2 * KERNEL32 thunks and other undocumented stuff
4 * Copyright 1997-1998 Marcus Meissner
5 * Copyright 1998 Ulrich Weigand
16 #include "stackframe.h"
18 #include "selectors.h"
23 #include "flatthunk.h"
27 /***********************************************************************
29 * Win95 internal thunks *
31 ***********************************************************************/
33 /***********************************************************************
34 * Generates a FT_Prolog call.
36 * 0FB6D1 movzbl edx,cl
37 * 8B1495xxxxxxxx mov edx,[4*edx + targetTable]
38 * 68xxxxxxxx push FT_Prolog
41 static void _write_ftprolog(LPBYTE relayCode
,DWORD
*targetTable
) {
45 *x
++ = 0x0f;*x
++=0xb6;*x
++=0xd1; /* movzbl edx,cl */
46 *x
++ = 0x8B;*x
++=0x14;*x
++=0x95;*(DWORD
**)x
= targetTable
;
47 x
+=4; /* mov edx, [4*edx + targetTable] */
48 *x
++ = 0x68; *(DWORD
*)x
= (DWORD
)GetProcAddress32(GetModuleHandle32A("KERNEL32"),"FT_Prolog");
49 x
+=4; /* push FT_Prolog */
50 *x
++ = 0xC3; /* lret */
51 /* fill rest with 0xCC / int 3 */
54 /***********************************************************************
55 * _write_qtthunk (internal)
56 * Generates a QT_Thunk style call.
59 * 8A4DFC mov cl , [ebp-04]
60 * 8B148Dxxxxxxxx mov edx, [4*ecx + targetTable]
61 * B8yyyyyyyy mov eax, QT_Thunk
64 static void _write_qtthunk(
65 LPBYTE relayCode
, /* [in] start of QT_Thunk stub */
66 DWORD
*targetTable
/* [in] start of thunk (for index lookup) */
71 *x
++ = 0x33;*x
++=0xC9; /* xor ecx,ecx */
72 *x
++ = 0x8A;*x
++=0x4D;*x
++=0xFC; /* movb cl,[ebp-04] */
73 *x
++ = 0x8B;*x
++=0x14;*x
++=0x8D;*(DWORD
**)x
= targetTable
;
74 x
+=4; /* mov edx, [4*ecx + targetTable */
75 *x
++ = 0xB8; *(DWORD
*)x
= (DWORD
)GetProcAddress32(GetModuleHandle32A("KERNEL32"),"QT_Thunk");
76 x
+=4; /* mov eax , QT_Thunk */
77 *x
++ = 0xFF; *x
++ = 0xE0; /* jmp eax */
78 /* should fill the rest of the 32 bytes with 0xCC */
81 /***********************************************************************
84 static LPVOID
_loadthunk(LPSTR module
, LPSTR func
, LPSTR module32
,
85 struct ThunkDataCommon
*TD32
)
87 struct ThunkDataCommon
*TD16
;
90 if ((hmod
= LoadLibrary16(module
)) <= 32)
92 ERR(thunk
, "(%s, %s, %s, %p): Unable to load '%s', error %d\n",
93 module
, func
, module32
, TD32
, module
, hmod
);
97 if (!(TD16
= PTR_SEG_TO_LIN(WIN32_GetProcAddress16(hmod
, func
))))
99 ERR(thunk
, "(%s, %s, %s, %p): Unable to find '%s'\n",
100 module
, func
, module32
, TD32
, func
);
104 if (TD32
&& memcmp(TD16
->magic
, TD32
->magic
, 4))
106 ERR(thunk
, "(%s, %s, %s, %p): Bad magic %c%c%c%c (should be %c%c%c%c)\n",
107 module
, func
, module32
, TD32
,
108 TD16
->magic
[0], TD16
->magic
[1], TD16
->magic
[2], TD16
->magic
[3],
109 TD32
->magic
[0], TD32
->magic
[1], TD32
->magic
[2], TD32
->magic
[3]);
113 if (TD32
&& TD16
->checksum
!= TD32
->checksum
)
115 ERR(thunk
, "(%s, %s, %s, %p): Wrong checksum %08lx (should be %08lx)\n",
116 module
, func
, module32
, TD32
, TD16
->checksum
, TD32
->checksum
);
123 /***********************************************************************
124 * GetThunkStuff (KERNEL32.53)
126 LPVOID WINAPI
GetThunkStuff(LPSTR module
, LPSTR func
)
128 return _loadthunk(module
, func
, "<kernel>", NULL
);
131 /***********************************************************************
132 * GetThunkBuff (KERNEL32.52)
133 * Returns a pointer to ThkBuf in the 16bit library SYSTHUNK.DLL.
135 LPVOID WINAPI
GetThunkBuff(void)
137 return GetThunkStuff("SYSTHUNK.DLL", "ThkBuf");
140 /***********************************************************************
141 * ThunkConnect32 (KERNEL32)
142 * Connects a 32bit and a 16bit thunkbuffer.
144 UINT32 WINAPI
ThunkConnect32(
145 struct ThunkDataCommon
*TD
, /* [in/out] thunkbuffer */
146 LPSTR thunkfun16
, /* [in] win16 thunkfunction */
147 LPSTR module16
, /* [in] name of win16 dll */
148 LPSTR module32
, /* [in] name of win32 dll */
149 HMODULE32 hmod32
, /* [in] hmodule of win32 dll */
150 DWORD dwReason
/* [in] initialisation argument */
154 if (!lstrncmp32A(TD
->magic
, "SL01", 4))
158 TRACE(thunk
, "SL01 thunk %s (%lx) <- %s (%s), Reason: %ld\n",
159 module32
, (DWORD
)TD
, module16
, thunkfun16
, dwReason
);
161 else if (!lstrncmp32A(TD
->magic
, "LS01", 4))
165 TRACE(thunk
, "LS01 thunk %s (%lx) -> %s (%s), Reason: %ld\n",
166 module32
, (DWORD
)TD
, module16
, thunkfun16
, dwReason
);
170 ERR(thunk
, "Invalid magic %c%c%c%c\n",
171 TD
->magic
[0], TD
->magic
[1], TD
->magic
[2], TD
->magic
[3]);
177 case DLL_PROCESS_ATTACH
:
179 struct ThunkDataCommon
*TD16
;
180 if (!(TD16
= _loadthunk(module16
, thunkfun16
, module32
, TD
)))
185 struct ThunkDataSL32
*SL32
= (struct ThunkDataSL32
*)TD
;
186 struct ThunkDataSL16
*SL16
= (struct ThunkDataSL16
*)TD16
;
187 struct SLTargetDB
*tdb
;
189 if (SL16
->fpData
== NULL
)
191 ERR(thunk
, "ThunkConnect16 was not called!\n");
195 SL32
->data
= SL16
->fpData
;
197 tdb
= HeapAlloc(GetProcessHeap(), 0, sizeof(*tdb
));
198 tdb
->process
= PROCESS_Current();
199 tdb
->targetTable
= (DWORD
*)(thunkfun16
+ SL32
->offsetTargetTable
);
201 tdb
->next
= SL32
->data
->targetDB
; /* FIXME: not thread-safe! */
202 SL32
->data
->targetDB
= tdb
;
204 TRACE(thunk
, "Process %08lx allocated TargetDB entry for ThunkDataSL %08lx\n",
205 (DWORD
)PROCESS_Current(), (DWORD
)SL32
->data
);
209 struct ThunkDataLS32
*LS32
= (struct ThunkDataLS32
*)TD
;
210 struct ThunkDataLS16
*LS16
= (struct ThunkDataLS16
*)TD16
;
212 LS32
->targetTable
= PTR_SEG_TO_LIN(LS16
->targetTable
);
214 /* write QT_Thunk and FT_Prolog stubs */
215 _write_qtthunk ((LPBYTE
)TD
+ LS32
->offsetQTThunk
, LS32
->targetTable
);
216 _write_ftprolog((LPBYTE
)TD
+ LS32
->offsetFTProlog
, LS32
->targetTable
);
221 case DLL_PROCESS_DETACH
:
229 /**********************************************************************
230 * QT_Thunk (KERNEL32)
232 * The target address is in EDX.
233 * The 16 bit arguments start at ESP+4.
234 * The number of 16bit argumentbytes is EBP-ESP-0x44 (68 Byte thunksetup).
237 REGS_ENTRYPOINT(QT_Thunk
)
241 THDB
*thdb
= THREAD_Current();
243 memcpy(&context16
,context
,sizeof(context16
));
245 CS_reg(&context16
) = HIWORD(EDX_reg(context
));
246 IP_reg(&context16
) = LOWORD(EDX_reg(context
));
247 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
248 + (WORD
)&((STACK16FRAME
*)0)->bp
;
250 argsize
= EBP_reg(context
)-ESP_reg(context
)-0x44;
252 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
253 (LPBYTE
)ESP_reg(context
)+4, argsize
);
255 EAX_reg(context
) = Callbacks
->CallRegisterShortProc( &context16
, argsize
);
256 EDX_reg(context
) = HIWORD(EAX_reg(context
));
260 /**********************************************************************
261 * FT_Prolog (KERNEL32.233)
263 * The set of FT_... thunk routines is used instead of QT_Thunk,
264 * if structures have to be converted from 32-bit to 16-bit
265 * (change of member alignment, conversion of members).
267 * The thunk function (as created by the thunk compiler) calls
268 * FT_Prolog at the beginning, to set up a stack frame and
269 * allocate a 64 byte buffer on the stack.
270 * The input parameters (target address and some flags) are
271 * saved for later use by FT_Thunk.
273 * Input: EDX 16-bit target address (SEGPTR)
274 * CX bits 0..7 target number (in target table)
275 * bits 8..9 some flags (unclear???)
276 * bits 10..15 number of DWORD arguments
278 * Output: A new stackframe is created, and a 64 byte buffer
279 * allocated on the stack. The layout of the stack
280 * on return is as follows:
282 * (ebp+4) return address to caller of thunk function
284 * (ebp-4) saved EBX register of caller
285 * (ebp-8) saved ESI register of caller
286 * (ebp-12) saved EDI register of caller
287 * (ebp-16) saved ECX register, containing flags
288 * (ebp-20) bitmap containing parameters that are to be converted
289 * by FT_Thunk; it is initialized to 0 by FT_Prolog and
290 * filled in by the thunk code before calling FT_Thunk
294 * (ebp-48) saved EAX register of caller (unclear, never restored???)
295 * (ebp-52) saved EDX register, containing 16-bit thunk target
300 * ESP is EBP-68 on return.
304 REGS_ENTRYPOINT(FT_Prolog
)
306 /* Pop return address to thunk code */
307 EIP_reg(context
) = STACK32_POP(context
);
309 /* Build stack frame */
310 STACK32_PUSH(context
, EBP_reg(context
));
311 EBP_reg(context
) = ESP_reg(context
);
313 /* Allocate 64-byte Thunk Buffer */
314 ESP_reg(context
) -= 64;
315 memset((char *)ESP_reg(context
), '\0', 64);
317 /* Store Flags (ECX) and Target Address (EDX) */
318 /* Save other registers to be restored later */
319 *(DWORD
*)(EBP_reg(context
) - 4) = EBX_reg(context
);
320 *(DWORD
*)(EBP_reg(context
) - 8) = ESI_reg(context
);
321 *(DWORD
*)(EBP_reg(context
) - 12) = EDI_reg(context
);
322 *(DWORD
*)(EBP_reg(context
) - 16) = ECX_reg(context
);
324 *(DWORD
*)(EBP_reg(context
) - 48) = EAX_reg(context
);
325 *(DWORD
*)(EBP_reg(context
) - 52) = EDX_reg(context
);
327 /* Push return address back onto stack */
328 STACK32_PUSH(context
, EIP_reg(context
));
331 /**********************************************************************
332 * FT_Thunk (KERNEL32.234)
334 * This routine performs the actual call to 16-bit code,
335 * similar to QT_Thunk. The differences are:
336 * - The call target is taken from the buffer created by FT_Prolog
337 * - Those arguments requested by the thunk code (by setting the
338 * corresponding bit in the bitmap at EBP-20) are converted
339 * from 32-bit pointers to segmented pointers (those pointers
340 * are guaranteed to point to structures copied to the stack
341 * by the thunk code, so we always use the 16-bit stack selector
342 * for those addresses).
344 * The bit #i of EBP-20 corresponds here to the DWORD starting at
347 * FIXME: It is unclear what happens if there are more than 32 WORDs
348 * of arguments, so that the single DWORD bitmap is no longer
352 REGS_ENTRYPOINT(FT_Thunk
)
354 DWORD mapESPrelative
= *(DWORD
*)(EBP_reg(context
) - 20);
355 DWORD callTarget
= *(DWORD
*)(EBP_reg(context
) - 52);
359 LPBYTE newstack
, oldstack
;
360 THDB
*thdb
= THREAD_Current();
362 memcpy(&context16
,context
,sizeof(context16
));
364 CS_reg(&context16
) = HIWORD(callTarget
);
365 IP_reg(&context16
) = LOWORD(callTarget
);
366 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
367 + (WORD
)&((STACK16FRAME
*)0)->bp
;
369 argsize
= EBP_reg(context
)-ESP_reg(context
)-0x44;
370 newstack
= ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
;
371 oldstack
= (LPBYTE
)ESP_reg(context
)+4;
373 memcpy( newstack
, oldstack
, argsize
);
375 for (i
= 0; i
< 32; i
++) /* NOTE: What about > 32 arguments? */
376 if (mapESPrelative
& (1 << i
))
378 SEGPTR
*arg
= (SEGPTR
*)(newstack
+ 2*i
);
379 *arg
= PTR_SEG_OFF_TO_SEGPTR(SELECTOROF(thdb
->cur_stack
),
380 OFFSETOF(thdb
->cur_stack
) - argsize
381 + (*(LPBYTE
*)arg
- oldstack
));
384 EAX_reg(context
) = Callbacks
->CallRegisterShortProc( &context16
, argsize
);
385 EDX_reg(context
) = HIWORD(EAX_reg(context
));
388 /**********************************************************************
389 * FT_ExitNN (KERNEL32.218 - 232)
391 * One of the FT_ExitNN functions is called at the end of the thunk code.
392 * It removes the stack frame created by FT_Prolog, moves the function
393 * return from EBX to EAX (yes, FT_Thunk did use EAX for the return
394 * value, but the thunk code has moved it from EAX to EBX in the
395 * meantime ... :-), restores the caller's EBX, ESI, and EDI registers,
396 * and perform a return to the CALLER of the thunk code (while removing
397 * the given number of arguments from the caller's stack).
400 static void FT_Exit(CONTEXT
*context
, int nPopArgs
)
402 /* Return value is in EBX */
403 EAX_reg(context
) = EBX_reg(context
);
405 /* Restore EBX, ESI, and EDI registers */
406 EBX_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 4);
407 ESI_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 8);
408 EDI_reg(context
) = *(DWORD
*)(EBP_reg(context
) - 12);
410 /* Clean up stack frame */
411 ESP_reg(context
) = EBP_reg(context
);
412 EBP_reg(context
) = STACK32_POP(context
);
414 /* Pop return address to CALLER of thunk code */
415 EIP_reg(context
) = STACK32_POP(context
);
416 /* Remove arguments */
417 ESP_reg(context
) += nPopArgs
;
418 /* Push return address back onto stack */
419 STACK32_PUSH(context
, EIP_reg(context
));
422 REGS_ENTRYPOINT(FT_Exit0
) { FT_Exit(context
, 0); }
423 REGS_ENTRYPOINT(FT_Exit4
) { FT_Exit(context
, 4); }
424 REGS_ENTRYPOINT(FT_Exit8
) { FT_Exit(context
, 8); }
425 REGS_ENTRYPOINT(FT_Exit12
) { FT_Exit(context
, 12); }
426 REGS_ENTRYPOINT(FT_Exit16
) { FT_Exit(context
, 16); }
427 REGS_ENTRYPOINT(FT_Exit20
) { FT_Exit(context
, 20); }
428 REGS_ENTRYPOINT(FT_Exit24
) { FT_Exit(context
, 24); }
429 REGS_ENTRYPOINT(FT_Exit28
) { FT_Exit(context
, 28); }
430 REGS_ENTRYPOINT(FT_Exit32
) { FT_Exit(context
, 32); }
431 REGS_ENTRYPOINT(FT_Exit36
) { FT_Exit(context
, 36); }
432 REGS_ENTRYPOINT(FT_Exit40
) { FT_Exit(context
, 40); }
433 REGS_ENTRYPOINT(FT_Exit44
) { FT_Exit(context
, 44); }
434 REGS_ENTRYPOINT(FT_Exit48
) { FT_Exit(context
, 48); }
435 REGS_ENTRYPOINT(FT_Exit52
) { FT_Exit(context
, 52); }
436 REGS_ENTRYPOINT(FT_Exit56
) { FT_Exit(context
, 56); }
439 /**********************************************************************
440 * WOWCallback16 (KERNEL32.62)(WOW32.2)
441 * Calls a win16 function with a single DWORD argument.
445 DWORD WINAPI
WOWCallback16(
446 FARPROC16 fproc
, /* [in] win16 function to call */
447 DWORD arg
/* [in] single DWORD argument to function */
450 TRACE(thunk
,"(%p,0x%08lx)...\n",fproc
,arg
);
451 ret
= Callbacks
->CallWOWCallbackProc(fproc
,arg
);
452 TRACE(thunk
,"... returns %ld\n",ret
);
456 /**********************************************************************
457 * WOWCallback16Ex (KERNEL32.55)(WOW32.3)
458 * Calls a function in 16bit code.
462 BOOL32 WINAPI
WOWCallback16Ex(
463 FARPROC16 vpfn16
, /* [in] win16 function to call */
464 DWORD dwFlags
, /* [in] flags */
465 DWORD cbArgs
, /* [in] nr of arguments */
466 LPVOID pArgs
, /* [in] pointer to arguments (LPDWORD) */
467 LPDWORD pdwRetCode
/* [out] return value of win16 function */
469 return Callbacks
->CallWOWCallback16Ex(vpfn16
,dwFlags
,cbArgs
,pArgs
,pdwRetCode
);
472 /***********************************************************************
473 * ThunkInitLS (KERNEL32.43)
474 * A thunkbuffer link routine
475 * The thunkbuf looks like:
477 * 00: DWORD length ? don't know exactly
478 * 04: SEGPTR ptr ? where does it point to?
479 * The pointer ptr is written into the first DWORD of 'thunk'.
480 * (probably correct implemented)
483 * segmented pointer to thunk?
485 DWORD WINAPI
ThunkInitLS(
486 LPDWORD thunk
, /* [in] win32 thunk */
487 LPCSTR thkbuf
, /* [in] thkbuffer name in win16 dll */
488 DWORD len
, /* [in] thkbuffer length */
489 LPCSTR dll16
, /* [in] name of win16 dll */
490 LPCSTR dll32
/* [in] name of win32 dll (FIXME: not used?) */
496 hmod
= LoadLibrary16(dll16
);
498 WARN(thunk
,"failed to load 16bit DLL %s, error %d\n",
502 segaddr
= (DWORD
)WIN32_GetProcAddress16(hmod
,(LPSTR
)thkbuf
);
504 WARN(thunk
,"no %s exported from %s!\n",thkbuf
,dll16
);
507 addr
= (LPDWORD
)PTR_SEG_TO_LIN(segaddr
);
508 if (addr
[0] != len
) {
509 WARN(thunk
,"thkbuf length mismatch? %ld vs %ld\n",len
,addr
[0]);
514 *(DWORD
*)thunk
= addr
[1];
516 TRACE(thunk
, "loaded module %d, func %s (%d) @ %p (%p), returning %p\n",
517 hmod
, HIWORD(thkbuf
)==0 ? "<ordinal>" : thkbuf
, (int)thkbuf
,
518 (void*)segaddr
, addr
, (void*)addr
[1]);
523 /***********************************************************************
524 * Common32ThkLS (KERNEL32.45)
526 * This is another 32->16 thunk, independent of the QT_Thunk/FT_Thunk
527 * style thunks. The basic difference is that the parameter conversion
528 * is done completely on the *16-bit* side here. Thus we do not call
529 * the 16-bit target directly, but call a common entry point instead.
530 * This entry function then calls the target according to the target
531 * number passed in the DI register.
533 * Input: EAX SEGPTR to the common 16-bit entry point
534 * CX offset in thunk table (target number * 4)
535 * DX error return value if execution fails (unclear???)
536 * EDX.HI number of DWORD parameters
538 * (Note that we need to move the thunk table offset from CX to DI !)
540 * The called 16-bit stub expects its stack to look like this:
542 * (esp+40) 32-bit arguments
544 * (esp+8) 32 byte of stack space available as buffer
545 * (esp) 8 byte return address for use with 0x66 lret
547 * The called 16-bit stub uses a 0x66 lret to return to 32-bit code,
548 * and uses the EAX register to return a DWORD return value.
549 * Thus we need to use a special assembly glue routine
550 * (CallRegisterLongProc instead of CallRegisterShortProc).
552 * Finally, we return to the caller, popping the arguments off
555 * FIXME: The called function uses EBX to return the number of
556 * arguments that are to be popped off the caller's stack.
557 * This is clobbered by the assembly glue, so we simply use
558 * the original EDX.HI to get the number of arguments.
559 * (Those two values should be equal anyway ...?)
562 REGS_ENTRYPOINT(Common32ThkLS
)
566 THDB
*thdb
= THREAD_Current();
568 memcpy(&context16
,context
,sizeof(context16
));
570 DI_reg(&context16
) = CX_reg(context
);
571 CS_reg(&context16
) = HIWORD(EAX_reg(context
));
572 IP_reg(&context16
) = LOWORD(EAX_reg(context
));
573 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
574 + (WORD
)&((STACK16FRAME
*)0)->bp
;
576 argsize
= HIWORD(EDX_reg(context
)) * 4;
578 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
579 (LPBYTE
)ESP_reg(context
)+4, argsize
);
581 EAX_reg(context
) = Callbacks
->CallRegisterLongProc(&context16
, argsize
+ 32);
583 /* Clean up caller's stack frame */
585 EIP_reg(context
) = STACK32_POP(context
);
586 ESP_reg(context
) += argsize
;
587 STACK32_PUSH(context
, EIP_reg(context
));
590 /***********************************************************************
591 * OT_32ThkLSF (KERNEL32.40)
593 * YET Another 32->16 thunk. The difference to Common32ThkLS is that
594 * argument processing is done on both the 32-bit and the 16-bit side:
595 * The 32-bit side prepares arguments, copying them onto the stack.
597 * When this routine is called, the first word on the stack is the
598 * number of argument bytes prepared by the 32-bit code, and EDX
599 * contains the 16-bit target address.
601 * The called 16-bit routine is another relaycode, doing further
602 * argument processing and then calling the real 16-bit target
603 * whose address is stored at [bp-04].
605 * The call proceeds using a normal CallRegisterShortProc.
606 * After return from the 16-bit relaycode, the arguments need
607 * to be copied *back* to the 32-bit stack, since the 32-bit
608 * relaycode processes output parameters.
610 * Note that we copy twice the number of arguments, since some of the
611 * 16-bit relaycodes in SYSTHUNK.DLL directly access the original
612 * arguments of the caller!
614 * (Note that this function seems only to be used for
615 * OLECLI32 -> OLECLI and OLESVR32 -> OLESVR thunking.)
617 REGS_ENTRYPOINT(OT_32ThkLSF
)
621 THDB
*thdb
= THREAD_Current();
623 memcpy(&context16
,context
,sizeof(context16
));
625 CS_reg(&context16
) = HIWORD(EDX_reg(context
));
626 IP_reg(&context16
) = LOWORD(EDX_reg(context
));
627 EBP_reg(&context16
) = OFFSETOF( thdb
->cur_stack
)
628 + (WORD
)&((STACK16FRAME
*)0)->bp
;
630 argsize
= 2 * *(WORD
*)(ESP_reg(context
) + 4) + 2;
632 memcpy( ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
,
633 (LPBYTE
)ESP_reg(context
)+4, argsize
);
635 EAX_reg(context
) = Callbacks
->CallRegisterShortProc(&context16
, argsize
);
637 memcpy( (LPBYTE
)ESP_reg(context
)+4,
638 ((LPBYTE
)THREAD_STACK16(thdb
))-argsize
, argsize
);
641 /***********************************************************************
642 * ThunkInitLSF (KERNEL32.41)
643 * A thunk setup routine.
644 * Expects a pointer to a preinitialized thunkbuffer in the first argument
646 * 00..03: unknown (pointer, check _41, _43, _46)
649 * 06..23: unknown (space for replacement code, check .90)
651 * 24:>E800000000 call offset 29
652 * 29:>58 pop eax ( target of call )
653 * 2A: 2D25000000 sub eax,0x00000025 ( now points to offset 4 )
654 * 2F: BAxxxxxxxx mov edx,xxxxxxxx
655 * 34: 68yyyyyyyy push KERNEL32.90
659 * 3E ... 59: unknown (space for replacement code?)
660 * 5A: E8xxxxxxxx call <32bitoffset xxxxxxxx>
662 * 60: 81EA25xxxxxx sub edx, 0x25xxxxxx
664 * 67: 68xxxxxxxx push xxxxxxxx
665 * 6C: 68yyyyyyyy push KERNEL32.89
668 * This function checks if the code is there, and replaces the yyyyyyyy entries
669 * by the functionpointers.
670 * The thunkbuf looks like:
672 * 00: DWORD length ? don't know exactly
673 * 04: SEGPTR ptr ? where does it point to?
674 * The segpointer ptr is written into the first DWORD of 'thunk'.
677 * unclear, pointer to win16 thkbuffer?
679 LPVOID WINAPI
ThunkInitLSF(
680 LPBYTE thunk
, /* [in] win32 thunk */
681 LPCSTR thkbuf
, /* [in] thkbuffer name in win16 dll */
682 DWORD len
, /* [in] length of thkbuffer */
683 LPCSTR dll16
, /* [in] name of win16 dll */
684 LPCSTR dll32
/* [in] name of win32 dll */
686 HMODULE32 hkrnl32
= GetModuleHandle32A("KERNEL32");
691 /* FIXME: add checks for valid code ... */
692 /* write pointers to kernel32.89 and kernel32.90 (+ordinal base of 1) */
693 *(DWORD
*)(thunk
+0x35) = (DWORD
)GetProcAddress32(hkrnl32
,(LPSTR
)90);
694 *(DWORD
*)(thunk
+0x6D) = (DWORD
)GetProcAddress32(hkrnl32
,(LPSTR
)89);
697 hmod
= LoadLibrary16(dll16
);
699 ERR(thunk
,"failed to load 16bit DLL %s, error %d\n",
703 segaddr
= (DWORD
)WIN32_GetProcAddress16(hmod
,(LPSTR
)thkbuf
);
705 ERR(thunk
,"no %s exported from %s!\n",thkbuf
,dll16
);
708 addr
= (LPDWORD
)PTR_SEG_TO_LIN(segaddr
);
709 if (addr
[0] != len
) {
710 ERR(thunk
,"thkbuf length mismatch? %ld vs %ld\n",len
,addr
[0]);
713 addr2
= PTR_SEG_TO_LIN(addr
[1]);
715 *(DWORD
*)thunk
= (DWORD
)addr2
;
717 TRACE(thunk
, "loaded module %d, func %s(%d) @ %p (%p), returning %p\n",
718 hmod
, HIWORD(thkbuf
)==0 ? "<ordinal>" : thkbuf
, (int)thkbuf
,
719 (void*)segaddr
, addr
, addr2
);
724 /***********************************************************************
725 * FT_PrologPrime (KERNEL32.89)
727 * This function is called from the relay code installed by
728 * ThunkInitLSF. It replaces the location from where it was
729 * called by a standard FT_Prolog call stub (which is 'primed'
730 * by inserting the correct target table pointer).
731 * Finally, it calls that stub.
733 * Input: ECX target number + flags (passed through to FT_Prolog)
734 * (ESP) offset of location where target table pointer
735 * is stored, relative to the start of the relay code
736 * (ESP+4) pointer to start of relay code
737 * (this is where the FT_Prolog call stub gets written to)
739 * Note: The two DWORD arguments get popped from the stack.
742 REGS_ENTRYPOINT(FT_PrologPrime
)
744 DWORD targetTableOffset
= STACK32_POP(context
);
745 LPBYTE relayCode
= (LPBYTE
)STACK32_POP(context
);
746 DWORD
*targetTable
= *(DWORD
**)(relayCode
+targetTableOffset
);
747 DWORD targetNr
= LOBYTE(ECX_reg(context
));
749 _write_ftprolog(relayCode
, targetTable
);
751 /* We should actually call the relay code now, */
752 /* but we skip it and go directly to FT_Prolog */
753 EDX_reg(context
) = targetTable
[targetNr
];
754 __regs_FT_Prolog(context
);
757 /***********************************************************************
758 * QT_ThunkPrime (KERNEL32.90)
760 * This function corresponds to FT_PrologPrime, but installs a
761 * call stub for QT_Thunk instead.
763 * Input: (EBP-4) target number (passed through to QT_Thunk)
764 * EDX target table pointer location offset
765 * EAX start of relay code
768 REGS_ENTRYPOINT(QT_ThunkPrime
)
770 DWORD targetTableOffset
= EDX_reg(context
);
771 LPBYTE relayCode
= (LPBYTE
)EAX_reg(context
);
772 DWORD
*targetTable
= *(DWORD
**)(relayCode
+targetTableOffset
);
773 DWORD targetNr
= LOBYTE(*(DWORD
*)(EBP_reg(context
) - 4));
775 _write_qtthunk(relayCode
, targetTable
);
777 /* We should actually call the relay code now, */
778 /* but we skip it and go directly to QT_Thunk */
779 EDX_reg(context
) = targetTable
[targetNr
];
780 __regs_QT_Thunk(context
);
783 /***********************************************************************
785 * Another thunkbuf link routine.
786 * The start of the thunkbuf looks like this:
788 * 04: SEGPTR address for thunkbuffer pointer
791 VOID WINAPI
ThunkInitSL(
792 LPBYTE thunk
, /* [in] start of thunkbuffer */
793 LPCSTR thkbuf
, /* [in] name/ordinal of thunkbuffer in win16 dll */
794 DWORD len
, /* [in] length of thunkbuffer */
795 LPCSTR dll16
, /* [in] name of win16 dll containing the thkbuf */
796 LPCSTR dll32
/* [in] win32 dll. FIXME: strange, unused */
802 hmod
= LoadLibrary16(dll16
);
804 ERR(thunk
,"couldn't load %s, error %d\n",dll16
,hmod
);
807 segaddr
= (SEGPTR
)WIN32_GetProcAddress16(hmod
,(LPSTR
)thkbuf
);
809 ERR(thunk
,"haven't found %s in %s!\n",thkbuf
,dll16
);
812 addr
= (LPDWORD
)PTR_SEG_TO_LIN(segaddr
);
813 if (addr
[0] != len
) {
814 ERR(thunk
,"length of thkbuf differs from expected length! "
815 "(%ld vs %ld)\n",addr
[0],len
);
818 *(DWORD
*)PTR_SEG_TO_LIN(addr
[1]) = (DWORD
)thunk
;
820 TRACE(thunk
, "loaded module %d, func %s(%d) @ %p (%p)\n",
821 hmod
, HIWORD(thkbuf
)==0 ? "<ordinal>" : thkbuf
,
822 (int)thkbuf
, (void*)segaddr
, addr
);
825 /**********************************************************************
830 BOOL32 WINAPI
SSInit()
835 /**********************************************************************
836 * SSOnBigStack KERNEL32.87
837 * Check if thunking is initialized (ss selector set up etc.)
838 * We do that differently, so just return TRUE.
843 BOOL32 WINAPI
SSOnBigStack()
845 TRACE(thunk
, "Yes, thunking is initialized\n");
849 /**********************************************************************
851 * One of the real thunking functions. This one seems to be for 32<->32
852 * thunks. It should probably be capable of crossing processboundaries.
854 * And YES, I've seen nr=48 (somewhere in the Win95 32<->16 OLE coupling)
857 DWORD WINAPIV
SSCall(
858 DWORD nr
, /* [in] number of argument bytes */
859 DWORD flags
, /* [in] FIXME: flags ? */
860 FARPROC32 fun
, /* [in] function to call */
861 ... /* [in/out] arguments */
864 DWORD
*args
= ((DWORD
*)&fun
) + 1;
867 dbg_decl_str(thunk
, 256);
869 dsprintf(thunk
,"0x%08lx,",args
[i
]);
870 TRACE(thunk
,"(%ld,0x%08lx,%p,[%s])\n",
871 nr
,flags
,fun
,dbg_str(thunk
));
876 case 4: ret
= fun(args
[0]);
878 case 8: ret
= fun(args
[0],args
[1]);
880 case 12: ret
= fun(args
[0],args
[1],args
[2]);
882 case 16: ret
= fun(args
[0],args
[1],args
[2],args
[3]);
884 case 20: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4]);
886 case 24: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5]);
888 case 28: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6]);
890 case 32: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7]);
892 case 36: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8]);
894 case 40: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9]);
896 case 44: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9],args
[10]);
898 case 48: ret
= fun(args
[0],args
[1],args
[2],args
[3],args
[4],args
[5],args
[6],args
[7],args
[8],args
[9],args
[10],args
[11]);
901 WARN(thunk
,"Unsupported nr of arguments, %ld\n",nr
);
906 TRACE(thunk
," returning %ld ...\n",ret
);
910 /**********************************************************************
911 * InitCBClient (KERNEL.623)
913 WORD WINAPI
InitCBClient(DWORD x
)
915 FIXME(thunk
,"(0x%08lx): stub\n",x
);
919 /**********************************************************************
920 * RegisterCBClient (KERNEL.619)
921 * Seems to store y and z depending on x in some internal lists...
923 WORD WINAPI
RegisterCBClient(WORD x
,DWORD y
,DWORD z
)
925 FIXME(thunk
,"(0x%04x,0x%08lx,0x%08lx): stub\n",x
,y
,z
);
929 /**********************************************************************
930 * KERNEL_607 (KERNEL)
932 LPVOID WINAPI
_KERNEL_607(SEGPTR target
, LPVOID relay
, DWORD dummy
)
934 TDB
*pTask
= (TDB
*)GlobalLock16(GetCurrentTask());
935 LPBYTE thunk
= HeapAlloc( GetProcessHeap(), 0, 22 ), x
= thunk
;
937 *x
++=0x90; *x
++=0x68; *((DWORD
*)x
)++=(DWORD
)relay
; /* nop; pushl relay */
938 *x
++=0x90; *x
++=0x68; *((DWORD
*)x
)++=(DWORD
)target
; /* nop; pushl target */
939 *x
++=0x90; *x
++=0x58; /* nop; popl eax */
941 *x
++=0xCC; *x
++=0xCC;
942 *x
++=0x01; /* type: LS */
943 *((WORD
*)x
)++ = pTask
->hInstance
; /* owner */
944 *((WORD
*)x
)++ = 0; /* next */
949 /**********************************************************************
950 * KERNEL_608 (KERNEL)
952 SEGPTR WINAPI
_KERNEL_608(LPVOID target
, SEGPTR relay
, DWORD dummy
)
954 TDB
*pTask
= (TDB
*)GlobalLock16(GetCurrentTask());
955 LPBYTE thunk
= HeapAlloc( GetProcessHeap(), 0, 22 ), x
= thunk
;
958 *x
++=0x66; *x
++=0x68; *((DWORD
*)x
)++=(DWORD
)relay
; /* pushl relay */
959 *x
++=0x66; *x
++=0x68; *((DWORD
*)x
)++=(DWORD
)target
; /* pushl target */
960 *x
++=0x66; *x
++=0x58; /* popl eax */
962 *x
++=0xCC; *x
++=0xCC;
963 *x
++=0x02; /* type: SL */
964 *((WORD
*)x
)++ = pTask
->hInstance
; /* owner */
965 *((WORD
*)x
)++ = 0; /* next */
967 sel
= SELECTOR_AllocBlock( thunk
, 22, SEGMENT_CODE
, FALSE
, FALSE
);
968 return PTR_SEG_OFF_TO_SEGPTR( sel
, 0 );
971 /**********************************************************************
972 * KERNEL_611 (KERNEL)
974 VOID WINAPI
_KERNEL_611(DWORD relay
, DWORD target
)
978 /**********************************************************************
979 * KERNEL_612 (KERNEL)
981 BOOL16 WINAPI
_KERNEL_612(LPBYTE target
)
983 return target
[ 0] == 0x66 && target
[ 1] == 0x68
984 && target
[ 6] == 0x66 && target
[ 2] == 0x68
985 && target
[12] == 0x66 && target
[13] == 0x58
986 && target
[14] == 0xCB;
989 /**********************************************************************
990 * AllocSLCallback (KERNEL32)
992 * Win95 uses some structchains for callbacks. It allocates them
993 * in blocks of 100 entries, size 32 bytes each, layout:
995 * 0: PTR nextblockstart
997 * 8: WORD sel ( start points to blockstart)
1001 * 18: PDB *owning_process;
1002 * 1C: PTR blockstart
1004 * We ignore this for now. (Just a note for further developers)
1005 * FIXME: use this method, so we don't waste selectors...
1007 * Following code is then generated by AllocSLCallback. The code is 16 bit, so
1008 * the 0x66 prefix switches from word->long registers.
1011 * 6668x arg2 x pushl <arg2>
1013 * EAx arg1 x jmpf <arg1>
1015 * returns the startaddress of this thunk.
1017 * Note, that they look very similair to the ones allocates by THUNK_Alloc.
1019 * segmented pointer to the start of the thunk
1023 DWORD finalizer
, /* [in] finalizer function */
1024 DWORD callback
/* [in] callback function */
1026 LPBYTE x
,thunk
= HeapAlloc( GetProcessHeap(), 0, 32 );
1030 *x
++=0x66;*x
++=0x5a; /* popl edx */
1031 *x
++=0x66;*x
++=0x68;*(DWORD
*)x
=finalizer
;x
+=4; /* pushl finalizer */
1032 *x
++=0x66;*x
++=0x52; /* pushl edx */
1033 *x
++=0xea;*(DWORD
*)x
=callback
;x
+=4; /* jmpf callback */
1035 *(PDB32
**)(thunk
+18) = PROCESS_Current();
1037 sel
= SELECTOR_AllocBlock( thunk
, 32, SEGMENT_CODE
, FALSE
, FALSE
);
1041 /**********************************************************************
1042 * FreeSLCallback (KERNEL32.274)
1043 * Frees the specified 16->32 callback
1047 DWORD x
/* [in] 16 bit callback (segmented pointer?) */
1049 FIXME(win32
,"(0x%08lx): stub\n",x
);
1053 /**********************************************************************
1054 * GetTEBSelectorFS (KERNEL.475)
1055 * Set the 16-bit %fs to the 32-bit %fs (current TEB selector)
1057 VOID WINAPI
GetTEBSelectorFS( CONTEXT
*context
)
1059 GET_FS( FS_reg(context
) );
1062 /**********************************************************************
1063 * KERNEL_431 (KERNEL.431)
1064 * IsPeFormat (W32SYS.2)
1065 * Checks the passed filename if it is a PE format executeable
1070 BOOL16 WINAPI
IsPeFormat(
1071 LPSTR fn
, /* [in] filename to executeable */
1072 HFILE16 hf16
/* [in] open file, if filename is NULL */
1074 IMAGE_DOS_HEADER mzh
;
1075 HFILE32 hf
=HFILE16_TO_HFILE32(hf16
);
1080 hf
= OpenFile32(fn
,&ofs
,OF_READ
);
1081 if (hf
==HFILE_ERROR32
)
1084 _llseek32(hf
,0,SEEK_SET
);
1085 if (sizeof(mzh
)!=_lread32(hf
,&mzh
,sizeof(mzh
))) {
1089 if (mzh
.e_magic
!=IMAGE_DOS_SIGNATURE
) {
1090 WARN(dosmem
,"File has not got dos signature!\n");
1094 _llseek32(hf
,mzh
.e_lfanew
,SEEK_SET
);
1095 if (sizeof(DWORD
)!=_lread32(hf
,&xmagic
,sizeof(DWORD
))) {
1100 return (xmagic
== IMAGE_NT_SIGNATURE
);
1103 /***********************************************************************
1104 * WOWHandle32 (KERNEL32.57)(WOW32.16)
1105 * Converts a win16 handle of type into the respective win32 handle.
1106 * We currently just return this handle, since most handles are the same
1107 * for win16 and win32.
1111 HANDLE32 WINAPI
WOWHandle32(
1112 WORD handle
, /* [in] win16 handle */
1113 WOW_HANDLE_TYPE type
/* [in] handle type */
1115 TRACE(win32
,"(0x%04x,%d)\n",handle
,type
);
1116 return (HANDLE32
)handle
;
1119 /***********************************************************************
1120 * K32Thk1632Prolog (KERNEL32.492)
1122 REGS_ENTRYPOINT(K32Thk1632Prolog
)
1124 LPBYTE code
= (LPBYTE
)EIP_reg(context
) - 5;
1126 /* Arrrgh! SYSTHUNK.DLL just has to re-implement another method
1127 of 16->32 thunks instead of using one of the standard methods!
1128 This means that SYSTHUNK.DLL itself switches to a 32-bit stack,
1129 and does a far call to the 32-bit code segment of OLECLI32/OLESVR32.
1130 Unfortunately, our CallTo/CallFrom mechanism is therefore completely
1131 bypassed, which means it will crash the next time the 32-bit OLE
1132 code thunks down again to 16-bit (this *will* happen!).
1134 The following hack tries to recognize this situation.
1135 This is possible since the called stubs in OLECLI32/OLESVR32 all
1136 look exactly the same:
1137 00 E8xxxxxxxx call K32Thk1632Prolog
1138 05 FF55FC call [ebp-04]
1139 08 E8xxxxxxxx call K32Thk1632Epilog
1142 If we recognize this situation, we try to simulate the actions
1143 of our CallTo/CallFrom mechanism by copying the 16-bit stack
1144 to our 32-bit stack, creating a proper STACK16FRAME and
1145 updating thdb->cur_stack. */
1147 if ( code
[5] == 0xFF && code
[6] == 0x55 && code
[7] == 0xFC
1148 && code
[13] == 0x66 && code
[14] == 0xCB)
1150 WORD stackSel
= NtCurrentTeb()->stack_sel
;
1151 DWORD stackBase
= GetSelectorBase(stackSel
);
1153 THDB
*thdb
= THREAD_Current();
1154 DWORD argSize
= EBP_reg(context
) - ESP_reg(context
);
1155 char *stack16
= (char *)ESP_reg(context
);
1156 char *stack32
= (char *)thdb
->cur_stack
- argSize
;
1157 STACK16FRAME
*frame16
= (STACK16FRAME
*)stack16
- 1;
1159 TRACE(thunk
, "before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1160 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1162 memset(frame16
, '\0', sizeof(STACK16FRAME
));
1163 frame16
->frame32
= (STACK32FRAME
*)thdb
->cur_stack
;
1164 frame16
->ebp
= EBP_reg(context
);
1166 memcpy(stack32
, stack16
, argSize
);
1167 thdb
->cur_stack
= PTR_SEG_OFF_TO_SEGPTR(stackSel
, (DWORD
)frame16
- stackBase
);
1169 ESP_reg(context
) = (DWORD
)stack32
;
1170 EBP_reg(context
) = ESP_reg(context
) + argSize
;
1172 TRACE(thunk
, "after SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1173 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1176 SYSLEVEL_ReleaseWin16Lock();
1179 /***********************************************************************
1180 * K32Thk1632Epilog (KERNEL32.491)
1182 REGS_ENTRYPOINT(K32Thk1632Epilog
)
1184 LPBYTE code
= (LPBYTE
)EIP_reg(context
) - 13;
1186 SYSLEVEL_RestoreWin16Lock();
1188 /* We undo the SYSTHUNK hack if necessary. See K32Thk1632Prolog. */
1190 if ( code
[5] == 0xFF && code
[6] == 0x55 && code
[7] == 0xFC
1191 && code
[13] == 0x66 && code
[14] == 0xCB)
1193 THDB
*thdb
= THREAD_Current();
1194 STACK16FRAME
*frame16
= (STACK16FRAME
*)PTR_SEG_TO_LIN(thdb
->cur_stack
);
1195 char *stack16
= (char *)(frame16
+ 1);
1196 DWORD argSize
= frame16
->ebp
- (DWORD
)stack16
;
1197 char *stack32
= (char *)frame16
->frame32
- argSize
;
1199 DWORD nArgsPopped
= ESP_reg(context
) - (DWORD
)stack32
;
1201 TRACE(thunk
, "before SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1202 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);
1204 thdb
->cur_stack
= (DWORD
)frame16
->frame32
;
1206 ESP_reg(context
) = (DWORD
)stack16
+ nArgsPopped
;
1207 EBP_reg(context
) = frame16
->ebp
;
1209 TRACE(thunk
, "after SYSTHUNK hack: EBP: %08lx ESP: %08lx cur_stack: %08lx\n",
1210 EBP_reg(context
), ESP_reg(context
), thdb
->cur_stack
);