2 * 386-specific Win32 dll<->dll snooping functions
4 * Copyright 1998 Marcus Meissner
14 #include "builtin32.h"
18 #include "selectors.h"
19 #include "stackframe.h"
21 #include "debugtools.h"
23 DEFAULT_DEBUG_CHANNEL(snoop)
25 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
29 extern void WINAPI SNOOP_Entry();
30 extern void WINAPI SNOOP_Return();
32 #ifdef NEED_UNDERSCORE_PREFIX
40 typedef struct tagSNOOP_FUN {
42 BYTE lcall; /* 0xe8 call snoopentry (relative) */
43 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
46 DWORD snoopentry; /* SNOOP_Entry relative */
53 typedef struct tagSNOOP_DLL {
58 struct tagSNOOP_DLL *next;
60 typedef struct tagSNOOP_RETURNENTRY {
62 BYTE lcall; /* 0xe8 call snoopret relative*/
63 /* NOTE: If you move snoopret OR origreturn fix the relative offset
66 DWORD snoopret; /* SNOOP_Ret relative */
72 DWORD *args; /* saved args across a stdcall */
75 typedef struct tagSNOOP_RETURNENTRIES {
76 SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
77 struct tagSNOOP_RETURNENTRIES *next;
78 } SNOOP_RETURNENTRIES;
82 static SNOOP_DLL *firstdll = NULL;
83 static SNOOP_RETURNENTRIES *firstrets = NULL;
85 /***********************************************************************
86 * SNOOP_ShowDebugmsgSnoop
88 * Simple function to decide if a particular debugging message is
91 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
93 if(debug_snoop_excludelist || debug_snoop_includelist) {
96 int len, len2, itemlen, show;
98 if(debug_snoop_excludelist) {
100 listitem = debug_snoop_excludelist;
103 listitem = debug_snoop_includelist;
107 sprintf(buf, "%s.%d", dll, ord);
109 for(; *listitem; listitem++) {
110 itemlen = strlen(*listitem);
111 if((itemlen == len && !strncmp(*listitem, buf, len)) ||
112 (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
113 !strcmp(*listitem, fname)) {
124 SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
125 SNOOP_DLL **dll = &(firstdll);
128 if (!TRACE_ON(snoop)) return;
130 if ((*dll)->hmod == hmod)
131 return; /* already registered */
132 dll = &((*dll)->next);
134 *dll = (SNOOP_DLL*)HeapAlloc(SystemHeap,HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
137 (*dll)->nrofordinals = nrofordinals;
138 (*dll)->name = HEAP_strdupA(SystemHeap,0,name);
139 if ((s=strrchr((*dll)->name,'.')))
141 (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
142 memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
144 HeapFree(SystemHeap,0,*dll);
145 FIXME("out of memory\n");
151 SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
152 SNOOP_DLL *dll = firstdll;
155 IMAGE_SECTION_HEADER *pe_seg = PE_SECTIONS(hmod);
157 if (!TRACE_ON(snoop)) return origfun;
158 if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
160 for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
161 /* 0x42 is special ELF loader tag */
162 if ((pe_seg[j].VirtualAddress==0x42) ||
163 (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
164 ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
165 pe_seg[j].SizeOfRawData
169 /* If we looked through all sections (and didn't find one)
170 * or if the sectionname contains "data", we return the
171 * original function since it is most likely a datareference.
173 if ( (j==PE_HEADER(hmod)->FileHeader.NumberOfSections) ||
174 (strstr(pe_seg[j].Name,"data")) ||
175 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
180 if (hmod == dll->hmod)
184 if (!dll) /* probably internal */
186 if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
188 assert(ordinal<dll->nrofordinals);
189 fun = dll->funs+ordinal;
190 if (!fun->name) fun->name = HEAP_strdupA(SystemHeap,0,name);
192 /* NOTE: origreturn struct member MUST come directly after snoopentry */
193 fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
194 fun->origfun = origfun;
196 return (FARPROC)&(fun->lcall);
200 SNOOP_PrintArg(DWORD x) {
201 static char buf[200];
203 MEMORY_BASIC_INFORMATION mbi;
206 !VirtualQuery((LPVOID)x,&mbi,sizeof(mbi)) ||
209 sprintf(buf,"%08lx",x);
212 if (!IsBadStringPtrA((LPSTR)x,80)) {
217 if (s[i]<0x20) {nostring=1;break;}
218 if (s[i]>=0x80) {nostring=1;break;}
223 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_an((LPSTR)x,sizeof(buf)-10));
228 if (!IsBadStringPtrW((LPWSTR)x,80)) {
233 if (s[i]<0x20) {nostring=1;break;}
234 if (s[i]>0x100) {nostring=1;break;}
239 wsnprintfA(buf,sizeof(buf),"%08lx %s",x,debugstr_wn((LPWSTR)x,sizeof(buf)-10));
244 sprintf(buf,"%08lx",x);
248 #define CALLER1REF (*(DWORD*)ESP_reg(context))
250 void WINAPI SNOOP_DoEntry( CONTEXT86 *context );
251 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Entry, SNOOP_DoEntry );
252 void WINAPI SNOOP_DoEntry( CONTEXT86 *context )
254 DWORD ordinal=0,entry = EIP_reg(context)-5;
255 SNOOP_DLL *dll = firstdll;
256 SNOOP_FUN *fun = NULL;
257 SNOOP_RETURNENTRIES **rets = &firstrets;
258 SNOOP_RETURNENTRY *ret;
262 if ( ((char*)entry>=(char*)dll->funs) &&
263 ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
265 fun = (SNOOP_FUN*)entry;
266 ordinal = fun-dll->funs;
272 FIXME("entrypoint 0x%08lx not found\n",entry);
275 /* guess cdecl ... */
276 if (fun->nrofargs<0) {
277 /* Typical cdecl return frame is:
279 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
280 * (after that 81 C2 xx xx xx xx)
282 LPBYTE reteip = (LPBYTE)CALLER1REF;
285 if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
286 fun->nrofargs=reteip[2]/4;
292 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
293 if (!(*rets)->entry[i].origreturn)
295 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
297 rets = &((*rets)->next);
300 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
301 memset(*rets,0,4096);
302 i = 0; /* entry 0 is free */
304 ret = &((*rets)->entry[i]);
306 /* NOTE: origreturn struct member MUST come directly after snoopret */
307 ret->snoopret = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
308 ret->origreturn = (FARPROC)CALLER1REF;
309 CALLER1REF = (DWORD)&ret->lcall;
312 ret->ordinal = ordinal;
313 ret->origESP = ESP_reg(context);
315 EIP_reg(context)= (DWORD)fun->origfun;
317 DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
318 if (fun->nrofargs>0) {
319 max = fun->nrofargs; if (max>16) max=16;
321 DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(ESP_reg(context)+4+sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
322 if (max!=fun->nrofargs)
324 } else if (fun->nrofargs<0) {
325 DPRINTF("<unknown, check return>");
326 ret->args = HeapAlloc(SystemHeap,0,16*sizeof(DWORD));
327 memcpy(ret->args,(LPBYTE)(ESP_reg(context)+4),sizeof(DWORD)*16);
329 DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD)ret->origreturn,FS_reg(context));
332 void WINAPI SNOOP_DoReturn( CONTEXT86 *context );
333 DEFINE_REGS_ENTRYPOINT_0( SNOOP_Return, SNOOP_DoReturn );
334 void WINAPI SNOOP_DoReturn( CONTEXT86 *context )
336 SNOOP_RETURNENTRY *ret = (SNOOP_RETURNENTRY*)(EIP_reg(context)-5);
338 /* We haven't found out the nrofargs yet. If we called a cdecl
339 * function it is too late anyway and we can just set '0' (which
340 * will be the difference between orig and current ESP
341 * If stdcall -> everything ok.
343 if (ret->dll->funs[ret->ordinal].nrofargs<0)
344 ret->dll->funs[ret->ordinal].nrofargs=(ESP_reg(context)-ret->origESP-4)/4;
345 EIP_reg(context) = (DWORD)ret->origreturn;
349 DPRINTF("Ret %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
350 max = ret->dll->funs[ret->ordinal].nrofargs;
354 DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
355 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
356 EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
358 HeapFree(SystemHeap,0,ret->args);
361 DPRINTF("Ret %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
362 ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
363 EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
365 ret->origreturn = NULL; /* mark as empty */
367 #else /* !__i386__ */
368 void SNOOP_RegisterDLL(HMODULE hmod,LPCSTR name,DWORD nrofordinals) {
369 FIXME("snooping works only on i386 for now.\n");
373 FARPROC SNOOP_GetProcAddress(HMODULE hmod,LPCSTR name,DWORD ordinal,FARPROC origfun) {
376 #endif /* !__i386__ */