win32/kernel32.c

   1 /*
   2  * KERNEL32 thunks and other undocumented stuff
   3  *
   4  * Copyright 1997-1998 Marcus Meissner
   5  * Copyright 1998      Ulrich Weigand
   6  */
   7
   8 #include <stdio.h>
   9 #include "windows.h"
  10 #include "callback.h"
  11 #include "resource.h"
  12 #include "task.h"
  13 #include "user.h"
  14 #include "heap.h"
  15 #include "module.h"
  16 #include "process.h"
  17 #include "stackframe.h"
  18 #include "heap.h"
  19 #include "selectors.h"
  20 #include "task.h"
  21 #include "win.h"
  22 #include "debug.h"
  23
  24 /***********************************************************************
  25  *                                                                     *
  26  *                 Win95 internal thunks                               *
  27  *                                                                     *
  28  ***********************************************************************/
  29
  30 /***********************************************************************
  31  * Generates a FT_Prolog call.
  32  *
  33  *  0FB6D1                  movzbl edx,cl
  34  *  8B1495xxxxxxxx          mov edx,[4*edx + targetTable]
  35  *  68xxxxxxxx              push FT_Prolog
  36  *  C3                      lret
  37  */
  38 static void _write_ftprolog(LPBYTE relayCode ,DWORD *targetTable) {
  39         LPBYTE  x;
  40
  41         x       = relayCode;
  42         *x++    = 0x0f;*x++=0xb6;*x++=0xd1; /* movzbl edx,cl */
  43         *x++    = 0x8B;*x++=0x14;*x++=0x95;*(DWORD**)x= targetTable;
  44         x+=4;   /* mov edx, [4*edx + targetTable] */
  45         *x++    = 0x68; *(DWORD*)x = (DWORD)GetProcAddress32(GetModuleHandle32A("KERNEL32"),"FT_Prolog");
  46         x+=4;   /* push FT_Prolog */
  47         *x++    = 0xC3;         /* lret */
  48         /* fill rest with 0xCC / int 3 */
  49 }
  50
  51 /***********************************************************************
  52  *      _write_qtthunk                                  (internal)
  53  * Generates a QT_Thunk style call.
  54  *
  55  *  33C9                    xor ecx, ecx
  56  *  8A4DFC                  mov cl , [ebp-04]
  57  *  8B148Dxxxxxxxx          mov edx, [4*ecx + targetTable]
  58  *  B8yyyyyyyy              mov eax, QT_Thunk
  59  *  FFE0                    jmp eax
  60  */
  61 static void _write_qtthunk(
  62         LPBYTE relayCode,       /* [in] start of QT_Thunk stub */
  63         DWORD *targetTable      /* [in] start of thunk (for index lookup) */
  64 ) {
  65         LPBYTE  x;
  66
  67         x       = relayCode;
  68         *x++    = 0x33;*x++=0xC9; /* xor ecx,ecx */
  69         *x++    = 0x8A;*x++=0x4D;*x++=0xFC; /* movb cl,[ebp-04] */
  70         *x++    = 0x8B;*x++=0x14;*x++=0x8D;*(DWORD**)x= targetTable;
  71         x+=4;   /* mov edx, [4*ecx + targetTable */
  72         *x++    = 0xB8; *(DWORD*)x = (DWORD)GetProcAddress32(GetModuleHandle32A("KERNEL32"),"QT_Thunk");
  73         x+=4;   /* mov eax , QT_Thunk */
  74         *x++    = 0xFF; *x++ = 0xE0;    /* jmp eax */
  75         /* should fill the rest of the 32 bytes with 0xCC */
  76 }
  77
  78 struct thunkstruct
  79 {
  80         char    magic[4];
  81         DWORD   length;
  82         DWORD   ptr;
  83         DWORD   x0C;
  84
  85         DWORD   x10;
  86         DWORD   x14;
  87         DWORD   x18;
  88         DWORD   x1C;
  89         DWORD   x20;
  90 };
  91
  92 /***********************************************************************
  93  *              ThunkConnect32          (KERNEL32)
  94  * Connects a 32bit and a 16bit thunkbuffer.
  95  */
  96 UINT32 WINAPI ThunkConnect32(
  97         struct thunkstruct *ths,        /* [in/out] thunkbuffer */
  98         LPCSTR thunkfun16,              /* [in] win16 thunkfunction */
  99         LPCSTR module16,                /* [in] name of win16 dll */
 100         LPCSTR module32,                /* [in] name of win32 dll */
 101         HMODULE32 hmod32,               /* [in] hmodule of win32 dll (used?) */
 102         DWORD dllinitarg1               /* [in] initialisation argument */
 103 ) {
 104         HINSTANCE16     hmm;
 105         SEGPTR          thkbuf;
 106         struct  thunkstruct     *ths16;
 107
 108         TRACE(thunk,"(<struct>,%s,%s,%s,%x,%lx)\n",
 109                 thunkfun16,module32,module16,hmod32,dllinitarg1
 110         );
 111         TRACE(thunk,"   magic = %c%c%c%c\n",
 112                 ths->magic[0],
 113                 ths->magic[1],
 114                 ths->magic[2],
 115                 ths->magic[3]
 116         );
 117         TRACE(thunk,"   length = %lx\n",ths->length);
 118         if (lstrncmp32A(ths->magic,"SL01",4)&&lstrncmp32A(ths->magic,"LS01",4))
 119                 return 0;
 120         hmm=LoadModule16(module16,NULL);
 121         if (hmm<=32)
 122                 return 0;
 123         thkbuf=(SEGPTR)WIN32_GetProcAddress16(hmm,thunkfun16);
 124         if (!thkbuf)
 125                 return 0;
 126         ths16=(struct thunkstruct*)PTR_SEG_TO_LIN(thkbuf);
 127         if (lstrncmp32A(ths16->magic,ths->magic,4))
 128                 return 0;
 129
 130         if (!lstrncmp32A(ths->magic,"SL01",4))  {
 131                 if (ths16->length != ths->length)
 132                         return 0;
 133                 ths->x0C = (DWORD)ths16;
 134
 135                 TRACE(thunk,"   ths16 magic is 0x%08lx\n",*(DWORD*)ths16->magic);
 136                 if (*((DWORD*)ths16->magic) != 0x0000304C)
 137                         return 0;
 138                 if (!*(WORD*)(((LPBYTE)ths16)+0x12))
 139                         return 0;
 140
 141         }
 142         if (!lstrncmp32A(ths->magic,"LS01",4))  {
 143                 if (ths16->length != ths->length)
 144                         return 0;
 145                 ths->ptr = (DWORD)PTR_SEG_TO_LIN(ths16->ptr);
 146                 /* code offset for QT_Thunk is at 0x1C...  */
 147                 _write_qtthunk (((LPBYTE)ths) + ths->x1C,(DWORD *)ths->ptr);
 148                 /* code offset for FT_Prolog is at 0x20...  */
 149                 _write_ftprolog(((LPBYTE)ths) + ths->x20,(DWORD *)ths->ptr);
 150                 return 1;
 151         }
 152         return TRUE;
 153 }
 154
 155
 156 /**********************************************************************
 157  *              QT_Thunk                        (KERNEL32)
 158  *
 159  * The target address is in EDX.
 160  * The 16 bit arguments start at ESP+4.
 161  * The number of 16bit argumentbytes is EBP-ESP-0x44 (68 Byte thunksetup).
 162  * [ok]
 163  */
 164 VOID WINAPI QT_Thunk(CONTEXT *context)
 165 {
 166     CONTEXT context16;
 167     DWORD argsize;
 168     THDB *thdb = THREAD_Current();
 169
 170     memcpy(&context16,context,sizeof(context16));
 171
 172     CS_reg(&context16)  = HIWORD(EDX_reg(context));
 173     IP_reg(&context16)  = LOWORD(EDX_reg(context));
 174     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 175                            + (WORD)&((STACK16FRAME*)0)->bp;
 176
 177     argsize = EBP_reg(context)-ESP_reg(context)-0x44;
 178
 179     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 180             (LPBYTE)ESP_reg(context)+4, argsize );
 181
 182     EAX_reg(context) = Callbacks->CallRegisterShortProc( &context16, argsize );
 183 }
 184
 185
 186 /**********************************************************************
 187  *              FT_Prolog                       (KERNEL32.233)
 188  *
 189  * The set of FT_... thunk routines is used instead of QT_Thunk,
 190  * if structures have to be converted from 32-bit to 16-bit
 191  * (change of member alignment, conversion of members).
 192  *
 193  * The thunk function (as created by the thunk compiler) calls
 194  * FT_Prolog at the beginning, to set up a stack frame and
 195  * allocate a 64 byte buffer on the stack.
 196  * The input parameters (target address and some flags) are
 197  * saved for later use by FT_Thunk.
 198  *
 199  * Input:  EDX  16-bit target address (SEGPTR)
 200  *         CX   bits  0..7   target number (in target table)
 201  *              bits  8..9   some flags (unclear???)
 202  *              bits 10..15  number of DWORD arguments
 203  *
 204  * Output: A new stackframe is created, and a 64 byte buffer
 205  *         allocated on the stack. The layout of the stack
 206  *         on return is as follows:
 207  *
 208  *  (ebp+4)  return address to caller of thunk function
 209  *  (ebp)    old EBP
 210  *  (ebp-4)  saved EBX register of caller
 211  *  (ebp-8)  saved ESI register of caller
 212  *  (ebp-12) saved EDI register of caller
 213  *  (ebp-16) saved ECX register, containing flags
 214  *  (ebp-20) bitmap containing parameters that are to be converted
 215  *           by FT_Thunk; it is initialized to 0 by FT_Prolog and
 216  *           filled in by the thunk code before calling FT_Thunk
 217  *  (ebp-24)
 218  *    ...    (unclear)
 219  *  (ebp-44)
 220  *  (ebp-48) saved EAX register of caller (unclear, never restored???)
 221  *  (ebp-52) saved EDX register, containing 16-bit thunk target
 222  *  (ebp-56)
 223  *    ...    (unclear)
 224  *  (ebp-64)
 225  *
 226  *  ESP is EBP-68 on return.
 227  *
 228  */
 229
 230 #define POP_DWORD(ctx)          (*((DWORD *)ESP_reg(ctx))++)
 231 #define PUSH_DWORD(ctx, val)    *--((DWORD *)ESP_reg(ctx)) = (val)
 232
 233 VOID WINAPI FT_Prolog(CONTEXT *context)
 234 {
 235     /* Pop return address to thunk code */
 236     EIP_reg(context) = POP_DWORD(context);
 237
 238     /* Build stack frame */
 239     PUSH_DWORD(context, EBP_reg(context));
 240     EBP_reg(context) = ESP_reg(context);
 241
 242     /* Allocate 64-byte Thunk Buffer */
 243     ESP_reg(context) -= 64;
 244     memset((char *)ESP_reg(context), '\0', 64);
 245
 246     /* Store Flags (ECX) and Target Address (EDX) */
 247     /* Save other registers to be restored later */
 248     *(DWORD *)(EBP_reg(context) -  4) = EBX_reg(context);
 249     *(DWORD *)(EBP_reg(context) -  8) = ESI_reg(context);
 250     *(DWORD *)(EBP_reg(context) - 12) = EDI_reg(context);
 251     *(DWORD *)(EBP_reg(context) - 16) = ECX_reg(context);
 252
 253     *(DWORD *)(EBP_reg(context) - 48) = EAX_reg(context);
 254     *(DWORD *)(EBP_reg(context) - 52) = EDX_reg(context);
 255
 256     /* Push return address back onto stack */
 257     PUSH_DWORD(context, EIP_reg(context));
 258 }
 259
 260 /**********************************************************************
 261  *              FT_Thunk                        (KERNEL32.234)
 262  *
 263  * This routine performs the actual call to 16-bit code,
 264  * similar to QT_Thunk. The differences are:
 265  *  - The call target is taken from the buffer created by FT_Prolog
 266  *  - Those arguments requested by the thunk code (by setting the
 267  *    corresponding bit in the bitmap at EBP-20) are converted
 268  *    from 32-bit pointers to segmented pointers (those pointers
 269  *    are guaranteed to point to structures copied to the stack
 270  *    by the thunk code, so we always use the 16-bit stack selector
 271  *    for those addresses).
 272  *
 273  *    The bit #i of EBP-20 corresponds here to the DWORD starting at
 274  *    ESP+4 + 2*i.
 275  *
 276  * FIXME: It is unclear what happens if there are more than 32 WORDs
 277  *        of arguments, so that the single DWORD bitmap is no longer
 278  *        sufficient ...
 279  */
 280
 281 VOID WINAPI FT_Thunk(CONTEXT *context)
 282 {
 283     DWORD mapESPrelative = *(DWORD *)(EBP_reg(context) - 20);
 284     DWORD callTarget     = *(DWORD *)(EBP_reg(context) - 52);
 285
 286     CONTEXT context16;
 287     DWORD i, argsize;
 288     LPBYTE newstack;
 289     THDB *thdb = THREAD_Current();
 290
 291     memcpy(&context16,context,sizeof(context16));
 292
 293     CS_reg(&context16)  = HIWORD(callTarget);
 294     IP_reg(&context16)  = LOWORD(callTarget);
 295     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 296                            + (WORD)&((STACK16FRAME*)0)->bp;
 297
 298     argsize  = EBP_reg(context)-ESP_reg(context)-0x44;
 299     newstack = ((LPBYTE)THREAD_STACK16(thdb))-argsize;
 300
 301     memcpy( newstack, (LPBYTE)ESP_reg(context)+4, argsize );
 302
 303     for (i = 0; i < 32; i++)    /* NOTE: What about > 32 arguments? */
 304         if (mapESPrelative & (1 << i))
 305         {
 306             SEGPTR *arg = (SEGPTR *)(newstack + 2*i);
 307             *arg = PTR_SEG_OFF_TO_SEGPTR(SELECTOROF(thdb->cur_stack),
 308                                          *(LPBYTE *)arg - newstack);
 309         }
 310
 311     EAX_reg(context) = Callbacks->CallRegisterShortProc( &context16, argsize );
 312 }
 313
 314 /**********************************************************************
 315  *              FT_ExitNN               (KERNEL32.218 - 232)
 316  *
 317  * One of the FT_ExitNN functions is called at the end of the thunk code.
 318  * It removes the stack frame created by FT_Prolog, moves the function
 319  * return from EBX to EAX (yes, FT_Thunk did use EAX for the return
 320  * value, but the thunk code has moved it from EAX to EBX in the
 321  * meantime ... :-), restores the caller's EBX, ESI, and EDI registers,
 322  * and perform a return to the CALLER of the thunk code (while removing
 323  * the given number of arguments from the caller's stack).
 324  */
 325
 326 VOID WINAPI FT_Exit(CONTEXT *context, int nPopArgs)
 327 {
 328     /* Return value is in EBX */
 329     EAX_reg(context) = EBX_reg(context);
 330
 331     /* Restore EBX, ESI, and EDI registers */
 332     EBX_reg(context) = *(DWORD *)(EBP_reg(context) -  4);
 333     ESI_reg(context) = *(DWORD *)(EBP_reg(context) -  8);
 334     EDI_reg(context) = *(DWORD *)(EBP_reg(context) - 12);
 335
 336     /* Clean up stack frame */
 337     ESP_reg(context) = EBP_reg(context);
 338     EBP_reg(context) = POP_DWORD(context);
 339
 340     /* Pop return address to CALLER of thunk code */
 341     EIP_reg(context) = POP_DWORD(context);
 342     /* Remove arguments */
 343     ESP_reg(context) += nPopArgs;
 344     /* Push return address back onto stack */
 345     PUSH_DWORD(context, EIP_reg(context));
 346 }
 347
 348 VOID WINAPI FT_Exit0 (CONTEXT *context) { FT_Exit(context,  0); }
 349 VOID WINAPI FT_Exit4 (CONTEXT *context) { FT_Exit(context,  4); }
 350 VOID WINAPI FT_Exit8 (CONTEXT *context) { FT_Exit(context,  8); }
 351 VOID WINAPI FT_Exit12(CONTEXT *context) { FT_Exit(context, 12); }
 352 VOID WINAPI FT_Exit16(CONTEXT *context) { FT_Exit(context, 16); }
 353 VOID WINAPI FT_Exit20(CONTEXT *context) { FT_Exit(context, 20); }
 354 VOID WINAPI FT_Exit24(CONTEXT *context) { FT_Exit(context, 24); }
 355 VOID WINAPI FT_Exit28(CONTEXT *context) { FT_Exit(context, 28); }
 356 VOID WINAPI FT_Exit32(CONTEXT *context) { FT_Exit(context, 32); }
 357 VOID WINAPI FT_Exit36(CONTEXT *context) { FT_Exit(context, 36); }
 358 VOID WINAPI FT_Exit40(CONTEXT *context) { FT_Exit(context, 40); }
 359 VOID WINAPI FT_Exit44(CONTEXT *context) { FT_Exit(context, 44); }
 360 VOID WINAPI FT_Exit48(CONTEXT *context) { FT_Exit(context, 48); }
 361 VOID WINAPI FT_Exit52(CONTEXT *context) { FT_Exit(context, 52); }
 362 VOID WINAPI FT_Exit56(CONTEXT *context) { FT_Exit(context, 56); }
 363
 364
 365 /**********************************************************************
 366  *           WOWCallback16 (KERNEL32.62)(WOW32.2)
 367  * Calls a win16 function with a single DWORD argument.
 368  * RETURNS
 369  *      the return value
 370  */
 371 DWORD WINAPI WOWCallback16(
 372         FARPROC16 fproc,        /* [in] win16 function to call */
 373         DWORD arg               /* [in] single DWORD argument to function */
 374 ) {
 375         DWORD   ret;
 376         TRACE(thunk,"(%p,0x%08lx)...\n",fproc,arg);
 377         ret =  Callbacks->CallWOWCallbackProc(fproc,arg);
 378         TRACE(thunk,"... returns %ld\n",ret);
 379         return ret;
 380 }
 381
 382 /**********************************************************************
 383  *           WOWCallback16Ex (KERNEL32.55)(WOW32.3)
 384  * Calls a function in 16bit code.
 385  * RETURNS
 386  *      TRUE for success
 387  */
 388 BOOL32 WINAPI WOWCallback16Ex(
 389         FARPROC16 vpfn16,       /* [in] win16 function to call */
 390         DWORD dwFlags,          /* [in] flags */
 391         DWORD cbArgs,           /* [in] nr of arguments */
 392         LPVOID pArgs,           /* [in] pointer to arguments (LPDWORD) */
 393         LPDWORD pdwRetCode      /* [out] return value of win16 function */
 394 ) {
 395         return Callbacks->CallWOWCallback16Ex(vpfn16,dwFlags,cbArgs,pArgs,pdwRetCode);
 396 }
 397
 398 /***********************************************************************
 399  *           _KERNEL32_52    (KERNEL32.52)
 400  * Returns a pointer to ThkBuf in the 16bit library SYSTHUNK.DLL.
 401  * [ok probably]
 402  */
 403 LPVOID WINAPI _KERNEL32_52()
 404 {
 405         HMODULE32       hmod = LoadLibrary16("systhunk.dll");
 406
 407         TRACE(thunk, "systhunk.dll module %d\n", hmod);
 408
 409         if (hmod<=32)
 410                 return 0;
 411         return PTR_SEG_TO_LIN(WIN32_GetProcAddress16(hmod,"ThkBuf"));
 412 }
 413
 414 /***********************************************************************
 415  *              ThunkInitLS     (KERNEL32.43)
 416  * A thunkbuffer link routine
 417  * The thunkbuf looks like:
 418  *
 419  *      00: DWORD       length          ? don't know exactly
 420  *      04: SEGPTR      ptr             ? where does it point to?
 421  * The pointer ptr is written into the first DWORD of 'thunk'.
 422  * (probably correct implemented)
 423  * [ok probably]
 424  * RETURNS
 425  *      segmented pointer to thunk?
 426  */
 427 DWORD WINAPI ThunkInitLS(
 428         LPDWORD thunk,  /* [in] win32 thunk */
 429         LPCSTR thkbuf,  /* [in] thkbuffer name in win16 dll */
 430         DWORD len,      /* [in] thkbuffer length */
 431         LPCSTR dll16,   /* [in] name of win16 dll */
 432         LPCSTR dll32    /* [in] name of win32 dll (FIXME: not used?) */
 433 ) {
 434         HINSTANCE16     hmod;
 435         LPDWORD         addr;
 436         SEGPTR          segaddr;
 437
 438         hmod = LoadLibrary16(dll16);
 439         if (hmod<32) {
 440                 WARN(thunk,"failed to load 16bit DLL %s, error %d\n",
 441                              dll16,hmod);
 442                 return 0;
 443         }
 444         segaddr = (DWORD)WIN32_GetProcAddress16(hmod,(LPSTR)thkbuf);
 445         if (!segaddr) {
 446                 WARN(thunk,"no %s exported from %s!\n",thkbuf,dll16);
 447                 return 0;
 448         }
 449         addr = (LPDWORD)PTR_SEG_TO_LIN(segaddr);
 450         if (addr[0] != len) {
 451                 WARN(thunk,"thkbuf length mismatch? %ld vs %ld\n",len,addr[0]);
 452                 return 0;
 453         }
 454         if (!addr[1])
 455                 return 0;
 456         *(DWORD*)thunk = addr[1];
 457
 458         TRACE(thunk, "loaded module %d, func %s (%d) @ %p (%p), returning %p\n",
 459                      hmod, HIWORD(thkbuf)==0 ? "<ordinal>" : thkbuf, (int)thkbuf,
 460                      (void*)segaddr, addr, (void*)addr[1]);
 461
 462         return addr[1];
 463 }
 464
 465 /***********************************************************************
 466  *              Common32ThkLS   (KERNEL32.45)
 467  *
 468  * This is another 32->16 thunk, independent of the QT_Thunk/FT_Thunk
 469  * style thunks. The basic difference is that the parameter conversion
 470  * is done completely on the *16-bit* side here. Thus we do not call
 471  * the 16-bit target directly, but call a common entry point instead.
 472  * This entry function then calls the target according to the target
 473  * number passed in the DI register.
 474  *
 475  * Input:  EAX    SEGPTR to the common 16-bit entry point
 476  *         CX     offset in thunk table (target number * 4)
 477  *         DX     error return value if execution fails (unclear???)
 478  *         EDX.HI number of DWORD parameters
 479  *
 480  * (Note that we need to move the thunk table offset from CX to DI !)
 481  *
 482  * The called 16-bit stub expects its stack to look like this:
 483  *     ...
 484  *   (esp+40)  32-bit arguments
 485  *     ...
 486  *   (esp+8)   32 byte of stack space available as buffer
 487  *   (esp)     8 byte return address for use with 0x66 lret
 488  *
 489  * The called 16-bit stub uses a 0x66 lret to return to 32-bit code,
 490  * and uses the EAX register to return a DWORD return value.
 491  * Thus we need to use a special assembly glue routine
 492  * (CallRegisterLongProc instead of CallRegisterShortProc).
 493  *
 494  * Finally, we return to the caller, popping the arguments off
 495  * the stack.
 496  *
 497  * FIXME: The called function uses EBX to return the number of
 498  *        arguments that are to be popped off the caller's stack.
 499  *        This is clobbered by the assembly glue, so we simply use
 500  *        the original EDX.HI to get the number of arguments.
 501  *        (Those two values should be equal anyway ...?)
 502  *
 503  */
 504 VOID WINAPI Common32ThkLS(CONTEXT *context)
 505 {
 506     CONTEXT context16;
 507     DWORD argsize;
 508     THDB *thdb = THREAD_Current();
 509
 510     memcpy(&context16,context,sizeof(context16));
 511
 512     DI_reg(&context16)  = CX_reg(context);
 513     CS_reg(&context16)  = HIWORD(EAX_reg(context));
 514     IP_reg(&context16)  = LOWORD(EAX_reg(context));
 515     EBP_reg(&context16) = OFFSETOF( thdb->cur_stack )
 516                            + (WORD)&((STACK16FRAME*)0)->bp;
 517
 518     argsize = HIWORD(EDX_reg(context)) * 4;
 519
 520     memcpy( ((LPBYTE)THREAD_STACK16(thdb))-argsize,
 521             (LPBYTE)ESP_reg(context)+4, argsize );
 522
 523     EAX_reg(context) = Callbacks->CallRegisterLongProc(&context16, argsize + 32);
 524
 525     /* Clean up caller's stack frame */
 526
 527     EIP_reg(context) = POP_DWORD(context);
 528     ESP_reg(context) += argsize;
 529     PUSH_DWORD(context, EIP_reg(context));
 530 }
 531
 532 /***********************************************************************
 533  *              _KERNEL32_40    (KERNEL32.40)
 534  * YET Another 32->16 thunk, the difference to the others is still mysterious
 535  * Target address is in EDX.
 536  *
 537  * [crashes]
 538  */
 539 VOID WINAPI _KERNEL32_40(CONTEXT *context)
 540 {
 541         CONTEXT context16;
 542         LPBYTE  curstack;
 543         DWORD   ret,stacksize;
 544         THDB *thdb = THREAD_Current();
 545
 546         __RESTORE_ES;
 547         TRACE(thunk,"(EDX=0x%08lx)\n", EDX_reg(context) );
 548         stacksize = EBP_reg(context)-ESP_reg(context);
 549         TRACE(thunk,"   stacksize = %ld\n",stacksize);
 550         TRACE(thunk,"on top of stack: 0x%04x\n",*(WORD*)ESP_reg(context));
 551
 552         memcpy(&context16,context,sizeof(context16));
 553
 554         CS_reg(&context16)       = HIWORD(EDX_reg(context));
 555         IP_reg(&context16)       = LOWORD(EDX_reg(context));
 556
 557         curstack = PTR_SEG_TO_LIN(STACK16_PUSH( thdb, stacksize ));
 558         memcpy(curstack-stacksize,(LPBYTE)ESP_reg(context),stacksize);
 559         ret = Callbacks->CallRegisterShortProc(&context16,0);
 560         STACK16_POP( thdb, stacksize );
 561
 562         TRACE(thunk,". returned %08lx\n",ret);
 563         EAX_reg(context)         = ret;
 564 }
 565
 566
 567 /***********************************************************************
 568  *              ThunkInitLSF            (KERNEL32.41)
 569  * A thunk setup routine.
 570  * Expects a pointer to a preinitialized thunkbuffer in the first argument
 571  * looking like:
 572  *      00..03:         unknown (pointer, check _41, _43, _46)
 573  *      04: EB1E                jmp +0x20
 574  *
 575  *      06..23:         unknown (space for replacement code, check .90)
 576  *
 577  *      24:>E800000000          call offset 29
 578  *      29:>58                  pop eax            ( target of call )
 579  *      2A: 2D25000000          sub eax,0x00000025 ( now points to offset 4 )
 580  *      2F: BAxxxxxxxx          mov edx,xxxxxxxx
 581  *      34: 68yyyyyyyy          push KERNEL32.90
 582  *      39: C3                  ret
 583  *
 584  *      3A: EB1E                jmp +0x20
 585  *      3E ... 59:      unknown (space for replacement code?)
 586  *      5A: E8xxxxxxxx          call <32bitoffset xxxxxxxx>
 587  *      5F: 5A                  pop edx
 588  *      60: 81EA25xxxxxx        sub edx, 0x25xxxxxx
 589  *      66: 52                  push edx
 590  *      67: 68xxxxxxxx          push xxxxxxxx
 591  *      6C: 68yyyyyyyy          push KERNEL32.89
 592  *      71: C3                  ret
 593  *      72: end?
 594  * This function checks if the code is there, and replaces the yyyyyyyy entries
 595  * by the functionpointers.
 596  * The thunkbuf looks like:
 597  *
 598  *      00: DWORD       length          ? don't know exactly
 599  *      04: SEGPTR      ptr             ? where does it point to?
 600  * The segpointer ptr is written into the first DWORD of 'thunk'.
 601  * [ok probably]
 602  * RETURNS
 603  *      unclear, pointer to win16 thkbuffer?
 604  */
 605 LPVOID WINAPI ThunkInitLSF(
 606         LPBYTE thunk,   /* [in] win32 thunk */
 607         LPCSTR thkbuf,  /* [in] thkbuffer name in win16 dll */
 608         DWORD len,      /* [in] length of thkbuffer */
 609         LPCSTR dll16,   /* [in] name of win16 dll */
 610         LPCSTR dll32    /* [in] name of win32 dll */
 611 ) {
 612         HMODULE32       hkrnl32 = GetModuleHandle32A("KERNEL32");
 613         HMODULE16       hmod;
 614         LPDWORD         addr,addr2;
 615         DWORD           segaddr;
 616
 617         /* FIXME: add checks for valid code ... */
 618         /* write pointers to kernel32.89 and kernel32.90 (+ordinal base of 1) */
 619         *(DWORD*)(thunk+0x35) = (DWORD)GetProcAddress32(hkrnl32,(LPSTR)90);
 620         *(DWORD*)(thunk+0x6D) = (DWORD)GetProcAddress32(hkrnl32,(LPSTR)89);
 621
 622
 623         hmod = LoadLibrary16(dll16);
 624         if (hmod<32) {
 625                 ERR(thunk,"failed to load 16bit DLL %s, error %d\n",
 626                              dll16,hmod);
 627                 return NULL;
 628         }
 629         segaddr = (DWORD)WIN32_GetProcAddress16(hmod,(LPSTR)thkbuf);
 630         if (!segaddr) {
 631                 ERR(thunk,"no %s exported from %s!\n",thkbuf,dll16);
 632                 return NULL;
 633         }
 634         addr = (LPDWORD)PTR_SEG_TO_LIN(segaddr);
 635         if (addr[0] != len) {
 636                 ERR(thunk,"thkbuf length mismatch? %ld vs %ld\n",len,addr[0]);
 637                 return NULL;
 638         }
 639         addr2 = PTR_SEG_TO_LIN(addr[1]);
 640         if (HIWORD(addr2))
 641                 *(DWORD*)thunk = (DWORD)addr2;
 642
 643         TRACE(thunk, "loaded module %d, func %s(%d) @ %p (%p), returning %p\n",
 644                       hmod, HIWORD(thkbuf)==0 ? "<ordinal>" : thkbuf, (int)thkbuf,
 645                      (void*)segaddr, addr, addr2);
 646
 647         return addr2;
 648 }
 649
 650 /***********************************************************************
 651  *              FT_PrologPrime                  (KERNEL32.89)
 652  *
 653  * This function is called from the relay code installed by
 654  * ThunkInitLSF. It replaces the location from where it was
 655  * called by a standard FT_Prolog call stub (which is 'primed'
 656  * by inserting the correct target table pointer).
 657  * Finally, it calls that stub.
 658  *
 659  * Input:  ECX    target number + flags (passed through to FT_Prolog)
 660  *        (ESP)   offset of location where target table pointer
 661  *                is stored, relative to the start of the relay code
 662  *        (ESP+4) pointer to start of relay code
 663  *                (this is where the FT_Prolog call stub gets written to)
 664  *
 665  * Note: The two DWORD arguments get popped from the stack.
 666  *
 667  */
 668 VOID WINAPI FT_PrologPrime(CONTEXT *context)
 669 {
 670     DWORD  targetTableOffset = POP_DWORD(context);
 671     LPBYTE relayCode = (LPBYTE)POP_DWORD(context);
 672     DWORD *targetTable = *(DWORD **)(relayCode+targetTableOffset);
 673     DWORD  targetNr = LOBYTE(ECX_reg(context));
 674
 675     _write_ftprolog(relayCode, targetTable);
 676
 677     /* We should actually call the relay code now, */
 678     /* but we skip it and go directly to FT_Prolog */
 679     EDX_reg(context) = targetTable[targetNr];
 680     FT_Prolog(context);
 681 }
 682
 683 /***********************************************************************
 684  *              QT_ThunkPrime                   (KERNEL32.90)
 685  *
 686  * This function corresponds to FT_PrologPrime, but installs a
 687  * call stub for QT_Thunk instead.
 688  *
 689  * Input: (EBP-4) target number (passed through to QT_Thunk)
 690  *         EDX    target table pointer location offset
 691  *         EAX    start of relay code
 692  *
 693  */
 694 VOID WINAPI QT_ThunkPrime(CONTEXT *context)
 695 {
 696     DWORD  targetTableOffset = EDX_reg(context);
 697     LPBYTE relayCode = (LPBYTE)EAX_reg(context);
 698     DWORD *targetTable = *(DWORD **)(relayCode+targetTableOffset);
 699     DWORD  targetNr = *(DWORD *)(EBP_reg(context) - 4);
 700
 701     _write_qtthunk(relayCode, targetTable);
 702
 703     /* We should actually call the relay code now, */
 704     /* but we skip it and go directly to QT_Thunk */
 705     EDX_reg(context) = targetTable[targetNr];
 706     QT_Thunk(context);
 707 }
 708
 709 /***********************************************************************
 710  *                                                      (KERNEL32.46)
 711  * Another thunkbuf link routine.
 712  * The start of the thunkbuf looks like this:
 713  *      00: DWORD       length
 714  *      04: SEGPTR      address for thunkbuffer pointer
 715  * [ok probably]
 716  */
 717 VOID WINAPI ThunkInitSL(
 718         LPBYTE thunk,           /* [in] start of thunkbuffer */
 719         LPCSTR thkbuf,          /* [in] name/ordinal of thunkbuffer in win16 dll */
 720         DWORD len,              /* [in] length of thunkbuffer */
 721         LPCSTR dll16,           /* [in] name of win16 dll containing the thkbuf */
 722         LPCSTR dll32            /* [in] win32 dll. FIXME: strange, unused */
 723 ) {
 724         LPDWORD         addr;
 725         HMODULE16       hmod;
 726         SEGPTR          segaddr;
 727
 728         hmod = LoadLibrary16(dll16);
 729         if (hmod < 32) {
 730                 ERR(thunk,"couldn't load %s, error %d\n",dll16,hmod);
 731                 return;
 732         }
 733         segaddr = (SEGPTR)WIN32_GetProcAddress16(hmod,thkbuf);
 734         if (!segaddr) {
 735                 ERR(thunk,"haven't found %s in %s!\n",thkbuf,dll16);
 736                 return;
 737         }
 738         addr = (LPDWORD)PTR_SEG_TO_LIN(segaddr);
 739         if (addr[0] != len) {
 740                 ERR(thunk,"length of thkbuf differs from expected length! "
 741                              "(%ld vs %ld)\n",addr[0],len);
 742                 return;
 743         }
 744         *(DWORD*)PTR_SEG_TO_LIN(addr[1]) = (DWORD)thunk;
 745
 746         TRACE(thunk, "loaded module %d, func %s(%d) @ %p (%p)\n",
 747                      hmod, HIWORD(thkbuf)==0 ? "<ordinal>" : thkbuf,
 748                      (int)thkbuf, (void*)segaddr, addr);
 749 }
 750
 751 /**********************************************************************
 752  *           SSOnBigStack       KERNEL32.87
 753  * Check if thunking is initialized (ss selector set up etc.)
 754  * We do that differently, so just return TRUE.
 755  * [ok]
 756  * RETURNS
 757  *      TRUE for success.
 758  */
 759 BOOL32 WINAPI SSOnBigStack()
 760 {
 761     TRACE(thunk, "Yes, thunking is initialized\n");
 762     return TRUE;
 763 }
 764
 765 /**********************************************************************
 766  *           SSCall
 767  * One of the real thunking functions. This one seems to be for 32<->32
 768  * thunks. It should probably be capable of crossing processboundaries.
 769  *
 770  * And YES, I've seen nr=48 (somewhere in the Win95 32<->16 OLE coupling)
 771  * [ok]
 772  */
 773 DWORD WINAPIV SSCall(
 774         DWORD nr,       /* [in] number of argument bytes */
 775         DWORD flags,    /* [in] FIXME: flags ? */
 776         FARPROC32 fun,  /* [in] function to call */
 777         ...             /* [in/out] arguments */
 778 ) {
 779     DWORD i,ret;
 780     DWORD *args = ((DWORD *)&fun) + 1;
 781
 782     if(TRACE_ON(thunk)){
 783       dbg_decl_str(thunk, 256);
 784       for (i=0;i<nr/4;i++)
 785         dsprintf(thunk,"0x%08lx,",args[i]);
 786       TRACE(thunk,"(%ld,0x%08lx,%p,[%s])\n",
 787                     nr,flags,fun,dbg_str(thunk));
 788     }
 789     switch (nr) {
 790     case 0:     ret = fun();
 791                 break;
 792     case 4:     ret = fun(args[0]);
 793                 break;
 794     case 8:     ret = fun(args[0],args[1]);
 795                 break;
 796     case 12:    ret = fun(args[0],args[1],args[2]);
 797                 break;
 798     case 16:    ret = fun(args[0],args[1],args[2],args[3]);
 799                 break;
 800     case 20:    ret = fun(args[0],args[1],args[2],args[3],args[4]);
 801                 break;
 802     case 24:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5]);
 803                 break;
 804     case 28:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6]);
 805                 break;
 806     case 32:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7]);
 807                 break;
 808     case 36:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8]);
 809                 break;
 810     case 40:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9]);
 811                 break;
 812     case 44:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9],args[10]);
 813                 break;
 814     case 48:    ret = fun(args[0],args[1],args[2],args[3],args[4],args[5],args[6],args[7],args[8],args[9],args[10],args[11]);
 815                 break;
 816     default:
 817         fprintf(stderr,"_KERNEL32_88: unsupported nr of arguments, %ld\n",nr);
 818         ret = 0;
 819         break;
 820
 821     }
 822     TRACE(thunk," returning %ld ...\n",ret);
 823     return ret;
 824 }
 825
 826 /**********************************************************************
 827  *              KERNEL_619              (KERNEL)
 828  * Seems to store y and z depending on x in some internal lists...
 829  */
 830 WORD WINAPI _KERNEL_619(WORD x,DWORD y,DWORD z)
 831 {
 832     fprintf(stderr,"KERNEL_619(0x%04x,0x%08lx,0x%08lx)\n",x,y,z);
 833     return x;
 834 }
 835
 836 /**********************************************************************
 837  *                      AllocSLCallback         (KERNEL32)
 838  *
 839  * Win95 uses some structchains for callbacks. It allocates them
 840  * in blocks of 100 entries, size 32 bytes each, layout:
 841  * blockstart:
 842  *      0:      PTR     nextblockstart
 843  *      4:      entry   *first;
 844  *      8:      WORD    sel ( start points to blockstart)
 845  *      A:      WORD    unknown
 846  * 100xentry:
 847  *      00..17:         Code
 848  *      18:     PDB     *owning_process;
 849  *      1C:     PTR     blockstart
 850  *
 851  * We ignore this for now. (Just a note for further developers)
 852  * FIXME: use this method, so we don't waste selectors...
 853  *
 854  * Following code is then generated by AllocSLCallback. The code is 16 bit, so
 855  * the 0x66 prefix switches from word->long registers.
 856  *
 857  *      665A            pop     edx
 858  *      6668x arg2 x    pushl   <arg2>
 859  *      6652            push    edx
 860  *      EAx arg1 x      jmpf    <arg1>
 861  *
 862  * returns the startaddress of this thunk.
 863  *
 864  * Note, that they look very similair to the ones allocates by THUNK_Alloc.
 865  * RETURNS
 866  *      segmented pointer to the start of the thunk
 867  */
 868 DWORD WINAPI
 869 AllocSLCallback(
 870         DWORD finalizer,        /* [in] finalizer function */
 871         DWORD callback          /* [in] callback function */
 872 ) {
 873         LPBYTE  x,thunk = HeapAlloc( GetProcessHeap(), 0, 32 );
 874         WORD    sel;
 875
 876         x=thunk;
 877         *x++=0x66;*x++=0x5a;                            /* popl edx */
 878         *x++=0x66;*x++=0x68;*(DWORD*)x=finalizer;x+=4;  /* pushl finalizer */
 879         *x++=0x66;*x++=0x52;                            /* pushl edx */
 880         *x++=0xea;*(DWORD*)x=callback;x+=4;             /* jmpf callback */
 881
 882         *(PDB32**)(thunk+18) = PROCESS_Current();
 883
 884         sel = SELECTOR_AllocBlock( thunk , 32, SEGMENT_CODE, FALSE, FALSE );
 885         return (sel<<16)|0;
 886 }
 887
 888 /**********************************************************************
 889  *              FreeSLCallback          (KERNEL32.274)
 890  * Frees the specified 16->32 callback
 891  */
 892 void WINAPI
 893 FreeSLCallback(
 894         DWORD x /* [in] 16 bit callback (segmented pointer?) */
 895 ) {
 896         fprintf(stderr,"FreeSLCallback(0x%08lx)\n",x);
 897 }
 898
 899
 900 /**********************************************************************
 901  *              KERNEL_471              (KERNEL.471)
 902  * RETURNS
 903  *      Seems to return the uncrypted current process pointer. [Not 100% sure].
 904  */
 905 LPVOID WINAPI
 906 _KERNEL_471() {
 907         return PROCESS_Current();
 908 }
 909
 910 /**********************************************************************
 911  *              KERNEL_472              (KERNEL.472)
 912  * something like GetCurrenthInstance.
 913  * RETURNS
 914  *      the hInstance
 915  */
 916 VOID WINAPI
 917 _KERNEL_472(CONTEXT *context) {
 918         fprintf(stderr,"_KERNEL_472(0x%08lx),stub\n",EAX_reg(context));
 919         if (!EAX_reg(context)) {
 920                 TDB *pTask = (TDB*)GlobalLock16(GetCurrentTask());
 921                 AX_reg(context)=pTask->hInstance;
 922                 return;
 923         }
 924         if (!HIWORD(EAX_reg(context)))
 925                 return; /* returns the passed value */
 926         /* hmm ... fixme */
 927 }
 928
 929 /**********************************************************************
 930  *              KERNEL_431              (KERNEL.431)
 931  *              IsPeFormat              (W32SYS.2)
 932  * Checks the passed filename if it is a PE format executeable
 933  * RETURNS
 934  *  TRUE, if it is.
 935  *  FALSE if not.
 936  */
 937 BOOL16 WINAPI IsPeFormat(
 938         LPSTR   fn,     /* [in] filename to executeable */
 939         HFILE16 hf16    /* [in] open file, if filename is NULL */
 940 ) {
 941         IMAGE_DOS_HEADER        mzh;
 942         HFILE32                 hf=hf16;
 943         OFSTRUCT                ofs;
 944         DWORD                   xmagic;
 945
 946         if (fn) {
 947                 hf = OpenFile32(fn,&ofs,OF_READ);
 948                 if (hf==HFILE_ERROR32)
 949                         return FALSE;
 950         }
 951         _llseek32(hf,0,SEEK_SET);
 952         if (sizeof(mzh)!=_lread32(hf,&mzh,sizeof(mzh))) {
 953                 _lclose32(hf);
 954                 return FALSE;
 955         }
 956         if (mzh.e_magic!=IMAGE_DOS_SIGNATURE) {
 957                 fprintf(stderr,"file has not got dos signature!\n");
 958                 _lclose32(hf);
 959                 return FALSE;
 960         }
 961         _llseek32(hf,mzh.e_lfanew,SEEK_SET);
 962         if (sizeof(DWORD)!=_lread32(hf,&xmagic,sizeof(DWORD))) {
 963                 _lclose32(hf);
 964                 return FALSE;
 965         }
 966         _lclose32(hf);
 967         return (xmagic == IMAGE_NT_SIGNATURE);
 968 }
 969
 970 /***********************************************************************
 971  *           WOWHandle32                        (KERNEL32.57)(WOW32.16)
 972  * Converts a win16 handle of type into the respective win32 handle.
 973  * We currently just return this handle, since most handles are the same
 974  * for win16 and win32.
 975  * RETURNS
 976  *      The new handle
 977  */
 978 HANDLE32 WINAPI WOWHandle32(
 979         WORD handle,            /* [in] win16 handle */
 980         WOW_HANDLE_TYPE type    /* [in] handle type */
 981 ) {
 982         fprintf(stderr,"WOWHandle32(0x%04x,%d)\n",handle,type);
 983         return (HANDLE32)handle;
 984 }
 985
 986 /***********************************************************************
 987  *           FUNC004                            (KERNEL.631)
 988  * A 16->32 thunk setup function.
 989  * Gets called from a thunkbuffer (value of EAX). It overwrites the start
 990  * with a jmp to a kernel32 function. The kernel32 function gets passed EDX.
 991  * (and possibly CX).
 992  */
 993 void WINAPI FUNC004(
 994         CONTEXT *context        /* [in/out] register context from 1632-relay */
 995 ) {
 996
 997         FIXME(reg,",STUB (edx is 0x%08lx, eax is 0x%08lx,edx[0x10] is 0x%08lx)!\n",
 998                 EDX_reg(context),
 999                 EAX_reg(context),
1000                 ((DWORD*)PTR_SEG_TO_LIN(EDX_reg(context)))[0x10/4]
1001         );
1002
1003 #if 0
1004 {
1005         LPBYTE  x,target = (LPBYTE)PTR_SEG_TO_LIN(EAX_reg(context));
1006         WORD    ds,cs;
1007
1008         GET_DS(ds);
1009         GET_CS(cs);
1010 /* Won't work anyway since we don't know the function called in KERNEL32 -Marcus*/
1011         x = target;
1012         *x++= 0xb8; *(WORD*)x= ds;x+=2;         /* mov ax,KERNEL32_DS */
1013         *x++= 0x8e; *x++ = 0xc0;                /* mov es,ax */
1014         *x++= 0x66; *x++ = 0xba; *(DWORD*)x=EDX_reg(context);x+=4;
1015                                                 /* mov edx, $EDX */
1016         *x++= 0x66; *x++ = 0xea;        /* jmp KERNEL32_CS:kernel32fun */
1017                 *(DWORD*)x=0;x+=4;/* FIXME: _what_ function does it call? */
1018                 *(WORD*)x=cs;x+=2;
1019
1020
1021         IP_reg(context) = LOWORD(EAX_reg(context));
1022         CS_reg(context) = HIWORD(EAX_reg(context));
1023 }
1024 #endif
1025         return;
1026 }
1027