2 * Win32 relay and snoop functions
4 * Copyright 1997 Alexandre Julliard
5 * Copyright 1998 Marcus Meissner
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
23 #include "wine/port.h"
31 #define WIN32_NO_STATUS
34 #include "wine/exception.h"
35 #include "ntdll_misc.h"
36 #include "wine/unicode.h"
37 #include "wine/debug.h"
39 WINE_DEFAULT_DEBUG_CHANNEL(relay);
41 #if defined(__i386__) || defined(__x86_64__)
43 struct relay_descr /* descriptor for a module */
45 void *magic; /* signature */
46 void *relay_call; /* functions to call from relay thunks */
47 void *relay_call_regs;
48 void *private; /* reserved for the relay code private data */
49 const char *entry_point_base; /* base address of entry point thunks */
50 const unsigned int *entry_point_offsets; /* offsets of entry points thunks */
51 const unsigned int *arg_types; /* table of argument types for all entry points */
54 #define RELAY_DESCR_MAGIC ((void *)0xdeb90001)
55 #define IS_INTARG(x) (((ULONG_PTR)(x) >> 16) == 0)
57 /* private data built at dll load time */
59 struct relay_entry_point
61 void *orig_func; /* original entry point function */
62 const char *name; /* function name (if any) */
65 struct relay_private_data
67 HMODULE module; /* module handle of this dll */
68 unsigned int base; /* ordinal base */
69 char dllname[40]; /* dll name (without .dll extension) */
70 struct relay_entry_point entry_points[1]; /* list of dll entry points */
73 static const WCHAR **debug_relay_excludelist;
74 static const WCHAR **debug_relay_includelist;
75 static const WCHAR **debug_snoop_excludelist;
76 static const WCHAR **debug_snoop_includelist;
77 static const WCHAR **debug_from_relay_excludelist;
78 static const WCHAR **debug_from_relay_includelist;
79 static const WCHAR **debug_from_snoop_excludelist;
80 static const WCHAR **debug_from_snoop_includelist;
82 static BOOL init_done;
84 /* compare an ASCII and a Unicode string without depending on the current codepage */
85 static inline int strcmpAW( const char *strA, const WCHAR *strW )
87 while (*strA && ((unsigned char)*strA == *strW)) { strA++; strW++; }
88 return (unsigned char)*strA - *strW;
91 /* compare an ASCII and a Unicode string without depending on the current codepage */
92 static inline int strncmpiAW( const char *strA, const WCHAR *strW, int n )
95 for ( ; n > 0; n--, strA++, strW++)
96 if ((ret = toupperW((unsigned char)*strA) - toupperW(*strW)) || !*strA) break;
100 /***********************************************************************
103 * Build a function list from a ';'-separated string.
105 static const WCHAR **build_list( const WCHAR *buffer )
108 const WCHAR *p = buffer;
111 while ((p = strchrW( p, ';' )))
116 /* allocate count+1 pointers, plus the space for a copy of the string */
117 if ((ret = RtlAllocateHeap( GetProcessHeap(), 0,
118 (count+1) * sizeof(WCHAR*) + (strlenW(buffer)+1) * sizeof(WCHAR) )))
120 WCHAR *str = (WCHAR *)(ret + count + 1);
123 strcpyW( str, buffer );
128 if (!(p = strchrW( p, ';' ))) break;
136 /***********************************************************************
139 * Load a function list from a registry value.
141 static const WCHAR **load_list( HKEY hkey, const WCHAR *value )
143 char initial_buffer[4096];
144 char *buffer = initial_buffer;
148 const WCHAR **list = NULL;
150 RtlInitUnicodeString( &name, value );
151 status = NtQueryValueKey( hkey, &name, KeyValuePartialInformation, buffer, sizeof(initial_buffer), &count );
152 if (status == STATUS_BUFFER_OVERFLOW)
154 buffer = RtlAllocateHeap( GetProcessHeap(), 0, count );
155 status = NtQueryValueKey( hkey, &name, KeyValuePartialInformation, buffer, count, &count );
157 if (status == STATUS_SUCCESS)
159 WCHAR *str = (WCHAR *)((KEY_VALUE_PARTIAL_INFORMATION *)buffer)->Data;
160 list = build_list( str );
161 if (list) TRACE( "%s = %s\n", debugstr_w(value), debugstr_w(str) );
164 if (buffer != initial_buffer) RtlFreeHeap( GetProcessHeap(), 0, buffer );
168 /***********************************************************************
171 * Build the relay include/exclude function lists.
173 static void init_debug_lists(void)
175 OBJECT_ATTRIBUTES attr;
178 static const WCHAR configW[] = {'S','o','f','t','w','a','r','e','\\',
179 'W','i','n','e','\\',
180 'D','e','b','u','g',0};
181 static const WCHAR RelayIncludeW[] = {'R','e','l','a','y','I','n','c','l','u','d','e',0};
182 static const WCHAR RelayExcludeW[] = {'R','e','l','a','y','E','x','c','l','u','d','e',0};
183 static const WCHAR SnoopIncludeW[] = {'S','n','o','o','p','I','n','c','l','u','d','e',0};
184 static const WCHAR SnoopExcludeW[] = {'S','n','o','o','p','E','x','c','l','u','d','e',0};
185 static const WCHAR RelayFromIncludeW[] = {'R','e','l','a','y','F','r','o','m','I','n','c','l','u','d','e',0};
186 static const WCHAR RelayFromExcludeW[] = {'R','e','l','a','y','F','r','o','m','E','x','c','l','u','d','e',0};
187 static const WCHAR SnoopFromIncludeW[] = {'S','n','o','o','p','F','r','o','m','I','n','c','l','u','d','e',0};
188 static const WCHAR SnoopFromExcludeW[] = {'S','n','o','o','p','F','r','o','m','E','x','c','l','u','d','e',0};
190 if (init_done) return;
193 RtlOpenCurrentUser( KEY_ALL_ACCESS, &root );
194 attr.Length = sizeof(attr);
195 attr.RootDirectory = root;
196 attr.ObjectName = &name;
198 attr.SecurityDescriptor = NULL;
199 attr.SecurityQualityOfService = NULL;
200 RtlInitUnicodeString( &name, configW );
202 /* @@ Wine registry key: HKCU\Software\Wine\Debug */
203 if (NtOpenKey( &hkey, KEY_ALL_ACCESS, &attr )) hkey = 0;
207 debug_relay_includelist = load_list( hkey, RelayIncludeW );
208 debug_relay_excludelist = load_list( hkey, RelayExcludeW );
209 debug_snoop_includelist = load_list( hkey, SnoopIncludeW );
210 debug_snoop_excludelist = load_list( hkey, SnoopExcludeW );
211 debug_from_relay_includelist = load_list( hkey, RelayFromIncludeW );
212 debug_from_relay_excludelist = load_list( hkey, RelayFromExcludeW );
213 debug_from_snoop_includelist = load_list( hkey, SnoopFromIncludeW );
214 debug_from_snoop_excludelist = load_list( hkey, SnoopFromExcludeW );
220 /***********************************************************************
223 * Check if a given module and function is in the list.
225 static BOOL check_list( const char *module, int ordinal, const char *func, const WCHAR *const *list )
229 sprintf( ord_str, "%d", ordinal );
232 const WCHAR *p = strrchrW( *list, '.' );
233 if (p && p > *list) /* check module and function */
236 if (strncmpiAW( module, *list, len-1 ) || module[len]) continue;
237 if (p[1] == '*' && !p[2]) return TRUE;
238 if (!strcmpAW( ord_str, p + 1 )) return TRUE;
239 if (func && !strcmpAW( func, p + 1 )) return TRUE;
241 else /* function only */
243 if (func && !strcmpAW( func, *list )) return TRUE;
250 /***********************************************************************
251 * check_relay_include
253 * Check if a given function must be included in the relay output.
255 static BOOL check_relay_include( const char *module, int ordinal, const char *func )
257 if (debug_relay_excludelist && check_list( module, ordinal, func, debug_relay_excludelist ))
259 if (debug_relay_includelist && !check_list( module, ordinal, func, debug_relay_includelist ))
264 /***********************************************************************
267 * Check if calls from a given module must be included in the relay/snoop output,
268 * given the exclusion and inclusion lists.
270 static BOOL check_from_module( const WCHAR **includelist, const WCHAR **excludelist, const WCHAR *module )
272 static const WCHAR dllW[] = {'.','d','l','l',0 };
273 const WCHAR **listitem;
276 if (!module) return TRUE;
277 if (!includelist && !excludelist) return TRUE;
281 listitem = excludelist;
286 listitem = includelist;
288 for(; *listitem; listitem++)
292 if (!strcmpiW( *listitem, module )) return !show;
293 len = strlenW( *listitem );
294 if (!strncmpiW( *listitem, module, len ) && !strcmpiW( module + len, dllW ))
300 /***********************************************************************
303 static inline void RELAY_PrintArgs( const INT_PTR *args, int nb_args, unsigned int typemask )
307 if ((typemask & 3) && !IS_INTARG(*args))
310 DPRINTF( "%08lx %s", *args, debugstr_w((LPCWSTR)*args) );
312 DPRINTF( "%08lx %s", *args, debugstr_a((LPCSTR)*args) );
314 else DPRINTF( "%08lx", *args );
315 if (nb_args) DPRINTF( "," );
321 extern LONGLONG CDECL call_entry_point( void *func, int nb_args, const INT_PTR *args, int flags );
323 __ASM_GLOBAL_FUNC( call_entry_point,
325 __ASM_CFI(".cfi_adjust_cfa_offset 4\n\t")
326 __ASM_CFI(".cfi_rel_offset %ebp,0\n\t")
328 __ASM_CFI(".cfi_def_cfa_register %ebp\n\t")
330 __ASM_CFI(".cfi_rel_offset %esi,-4\n\t")
332 __ASM_CFI(".cfi_rel_offset %edi,-8\n\t")
333 "movl 12(%ebp),%edx\n\t"
338 "movl 12(%ebp),%ecx\n\t"
339 "movl 16(%ebp),%esi\n\t"
343 "testl $2,20(%ebp)\n\t" /* (flags & 2) -> thiscall */
346 "1:\tcall *8(%ebp)\n\t"
347 "leal -8(%ebp),%esp\n\t"
349 __ASM_CFI(".cfi_same_value %edi\n\t")
351 __ASM_CFI(".cfi_same_value %esi\n\t")
353 __ASM_CFI(".cfi_def_cfa %esp,4\n\t")
354 __ASM_CFI(".cfi_same_value %ebp\n\t")
357 __ASM_GLOBAL_FUNC( call_entry_point,
359 __ASM_CFI(".cfi_adjust_cfa_offset 8\n\t")
360 __ASM_CFI(".cfi_rel_offset %rbp,0\n\t")
362 __ASM_CFI(".cfi_def_cfa_register %rbp\n\t")
364 __ASM_CFI(".cfi_rel_offset %rsi,-8\n\t")
366 __ASM_CFI(".cfi_rel_offset %rdi,-16\n\t")
370 "cmovgq %rdx,%rcx\n\t"
371 "leaq 0(,%rcx,8),%rdx\n\t"
377 "movq 0(%rsp),%rcx\n\t"
378 "movq 8(%rsp),%rdx\n\t"
379 "movq 16(%rsp),%r8\n\t"
380 "movq 24(%rsp),%r9\n\t"
382 "leaq -16(%rbp),%rsp\n\t"
384 __ASM_CFI(".cfi_same_value %rdi\n\t")
386 __ASM_CFI(".cfi_same_value %rsi\n\t")
387 __ASM_CFI(".cfi_def_cfa_register %rsp\n\t")
389 __ASM_CFI(".cfi_adjust_cfa_offset -8\n\t")
390 __ASM_CFI(".cfi_same_value %rbp\n\t")
395 /***********************************************************************
398 * stack points to the return address, i.e. the first argument is stack[1].
400 static LONGLONG WINAPI relay_call( struct relay_descr *descr, unsigned int idx, const INT_PTR *stack )
403 WORD ordinal = LOWORD(idx);
404 BYTE nb_args = LOBYTE(HIWORD(idx));
405 BYTE flags = HIBYTE(HIWORD(idx));
406 struct relay_private_data *data = descr->private;
407 struct relay_entry_point *entry_point = data->entry_points + ordinal;
409 if (!TRACE_ON(relay))
410 ret = call_entry_point( entry_point->orig_func, nb_args, stack + 1, flags );
413 if (entry_point->name)
414 DPRINTF( "%04x:Call %s.%s(", GetCurrentThreadId(), data->dllname, entry_point->name );
416 DPRINTF( "%04x:Call %s.%u(", GetCurrentThreadId(), data->dllname, data->base + ordinal );
417 RELAY_PrintArgs( stack + 1, nb_args, descr->arg_types[ordinal] );
418 DPRINTF( ") ret=%08lx\n", stack[0] );
420 ret = call_entry_point( entry_point->orig_func, nb_args, stack + 1, flags );
422 if (entry_point->name)
423 DPRINTF( "%04x:Ret %s.%s()", GetCurrentThreadId(), data->dllname, entry_point->name );
425 DPRINTF( "%04x:Ret %s.%u()", GetCurrentThreadId(), data->dllname, data->base + ordinal );
427 if (flags & 1) /* 64-bit return value */
428 DPRINTF( " retval=%08x%08x ret=%08lx\n",
429 (UINT)(ret >> 32), (UINT)ret, stack[0] );
431 DPRINTF( " retval=%08lx ret=%08lx\n", (UINT_PTR)ret, stack[0] );
437 /***********************************************************************
441 void WINAPI __regs_relay_call_regs( struct relay_descr *descr, unsigned int idx,
442 unsigned int orig_eax, unsigned int ret_addr,
445 WORD ordinal = LOWORD(idx);
446 BYTE nb_args = LOBYTE(HIWORD(idx));
447 struct relay_private_data *data = descr->private;
448 struct relay_entry_point *entry_point = data->entry_points + ordinal;
449 BYTE *orig_func = entry_point->orig_func;
450 INT_PTR *args = (INT_PTR *)context->Esp;
451 INT_PTR args_copy[32];
453 /* restore the context to what it was before the relay thunk */
454 context->Eax = orig_eax;
455 context->Eip = ret_addr;
456 context->Esp += nb_args * sizeof(int);
460 if (entry_point->name)
461 DPRINTF( "%04x:Call %s.%s(", GetCurrentThreadId(), data->dllname, entry_point->name );
463 DPRINTF( "%04x:Call %s.%u(", GetCurrentThreadId(), data->dllname, data->base + ordinal );
464 RELAY_PrintArgs( args, nb_args, descr->arg_types[ordinal] );
465 DPRINTF( ") ret=%08x\n", ret_addr );
467 DPRINTF( "%04x: eax=%08x ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x "
468 "ebp=%08x esp=%08x ds=%04x es=%04x fs=%04x gs=%04x flags=%08x\n",
469 GetCurrentThreadId(), context->Eax, context->Ebx, context->Ecx,
470 context->Edx, context->Esi, context->Edi, context->Ebp, context->Esp,
471 context->SegDs, context->SegEs, context->SegFs, context->SegGs, context->EFlags );
473 assert( orig_func[0] == 0x68 /* pushl func */ );
474 assert( orig_func[5] == 0x6a /* pushl args */ );
475 assert( orig_func[7] == 0xe8 /* call */ );
478 /* now call the real function */
480 memcpy( args_copy, args, nb_args * sizeof(args[0]) );
481 args_copy[nb_args++] = (INT_PTR)context; /* append context argument */
483 call_entry_point( orig_func + 12 + *(int *)(orig_func + 1), nb_args, args_copy, 0 );
488 if (entry_point->name)
489 DPRINTF( "%04x:Ret %s.%s() retval=%08x ret=%08x\n",
490 GetCurrentThreadId(), data->dllname, entry_point->name,
491 context->Eax, context->Eip );
493 DPRINTF( "%04x:Ret %s.%u() retval=%08x ret=%08x\n",
494 GetCurrentThreadId(), data->dllname, data->base + ordinal,
495 context->Eax, context->Eip );
496 DPRINTF( "%04x: eax=%08x ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x "
497 "ebp=%08x esp=%08x ds=%04x es=%04x fs=%04x gs=%04x flags=%08x\n",
498 GetCurrentThreadId(), context->Eax, context->Ebx, context->Ecx,
499 context->Edx, context->Esi, context->Edi, context->Ebp, context->Esp,
500 context->SegDs, context->SegEs, context->SegFs, context->SegGs, context->EFlags );
503 extern void WINAPI relay_call_regs(void);
504 DEFINE_REGS_ENTRYPOINT( relay_call_regs, 4 )
508 void WINAPI __regs_relay_call_regs( struct relay_descr *descr, INT_PTR idx,
509 INT_PTR *stack, CONTEXT *context )
511 WORD ordinal = LOWORD(idx);
512 BYTE nb_args = LOBYTE(HIWORD(idx));
513 struct relay_private_data *data = descr->private;
514 struct relay_entry_point *entry_point = data->entry_points + ordinal;
515 BYTE *orig_func = entry_point->orig_func;
516 INT_PTR *args = stack + 1;
517 INT_PTR args_copy[32];
519 /* restore the context to what it was before the relay thunk */
520 context->Rip = stack[0];
521 context->Rsp = (INT_PTR)args;
525 if (entry_point->name)
526 DPRINTF( "%04x:Call %s.%s(", GetCurrentThreadId(), data->dllname, entry_point->name );
528 DPRINTF( "%04x:Call %s.%u(", GetCurrentThreadId(), data->dllname, data->base + ordinal );
529 RELAY_PrintArgs( args, nb_args, descr->arg_types[ordinal] );
530 DPRINTF( ") ret=%08lx\n", context->Rip );
532 DPRINTF( "%04x: rax=%016lx rbx=%016lx rcx=%016lx rdx=%016lx rsi=%016lx rdi=%016lx rbp=%016lx rsp=%016lx\n",
533 GetCurrentThreadId(), context->Rax, context->Rbx, context->Rcx, context->Rdx,
534 context->Rsi, context->Rdi, context->Rbp, context->Rsp );
535 DPRINTF( "%04x: r8=%016lx r9=%016lx r10=%016lx r11=%016lx r12=%016lx r13=%016lx r14=%016lx r15=%016lx\n",
536 GetCurrentThreadId(), context->R8, context->R9, context->R10, context->R11,
537 context->R12, context->R13, context->R14, context->R15 );
539 assert( orig_func[17] == 0x48 /* leaq */ );
540 assert( orig_func[18] == 0x8d );
541 assert( orig_func[19] == 0x15 );
542 assert( orig_func[24] == 0xe8 /* call */ );
545 /* now call the real function */
547 memcpy( args_copy, args, nb_args * sizeof(args[0]) );
548 args_copy[nb_args++] = (INT_PTR)context; /* append context argument */
550 call_entry_point( orig_func + 24 + *(int *)(orig_func + 20), nb_args, args_copy, 0 );
555 if (entry_point->name)
556 DPRINTF( "%04x:Ret %s.%s() retval=%08lx ret=%08lx\n",
557 GetCurrentThreadId(), data->dllname, entry_point->name,
558 context->Rax, context->Rip );
560 DPRINTF( "%04x:Ret %s.%u() retval=%08lx ret=%08lx\n",
561 GetCurrentThreadId(), data->dllname, data->base + ordinal,
562 context->Rax, context->Rip );
563 DPRINTF( "%04x: rax=%016lx rbx=%016lx rcx=%016lx rdx=%016lx rsi=%016lx rdi=%016lx rbp=%016lx rsp=%016lx\n",
564 GetCurrentThreadId(), context->Rax, context->Rbx, context->Rcx, context->Rdx,
565 context->Rsi, context->Rdi, context->Rbp, context->Rsp );
566 DPRINTF( "%04x: r8=%016lx r9=%016lx r10=%016lx r11=%016lx r12=%016lx r13=%016lx r14=%016lx r15=%016lx\n",
567 GetCurrentThreadId(), context->R8, context->R9, context->R10, context->R11,
568 context->R12, context->R13, context->R14, context->R15 );
571 extern void WINAPI relay_call_regs(void);
572 DEFINE_REGS_ENTRYPOINT( relay_call_regs, 3 )
574 #endif /* __i386__ */
577 /***********************************************************************
578 * RELAY_GetProcAddress
580 * Return the proc address to use for a given function.
582 FARPROC RELAY_GetProcAddress( HMODULE module, const IMAGE_EXPORT_DIRECTORY *exports,
583 DWORD exp_size, FARPROC proc, DWORD ordinal, const WCHAR *user )
585 struct relay_private_data *data;
586 const struct relay_descr *descr = (const struct relay_descr *)((const char *)exports + exp_size);
588 if (descr->magic != RELAY_DESCR_MAGIC || !(data = descr->private)) return proc; /* no relay data */
589 if (!data->entry_points[ordinal].orig_func) return proc; /* not a relayed function */
590 if (check_from_module( debug_from_relay_includelist, debug_from_relay_excludelist, user ))
591 return proc; /* we want to relay it */
592 return data->entry_points[ordinal].orig_func;
596 /***********************************************************************
599 * Setup relay debugging for a built-in dll.
601 void RELAY_SetupDLL( HMODULE module )
603 IMAGE_EXPORT_DIRECTORY *exports;
606 DWORD size, entry_point_rva;
607 struct relay_descr *descr;
608 struct relay_private_data *data;
611 if (!init_done) init_debug_lists();
613 exports = RtlImageDirectoryEntryToData( module, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &size );
614 if (!exports) return;
616 descr = (struct relay_descr *)((char *)exports + size);
617 if (descr->magic != RELAY_DESCR_MAGIC) return;
619 if (!(data = RtlAllocateHeap( GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(*data) +
620 (exports->NumberOfFunctions-1) * sizeof(data->entry_points) )))
623 descr->relay_call = relay_call;
624 descr->relay_call_regs = relay_call_regs;
625 descr->private = data;
627 data->module = module;
628 data->base = exports->Base;
629 len = strlen( (char *)module + exports->Name );
630 if (len > 4 && !strcasecmp( (char *)module + exports->Name + len - 4, ".dll" )) len -= 4;
631 len = min( len, sizeof(data->dllname) - 1 );
632 memcpy( data->dllname, (char *)module + exports->Name, len );
633 data->dllname[len] = 0;
635 /* fetch name pointer for all entry points and store them in the private structure */
637 ordptr = (const WORD *)((char *)module + exports->AddressOfNameOrdinals);
638 for (i = 0; i < exports->NumberOfNames; i++, ordptr++)
640 DWORD name_rva = ((DWORD*)((char *)module + exports->AddressOfNames))[i];
641 data->entry_points[*ordptr].name = (const char *)module + name_rva;
644 /* patch the functions in the export table to point to the relay thunks */
646 funcs = (DWORD *)((char *)module + exports->AddressOfFunctions);
647 entry_point_rva = descr->entry_point_base - (const char *)module;
648 for (i = 0; i < exports->NumberOfFunctions; i++, funcs++)
650 if (!descr->entry_point_offsets[i]) continue; /* not a normal function */
651 if (!check_relay_include( data->dllname, i + exports->Base, data->entry_points[i].name ))
652 continue; /* don't include this entry point */
654 data->entry_points[i].orig_func = (char *)module + *funcs;
655 *funcs = entry_point_rva + descr->entry_point_offsets[i];
659 #else /* __i386__ || __x86_64__ */
661 FARPROC RELAY_GetProcAddress( HMODULE module, const IMAGE_EXPORT_DIRECTORY *exports,
662 DWORD exp_size, FARPROC proc, DWORD ordinal, const WCHAR *user )
667 void RELAY_SetupDLL( HMODULE module )
671 #endif /* __i386__ || __x86_64__ */
674 /***********************************************************************/
676 /***********************************************************************/
680 WINE_DECLARE_DEBUG_CHANNEL(seh);
681 WINE_DECLARE_DEBUG_CHANNEL(snoop);
683 #include "pshpack1.h"
688 BYTE lcall; /* 0xe8 call snoopentry (relative) */
689 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
692 DWORD snoopentry; /* SNOOP_Entry relative */
699 typedef struct tagSNOOP_DLL {
704 struct tagSNOOP_DLL *next;
711 BYTE lcall; /* 0xe8 call snoopret relative*/
712 /* NOTE: If you move snoopret OR origreturn fix the relative offset
715 DWORD snoopret; /* SNOOP_Ret relative */
721 DWORD *args; /* saved args across a stdcall */
724 typedef struct tagSNOOP_RETURNENTRIES {
725 SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
726 struct tagSNOOP_RETURNENTRIES *next;
727 } SNOOP_RETURNENTRIES;
731 extern void WINAPI SNOOP_Entry(void);
732 extern void WINAPI SNOOP_Return(void);
734 static SNOOP_DLL *firstdll;
735 static SNOOP_RETURNENTRIES *firstrets;
738 /***********************************************************************
739 * SNOOP_ShowDebugmsgSnoop
741 * Simple function to decide if a particular debugging message is
744 static BOOL SNOOP_ShowDebugmsgSnoop(const char *module, int ordinal, const char *func)
746 if (debug_snoop_excludelist && check_list( module, ordinal, func, debug_snoop_excludelist ))
748 if (debug_snoop_includelist && !check_list( module, ordinal, func, debug_snoop_includelist ))
754 /***********************************************************************
757 * Setup snoop debugging for a native dll.
759 void SNOOP_SetupDLL(HMODULE hmod)
761 SNOOP_DLL **dll = &firstdll;
766 IMAGE_EXPORT_DIRECTORY *exports;
768 if (!init_done) init_debug_lists();
770 exports = RtlImageDirectoryEntryToData( hmod, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &size32 );
771 if (!exports || !exports->NumberOfFunctions) return;
772 name = (char *)hmod + exports->Name;
775 TRACE_(snoop)("hmod=%p, name=%s\n", hmod, name);
778 if ((*dll)->hmod == hmod)
780 /* another dll, loaded at the same address */
782 size = (*dll)->nrofordinals * sizeof(SNOOP_FUN);
783 NtFreeVirtualMemory(NtCurrentProcess(), &addr, &size, MEM_RELEASE);
786 dll = &((*dll)->next);
789 *dll = RtlReAllocateHeap(GetProcessHeap(),
790 HEAP_ZERO_MEMORY, *dll,
791 sizeof(SNOOP_DLL) + strlen(name));
793 *dll = RtlAllocateHeap(GetProcessHeap(),
795 sizeof(SNOOP_DLL) + strlen(name));
797 (*dll)->ordbase = exports->Base;
798 (*dll)->nrofordinals = exports->NumberOfFunctions;
799 strcpy( (*dll)->name, name );
800 p = (*dll)->name + strlen((*dll)->name) - 4;
801 if (p > (*dll)->name && !strcasecmp( p, ".dll" )) *p = 0;
803 size = exports->NumberOfFunctions * sizeof(SNOOP_FUN);
805 NtAllocateVirtualMemory(NtCurrentProcess(), &addr, 0, &size,
806 MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
808 RtlFreeHeap(GetProcessHeap(),0,*dll);
809 FIXME("out of memory\n");
813 memset((*dll)->funs,0,size);
817 /***********************************************************************
818 * SNOOP_GetProcAddress
820 * Return the proc address to use for a given function.
822 FARPROC SNOOP_GetProcAddress( HMODULE hmod, const IMAGE_EXPORT_DIRECTORY *exports,
823 DWORD exp_size, FARPROC origfun, DWORD ordinal,
828 const WORD *ordinals;
830 SNOOP_DLL *dll = firstdll;
832 const IMAGE_SECTION_HEADER *sec;
834 if (!TRACE_ON(snoop)) return origfun;
835 if (!check_from_module( debug_from_snoop_includelist, debug_from_snoop_excludelist, user ))
836 return origfun; /* the calling module was explicitly excluded */
838 if (!*(LPBYTE)origfun) /* 0x00 is an impossible opcode, possible dataref. */
841 sec = RtlImageRvaToSection( RtlImageNtHeader(hmod), hmod, (char *)origfun - (char *)hmod );
843 if (!sec || !(sec->Characteristics & IMAGE_SCN_CNT_CODE))
844 return origfun; /* most likely a data reference */
847 if (hmod == dll->hmod)
851 if (!dll) /* probably internal */
854 /* try to find a name for it */
856 names = (const DWORD *)((const char *)hmod + exports->AddressOfNames);
857 ordinals = (const WORD *)((const char *)hmod + exports->AddressOfNameOrdinals);
858 if (names) for (i = 0; i < exports->NumberOfNames; i++)
860 if (ordinals[i] == ordinal)
862 ename = (const char *)hmod + names[i];
866 if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,ename))
868 assert(ordinal < dll->nrofordinals);
869 fun = dll->funs + ordinal;
874 /* NOTE: origreturn struct member MUST come directly after snoopentry */
875 fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
876 fun->origfun = origfun;
879 return (FARPROC)&(fun->lcall);
882 static void SNOOP_PrintArg(DWORD x)
887 if (IS_INTARG(x) || TRACE_ON(seh)) return; /* trivial reject to avoid faults */
894 if (s[i]<0x20) {nostring=1;break;}
895 if (s[i]>=0x80) {nostring=1;break;}
898 if (!nostring && i > 5)
899 DPRINTF(" %s",debugstr_an((LPSTR)x,i));
900 else /* try unicode */
906 if (s[i]<0x20) {nostring=1;break;}
907 if (s[i]>0x100) {nostring=1;break;}
910 if (!nostring && i > 5) DPRINTF(" %s",debugstr_wn((LPWSTR)x,i));
919 #define CALLER1REF (*(DWORD*)context->Esp)
921 void WINAPI __regs_SNOOP_Entry( CONTEXT86 *context )
923 DWORD ordinal=0,entry = context->Eip - 5;
924 SNOOP_DLL *dll = firstdll;
925 SNOOP_FUN *fun = NULL;
926 SNOOP_RETURNENTRIES **rets = &firstrets;
927 SNOOP_RETURNENTRY *ret;
931 if ( ((char*)entry>=(char*)dll->funs) &&
932 ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
934 fun = (SNOOP_FUN*)entry;
935 ordinal = fun-dll->funs;
941 FIXME("entrypoint 0x%08x not found\n",entry);
944 /* guess cdecl ... */
945 if (fun->nrofargs<0) {
946 /* Typical cdecl return frame is:
948 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
949 * (after that 81 C2 xx xx xx xx)
951 LPBYTE reteip = (LPBYTE)CALLER1REF;
954 if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
955 fun->nrofargs=reteip[2]/4;
961 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
962 if (!(*rets)->entry[i].origreturn)
964 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
966 rets = &((*rets)->next);
972 NtAllocateVirtualMemory(NtCurrentProcess(), &addr, 0, &size,
973 MEM_COMMIT | MEM_RESERVE,
974 PAGE_EXECUTE_READWRITE);
977 memset(*rets,0,4096);
978 i = 0; /* entry 0 is free */
980 ret = &((*rets)->entry[i]);
982 /* NOTE: origreturn struct member MUST come directly after snoopret */
983 ret->snoopret = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
984 ret->origreturn = (FARPROC)CALLER1REF;
985 CALLER1REF = (DWORD)&ret->lcall;
988 ret->ordinal = ordinal;
989 ret->origESP = context->Esp;
991 context->Eip = (DWORD)fun->origfun;
993 if (fun->name) DPRINTF("%04x:CALL %s.%s(",GetCurrentThreadId(),dll->name,fun->name);
994 else DPRINTF("%04x:CALL %s.%d(",GetCurrentThreadId(),dll->name,dll->ordbase+ordinal);
995 if (fun->nrofargs>0) {
996 max = fun->nrofargs; if (max>16) max=16;
999 SNOOP_PrintArg(*(DWORD*)(context->Esp + 4 + sizeof(DWORD)*i));
1000 if (i<fun->nrofargs-1) DPRINTF(",");
1002 if (max!=fun->nrofargs)
1004 } else if (fun->nrofargs<0) {
1005 DPRINTF("<unknown, check return>");
1006 ret->args = RtlAllocateHeap(GetProcessHeap(),
1007 0,16*sizeof(DWORD));
1008 memcpy(ret->args,(LPBYTE)(context->Esp + 4),sizeof(DWORD)*16);
1010 DPRINTF(") ret=%08x\n",(DWORD)ret->origreturn);
1014 void WINAPI __regs_SNOOP_Return( CONTEXT86 *context )
1016 SNOOP_RETURNENTRY *ret = (SNOOP_RETURNENTRY*)(context->Eip - 5);
1017 SNOOP_FUN *fun = &ret->dll->funs[ret->ordinal];
1019 /* We haven't found out the nrofargs yet. If we called a cdecl
1020 * function it is too late anyway and we can just set '0' (which
1021 * will be the difference between orig and current ESP
1022 * If stdcall -> everything ok.
1024 if (ret->dll->funs[ret->ordinal].nrofargs<0)
1025 ret->dll->funs[ret->ordinal].nrofargs=(context->Esp - ret->origESP-4)/4;
1026 context->Eip = (DWORD)ret->origreturn;
1031 DPRINTF("%04x:RET %s.%s(", GetCurrentThreadId(), ret->dll->name, fun->name);
1033 DPRINTF("%04x:RET %s.%d(", GetCurrentThreadId(),
1034 ret->dll->name,ret->dll->ordbase+ret->ordinal);
1036 max = fun->nrofargs;
1041 SNOOP_PrintArg(ret->args[i]);
1042 if (i<max-1) DPRINTF(",");
1044 DPRINTF(") retval=%08x ret=%08x\n",
1045 context->Eax,(DWORD)ret->origreturn );
1046 RtlFreeHeap(GetProcessHeap(),0,ret->args);
1052 DPRINTF("%04x:RET %s.%s() retval=%08x ret=%08x\n",
1053 GetCurrentThreadId(),
1054 ret->dll->name, fun->name, context->Eax, (DWORD)ret->origreturn);
1056 DPRINTF("%04x:RET %s.%d() retval=%08x ret=%08x\n",
1057 GetCurrentThreadId(),
1058 ret->dll->name,ret->dll->ordbase+ret->ordinal,
1059 context->Eax, (DWORD)ret->origreturn);
1061 ret->origreturn = NULL; /* mark as empty */
1064 /* assembly wrappers that save the context */
1065 DEFINE_REGS_ENTRYPOINT( SNOOP_Entry, 0 )
1066 DEFINE_REGS_ENTRYPOINT( SNOOP_Return, 0 )
1068 #else /* __i386__ */
1070 FARPROC SNOOP_GetProcAddress( HMODULE hmod, const IMAGE_EXPORT_DIRECTORY *exports, DWORD exp_size,
1071 FARPROC origfun, DWORD ordinal, const WCHAR *user )
1076 void SNOOP_SetupDLL( HMODULE hmod )
1078 FIXME("snooping works only on i386 for now.\n");
1081 #endif /* __i386__ */