relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  */
   6
   7
   8 #include <assert.h>
   9 #include <string.h>
  10 #include "windows.h"
  11 #include "winbase.h"
  12 #include "winnt.h"
  13 #include "heap.h"
  14 #include "builtin32.h"
  15 #include "snoop.h"
  16 #include "neexe.h"
  17 #include "peexe.h"
  18 #include "selectors.h"
  19 #include "stackframe.h"
  20 #include "debugstr.h"
  21 #include "debug.h"
  22
  23 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
  24
  25 #ifdef __i386__
  26
  27 #ifdef NEED_UNDERSCORE_PREFIX
  28 # define PREFIX "_"
  29 #else
  30 # define PREFIX
  31 #endif
  32
  33 /* Well, not exactly extern since they are in the same file (in the lines
  34  * below). But the C Compiler doesn't see them there, so we have to help a bit.
  35  */
  36 extern void SNOOP_Return();
  37 extern void SNOOP_Entry();
  38 __asm__(".align 4\n\t"
  39         ".globl "PREFIX"SNOOP_Entry\n\t"
  40         ".type "PREFIX"SNOOP_Entry,@function\n\t"
  41         PREFIX"SNOOP_Entry:\n\t"
  42         "pushl $"PREFIX"__regs_SNOOP_Entry\n\t"
  43         "pushl $"PREFIX"CALL32_Regs\n\t"
  44         "ret\n\t"
  45         ".align 4\n\t"
  46         ".globl "PREFIX"SNOOP_Return\n\t"
  47         ".type "PREFIX"SNOOP_Return,@function\n\t"
  48         PREFIX"SNOOP_Return:\n\t"
  49         "pushl $"PREFIX"__regs_SNOOP_Return\n\t"
  50         "pushl $"PREFIX"CALL32_Regs\n\t"
  51         "ret"
  52 );
  53
  54 #pragma pack(1)
  55
  56 typedef struct tagSNOOP_FUN {
  57         /* code part */
  58         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  59         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  60          * calculation!
  61          */
  62         DWORD           snoopentry;     /* SNOOP_Entry relative */
  63         /* unreached */
  64         int             nrofargs;
  65         FARPROC32       origfun;
  66         char            *name;
  67 } SNOOP_FUN;
  68
  69 typedef struct tagSNOOP_DLL {
  70         HMODULE32       hmod;
  71         SNOOP_FUN       *funs;
  72         LPCSTR          name;
  73         int             nrofordinals;
  74         struct tagSNOOP_DLL     *next;
  75 } SNOOP_DLL;
  76 typedef struct tagSNOOP_RETURNENTRY {
  77         /* code part */
  78         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  79         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  80          * calculation!
  81          */
  82         DWORD           snoopret;       /* SNOOP_Ret relative */
  83         /* unreached */
  84         FARPROC32       origreturn;
  85         SNOOP_DLL       *dll;
  86         DWORD           ordinal;
  87         DWORD           origESP;
  88         DWORD           *args;          /* saved args across a stdcall */
  89 } SNOOP_RETURNENTRY;
  90
  91 typedef struct tagSNOOP_RETURNENTRIES {
  92         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  93         struct tagSNOOP_RETURNENTRIES   *next;
  94 } SNOOP_RETURNENTRIES;
  95
  96 #pragma pack(4)
  97
  98 static  SNOOP_DLL               *firstdll = NULL;
  99 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
 100
 101 /***********************************************************************
 102  *          SNOOP_ShowDebugmsgSnoop
 103  *
 104  * Simple function to decide if a particular debugging message is
 105  * wanted.
 106  */
 107 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
 108
 109   if(debug_snoop_excludelist || debug_snoop_includelist) {
 110     char **listitem;
 111     char buf[80];
 112     int len, len2, itemlen, show;
 113
 114     if(debug_snoop_excludelist) {
 115       show = 1;
 116       listitem = debug_snoop_excludelist;
 117     } else {
 118       show = 0;
 119       listitem = debug_snoop_includelist;
 120     }
 121     len = strlen(dll);
 122     assert(len < 64);
 123     sprintf(buf, "%s.%d", dll, ord);
 124     len2 = strlen(buf);
 125     for(; *listitem; listitem++) {
 126       itemlen = strlen(*listitem);
 127       if((itemlen == len && !strncmp(*listitem, buf, len)) ||
 128          (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
 129          !strcmp(*listitem, fname)) {
 130         show = !show;
 131        break;
 132       }
 133     }
 134     return show;
 135   }
 136   return 1;
 137 }
 138
 139 void
 140 SNOOP_RegisterDLL(HMODULE32 hmod,LPCSTR name,DWORD nrofordinals) {
 141         SNOOP_DLL       **dll = &(firstdll);
 142         char            *s;
 143
 144         if (!TRACE_ON(snoop)) return;
 145         while (*dll) {
 146                 if ((*dll)->hmod == hmod)
 147                         return; /* already registered */
 148                 dll = &((*dll)->next);
 149         }
 150         *dll = (SNOOP_DLL*)HeapAlloc(SystemHeap,HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
 151         (*dll)->next    = NULL;
 152         (*dll)->hmod    = hmod;
 153         (*dll)->nrofordinals = nrofordinals;
 154         (*dll)->name    = HEAP_strdupA(SystemHeap,0,name);
 155         if ((s=strrchr((*dll)->name,'.')))
 156                 *s='\0';
 157         (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 158         memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
 159         if (!(*dll)->funs) {
 160                 HeapFree(SystemHeap,0,*dll);
 161                 FIXME(snoop,"out of memory\n");
 162                 return;
 163         }
 164 }
 165
 166 FARPROC32
 167 SNOOP_GetProcAddress32(HMODULE32 hmod,LPCSTR name,DWORD ordinal,FARPROC32 origfun) {
 168         SNOOP_DLL                       *dll = firstdll;
 169         SNOOP_FUN                       *fun;
 170         int                             j;
 171         IMAGE_SECTION_HEADER            *pe_seg = PE_SECTIONS(hmod);
 172
 173         if (!TRACE_ON(snoop)) return origfun;
 174         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 175                 return origfun;
 176         for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
 177                 /* 0x42 is special ELF loader tag */
 178                 if ((pe_seg[j].VirtualAddress==0x42) ||
 179                     (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
 180                      ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
 181                                    pe_seg[j].SizeOfRawData
 182                    ))
 183                 )
 184                         break;
 185         /* If we looked through all sections (and didn't find one)
 186          * or if the sectionname contains "data", we return the
 187          * original function since it is most likely a datareference.
 188          */
 189         if (    (j==PE_HEADER(hmod)->FileHeader.NumberOfSections)       ||
 190                 (strstr(pe_seg[j].Name,"data"))                         ||
 191                 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
 192         )
 193                 return origfun;
 194
 195         while (dll) {
 196                 if (hmod == dll->hmod)
 197                         break;
 198                 dll=dll->next;
 199         }
 200         if (!dll)       /* probably internal */
 201                 return origfun;
 202         if (!SNOOP_ShowDebugmsgSnoop(dll->name,ordinal,name))
 203                 return origfun;
 204         assert(ordinal<dll->nrofordinals);
 205         fun = dll->funs+ordinal;
 206         if (!fun->name) fun->name = HEAP_strdupA(SystemHeap,0,name);
 207         fun->lcall      = 0xe8;
 208         /* NOTE: origreturn struct member MUST come directly after snoopentry */
 209         fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 210         fun->origfun    = origfun;
 211         fun->nrofargs   = -1;
 212         return (FARPROC32)&(fun->lcall);
 213 }
 214
 215 static char*
 216 SNOOP_PrintArg(DWORD x) {
 217         static char     buf[200];
 218         int             i,nostring;
 219         MEMORY_BASIC_INFORMATION        mbi;
 220
 221         if (    !HIWORD(x)                                      ||
 222                 !VirtualQuery((LPVOID)x,&mbi,sizeof(mbi))       ||
 223                 !mbi.Type
 224         ) {
 225                 sprintf(buf,"%08lx",x);
 226                 return buf;
 227         }
 228         i=0;nostring=0;
 229         if (!IsBadStringPtr32A((LPSTR)x,80)) {
 230                 while (i<80) {
 231                         LPBYTE  s=(LPBYTE)x;
 232
 233                         if (s[i]==0) break;
 234                         if (s[i]<0x20) {nostring=1;break;}
 235                         if (s[i]>=0x80) {nostring=1;break;}
 236                         i++;
 237                 }
 238                 if (!nostring) {
 239                         if (i>5) {
 240                                 sprintf(buf,"%08lx \"",x);
 241                                 strncat(buf,(LPSTR)x,198-strlen(buf)-2);
 242                                 strcat(buf,"\"");
 243                                 return buf;
 244                         }
 245                 }
 246         }
 247         i=0;nostring=0;
 248         if (!IsBadStringPtr32W((LPWSTR)x,80)) {
 249                 while (i<80) {
 250                         LPWSTR  s=(LPWSTR)x;
 251
 252                         if (s[i]==0) break;
 253                         if (s[i]<0x20) {nostring=1;break;}
 254                         if (s[i]>0x100) {nostring=1;break;}
 255                         i++;
 256                 }
 257                 if (!nostring) {
 258                         if (i>5) {
 259                                 sprintf(buf,"%08lx L",x);
 260                                 strcat(buf,debugstr_wn((LPWSTR)x,198-strlen(buf)-2));
 261                                 return buf;
 262                         }
 263                 }
 264         }
 265         sprintf(buf,"%08lx",x);
 266         return buf;
 267 }
 268
 269 #define CALLER1REF (*(DWORD*)(ESP_reg(context)+4))
 270 REGS_ENTRYPOINT(SNOOP_Entry) {
 271         DWORD           ordinal=0,entry = EIP_reg(context)-5;
 272         SNOOP_DLL       *dll = firstdll;
 273         SNOOP_FUN       *fun = NULL;
 274         SNOOP_RETURNENTRIES     **rets = &firstrets;
 275         SNOOP_RETURNENTRY       *ret;
 276         int             i,max;
 277
 278         while (dll) {
 279                 if (    ((char*)entry>=(char*)dll->funs)        &&
 280                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 281                 ) {
 282                         fun = (SNOOP_FUN*)entry;
 283                         ordinal = fun-dll->funs;
 284                         break;
 285                 }
 286                 dll=dll->next;
 287         }
 288         if (!dll) {
 289                 FIXME(snoop,"entrypoint 0x%08lx not found\n",entry);
 290                 return; /* oops */
 291         }
 292         /* guess cdecl ... */
 293         if (fun->nrofargs<0) {
 294                 /* Typical cdecl return frame is:
 295                  *      add esp, xxxxxxxx
 296                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 297                  * (after that 81 C2 xx xx xx xx)
 298                  */
 299                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 300
 301                 if (reteip) {
 302                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 303                                 fun->nrofargs=reteip[2]/4;
 304                 }
 305         }
 306
 307
 308         while (*rets) {
 309                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 310                         if (!(*rets)->entry[i].origreturn)
 311                                 break;
 312                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 313                         break;
 314                 rets = &((*rets)->next);
 315         }
 316         if (!*rets) {
 317                 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 318                 memset(*rets,0,4096);
 319                 i = 0;  /* entry 0 is free */
 320         }
 321         ret = &((*rets)->entry[i]);
 322         ret->lcall      = 0xe8;
 323         /* NOTE: origreturn struct member MUST come directly after snoopret */
 324         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 325         ret->origreturn = (FARPROC32)CALLER1REF;
 326         CALLER1REF      = (DWORD)&ret->lcall;
 327         ret->dll        = dll;
 328         ret->args       = NULL;
 329         ret->ordinal    = ordinal;
 330         ret->origESP    = ESP_reg(context);
 331
 332         EIP_reg(context)= (DWORD)fun->origfun;
 333
 334         DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
 335         if (fun->nrofargs>0) {
 336                 max = fun->nrofargs; if (max>16) max=16;
 337                 for (i=0;i<max;i++)
 338                         DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(ESP_reg(context)+8+sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
 339                 if (max!=fun->nrofargs)
 340                         DPRINTF(" ...");
 341         } else if (fun->nrofargs<0) {
 342                 DPRINTF("<unknown, check return>");
 343                 ret->args = HeapAlloc(SystemHeap,0,16*sizeof(DWORD));
 344                 memcpy(ret->args,(LPBYTE)(ESP_reg(context)+8),sizeof(DWORD)*16);
 345         }
 346         DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD)ret->origreturn,FS_reg(context));
 347 }
 348
 349 REGS_ENTRYPOINT(SNOOP_Return) {
 350         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(EIP_reg(context)-5);
 351
 352         /* We haven't found out the nrofargs yet. If we called a cdecl
 353          * function it is too late anyway and we can just set '0' (which
 354          * will be the difference between orig and current ESP
 355          * If stdcall -> everything ok.
 356          */
 357         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 358                 ret->dll->funs[ret->ordinal].nrofargs=(ESP_reg(context)-ret->origESP-4)/4;
 359         EIP_reg(context) = (DWORD)ret->origreturn;
 360         if (ret->args) {
 361                 int     i,max;
 362
 363                 DPRINTF("Ret  %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
 364                 max = ret->dll->funs[ret->ordinal].nrofargs;
 365                 if (max>16) max=16;
 366
 367                 for (i=0;i<max;i++)
 368                         DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
 369                 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
 370                         EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
 371                 );
 372                 HeapFree(SystemHeap,0,ret->args);
 373                 ret->args = NULL;
 374         } else
 375                 DPRINTF("Ret  %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
 376                         ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
 377                         EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
 378                 );
 379         ret->origreturn = NULL; /* mark as empty */
 380 }
 381 #else   /* !__i386__ */
 382 void SNOOP_RegisterDLL(HMODULE32 hmod,LPCSTR name,DWORD nrofordinals) {
 383         FIXME(snoop,"snooping works only on i386 for now.\n");
 384         return;
 385 }
 386
 387 FARPROC32 SNOOP_GetProcAddress32(HMODULE32 hmod,LPCSTR name,DWORD ordinal,FARPROC32 origfun) {
 388         return origfun;
 389 }
 390 #endif  /* !__i386__ */