"");
266 if (max!=fun->nrofargs)
268 } else if (fun->nrofargs<0) {
269 DPRINTF("<unknown, check return>");
270 ret->args = HeapAlloc(SystemHeap,0,16*sizeof(WORD));
271 memcpy(ret->args,(LPBYTE)((char *) PTR_SEG_OFF_TO_LIN(SS_reg(context),LOWORD(ESP_reg(context)))+8),sizeof(WORD)*16);
273 DPRINTF(") ret=%04x:%04x\n",HIWORD(ret->origreturn),LOWORD(ret->origreturn));
276 void WINAPI SNOOP16_Return(FARPROC proc, LPBYTE args, CONTEXT86 *context) {
277 SNOOP16_RETURNENTRY *ret = (SNOOP16_RETURNENTRY*)((char *) PTR_SEG_OFF_TO_LIN(CS_reg(context),LOWORD(EIP_reg(context)))-5);
279 /* We haven't found out the nrofargs yet. If we called a cdecl
280 * function it is too late anyway and we can just set '0' (which
281 * will be the difference between orig and current SP
282 * If pascal -> everything ok.
284 if (ret->dll->funs[ret->ordinal].nrofargs<0) {
285 ret->dll->funs[ret->ordinal].nrofargs=(LOWORD(ESP_reg(context))-ret->origSP-4)/2;
287 EIP_reg(context) = LOWORD(ret->origreturn);
288 CS_reg(context) = HIWORD(ret->origreturn);
292 DPRINTF("Ret %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
293 max = ret->dll->funs[ret->ordinal].nrofargs;
300 DPRINTF("%04x%s",ret->args[i],i?",":"");
301 if (max!=ret->dll->funs[ret->ordinal].nrofargs)
303 DPRINTF(") retval = %04x:%04x ret=%04x:%04x\n",
304 DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
306 HeapFree(SystemHeap,0,ret->args);
309 DPRINTF("Ret %s.%ld: %s() retval = %04x:%04x ret=%04x:%04x\n",
310 ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
311 DX_reg(context),AX_reg(context),HIWORD(ret->origreturn),LOWORD(ret->origreturn)
313 ret->origreturn = NULL; /* mark as empty */
315 #else /* !__i386__ */
316 void SNOOP16_RegisterDLL(NE_MODULE *pModule,LPCSTR name) {
317 FIXME("snooping works only on i386 for now.\n");
321 FARPROC16 SNOOP16_GetProcAddress16(HMODULE16 hmod,DWORD ordinal,FARPROC16 origfun) {
324 #endif /* !__i386__ */