relay32/snoop.c

   1 /*
   2  * 386-specific Win32 dll<->dll snooping functions
   3  *
   4  * Copyright 1998 Marcus Meissner
   5  */
   6
   7 #ifdef __i386__
   8
   9 #include <assert.h>
  10 #include "windows.h"
  11 #include "winbase.h"
  12 #include "winnt.h"
  13 #include "heap.h"
  14 #include "builtin32.h"
  15 #include "snoop.h"
  16 #include "peexe.h"
  17 #include "selectors.h"
  18 #include "stackframe.h"
  19 #include "debugstr.h"
  20 #include "debug.h"
  21
  22 char **debug_snoop_excludelist = NULL, **debug_snoop_includelist = NULL;
  23
  24 #ifdef NEED_UNDERSCORE_PREFIX
  25 # define PREFIX "_"
  26 #else
  27 # define PREFIX
  28 #endif
  29
  30 /* Well, not exactly extern since they are in the same file (in the lines
  31  * below). But the C Compiler doesn't see them there, so we have to help a bit.
  32  */
  33 extern void SNOOP_Return();
  34 extern void SNOOP_Entry();
  35 __asm__(".align 4\n\t"
  36         ".globl "PREFIX"SNOOP_Entry\n\t"
  37         ".type "PREFIX"SNOOP_Entry,@function\n\t"
  38         PREFIX"SNOOP_Entry:\n\t"
  39         "pushl $"PREFIX"__regs_SNOOP_Entry\n\t"
  40         "pushl $"PREFIX"CALL32_Regs\n\t"
  41         "ret\n\t"
  42         ".align 4\n\t"
  43         ".globl "PREFIX"SNOOP_Return\n\t"
  44         ".type "PREFIX"SNOOP_Return,@function\n\t"
  45         PREFIX"SNOOP_Return:\n\t"
  46         "pushl $"PREFIX"__regs_SNOOP_Return\n\t"
  47         "pushl $"PREFIX"CALL32_Regs\n\t"
  48         "ret"
  49 );
  50
  51 #pragma pack(1)
  52
  53 typedef struct tagSNOOP_FUN {
  54         /* code part */
  55         BYTE            lcall;          /* 0xe8 call snoopentry (relative) */
  56         /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
  57          * calculation!
  58          */
  59         DWORD           snoopentry;     /* SNOOP_Entry relative */
  60         /* unreached */
  61         int             nrofargs;
  62         FARPROC32       origfun;
  63         char            *name;
  64 } SNOOP_FUN;
  65
  66 typedef struct tagSNOOP_DLL {
  67         HMODULE32       hmod;
  68         SNOOP_FUN       *funs;
  69         LPCSTR          name;
  70         int             nrofordinals;
  71         struct tagSNOOP_DLL     *next;
  72 } SNOOP_DLL;
  73 typedef struct tagSNOOP_RETURNENTRY {
  74         /* code part */
  75         BYTE            lcall;          /* 0xe8 call snoopret relative*/
  76         /* NOTE: If you move snoopret OR origreturn fix the relative offset
  77          * calculation!
  78          */
  79         DWORD           snoopret;       /* SNOOP_Ret relative */
  80         /* unreached */
  81         FARPROC32       origreturn;
  82         SNOOP_DLL       *dll;
  83         DWORD           ordinal;
  84         DWORD           origESP;
  85         DWORD           *args;          /* saved args across a stdcall */
  86         BYTE            show;
  87 } SNOOP_RETURNENTRY;
  88
  89 typedef struct tagSNOOP_RETURNENTRIES {
  90         SNOOP_RETURNENTRY entry[4092/sizeof(SNOOP_RETURNENTRY)];
  91         struct tagSNOOP_RETURNENTRIES   *next;
  92 } SNOOP_RETURNENTRIES;
  93
  94 #pragma pack(4)
  95
  96 static  SNOOP_DLL               *firstdll = NULL;
  97 static  SNOOP_RETURNENTRIES     *firstrets = NULL;
  98
  99 /***********************************************************************
 100  *          SNOOP_ShowDebugmsgSnoop
 101  *
 102  * Simple function to decide if a particular debugging message is
 103  * wanted.
 104  */
 105 int SNOOP_ShowDebugmsgSnoop(const char *dll, int ord, const char *fname) {
 106
 107   if(debug_snoop_excludelist || debug_snoop_includelist) {
 108     char **listitem;
 109     char buf[80];
 110     int len, len2, itemlen, show;
 111
 112     if(debug_snoop_excludelist) {
 113       show = 1;
 114       listitem = debug_snoop_excludelist;
 115     } else {
 116       show = 0;
 117       listitem = debug_snoop_includelist;
 118     }
 119     len = strlen(dll);
 120     assert(len < 64);
 121     sprintf(buf, "%s.%d", dll, ord);
 122     len2 = strlen(buf);
 123     for(; *listitem; listitem++) {
 124       itemlen = strlen(*listitem);
 125       if((itemlen == len && !strncmp(*listitem, buf, len)) ||
 126          (itemlen == len2 && !strncmp(*listitem, buf, len2)) ||
 127          !strcmp(*listitem, fname)) {
 128         show = !show;
 129        break;
 130       }
 131     }
 132     return show;
 133   }
 134   return 1;
 135 }
 136
 137 void
 138 SNOOP_RegisterDLL(HMODULE32 hmod,LPCSTR name,DWORD nrofordinals) {
 139         SNOOP_DLL       **dll = &(firstdll);
 140         char            *s;
 141
 142         if (!TRACE_ON(snoop)) return;
 143         while (*dll) {
 144                 if ((*dll)->hmod == hmod)
 145                         return; /* already registered */
 146                 dll = &((*dll)->next);
 147         }
 148         *dll = (SNOOP_DLL*)HeapAlloc(SystemHeap,HEAP_ZERO_MEMORY,sizeof(SNOOP_DLL));
 149         (*dll)->next    = NULL;
 150         (*dll)->hmod    = hmod;
 151         (*dll)->nrofordinals = nrofordinals;
 152         (*dll)->name    = HEAP_strdupA(SystemHeap,0,name);
 153         if ((s=strrchr((*dll)->name,'.')))
 154                 *s='\0';
 155         (*dll)->funs = VirtualAlloc(NULL,nrofordinals*sizeof(SNOOP_FUN),MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 156         memset((*dll)->funs,0,nrofordinals*sizeof(SNOOP_FUN));
 157         if (!(*dll)->funs) {
 158                 HeapFree(SystemHeap,0,*dll);
 159                 FIXME(snoop,"out of memory\n");
 160                 return;
 161         }
 162 }
 163
 164 FARPROC32
 165 SNOOP_GetProcAddress32(HMODULE32 hmod,LPCSTR name,DWORD ordinal,FARPROC32 origfun) {
 166         SNOOP_DLL                       *dll = firstdll;
 167         SNOOP_FUN                       *fun;
 168         int                             j;
 169         IMAGE_SECTION_HEADER            *pe_seg = PE_SECTIONS(hmod);
 170
 171         if (!TRACE_ON(snoop)) return origfun;
 172         if (!*(LPBYTE)origfun) /* 0x00 is an imposs. opcode, poss. dataref. */
 173                 return origfun;
 174         for (j=0;j<PE_HEADER(hmod)->FileHeader.NumberOfSections;j++)
 175                 if (((DWORD)origfun-hmod>=pe_seg[j].VirtualAddress)&&
 176                     ((DWORD)origfun-hmod <pe_seg[j].VirtualAddress+
 177                                    pe_seg[j].SizeOfRawData)
 178                 )
 179                         break;
 180         /* If we looked through all sections (and didn't find one)
 181          * or if the sectionname contains "data", we return the
 182          * original function since it is most likely a datareference.
 183          */
 184         if (    (j==PE_HEADER(hmod)->FileHeader.NumberOfSections)       ||
 185                 (strstr(pe_seg[j].Name,"data"))                         ||
 186                 !(pe_seg[j].Characteristics & IMAGE_SCN_CNT_CODE)
 187         )
 188                 return origfun;
 189
 190         while (dll) {
 191                 if (hmod == dll->hmod)
 192                         break;
 193                 dll=dll->next;
 194         }
 195         if (!dll)       /* probably internal */
 196                 return origfun;
 197         assert(ordinal<dll->nrofordinals);
 198         fun = dll->funs+ordinal;
 199         if (!fun->name) fun->name = HEAP_strdupA(SystemHeap,0,name);
 200         fun->lcall      = 0xe8;
 201         /* NOTE: origreturn struct member MUST come directly after snoopentry */
 202         fun->snoopentry = (char*)SNOOP_Entry-((char*)(&fun->nrofargs));
 203         fun->origfun    = origfun;
 204         fun->nrofargs   = -1;
 205         return (FARPROC32)&(fun->lcall);
 206 }
 207
 208 static char*
 209 SNOOP_PrintArg(DWORD x) {
 210         static char     buf[200];
 211         int             i,nostring;
 212         MEMORY_BASIC_INFORMATION        mbi;
 213
 214         if (    !HIWORD(x)                                      ||
 215                 !VirtualQuery((LPVOID)x,&mbi,sizeof(mbi))       ||
 216                 !mbi.Type
 217         ) {
 218                 sprintf(buf,"%08lx",x);
 219                 return buf;
 220         }
 221         i=0;nostring=0;
 222         if (!IsBadStringPtr32A((LPSTR)x,80)) {
 223                 while (i<80) {
 224                         LPBYTE  s=(LPBYTE)x;
 225
 226                         if (s[i]==0) break;
 227                         if (s[i]<0x20) {nostring=1;break;}
 228                         if (s[i]>=0x80) {nostring=1;break;}
 229                         i++;
 230                 }
 231                 if (!nostring) {
 232                         if (i>5) {
 233                                 sprintf(buf,"%08lx \"",x);
 234                                 strncat(buf,(LPSTR)x,198-strlen(buf)-2);
 235                                 strcat(buf,"\"");
 236                                 return buf;
 237                         }
 238                 }
 239         }
 240         i=0;nostring=0;
 241         if (!IsBadStringPtr32W((LPWSTR)x,80)) {
 242                 while (i<80) {
 243                         LPWSTR  s=(LPWSTR)x;
 244
 245                         if (s[i]==0) break;
 246                         if (s[i]<0x20) {nostring=1;break;}
 247                         if (s[i]>0x100) {nostring=1;break;}
 248                         i++;
 249                 }
 250                 if (!nostring) {
 251                         if (i>5) {
 252                                 sprintf(buf,"%08lx L",x);
 253                                 strcat(buf,debugstr_wn((LPWSTR)x,198-strlen(buf)-2));
 254                                 return buf;
 255                         }
 256                 }
 257         }
 258         sprintf(buf,"%08lx",x);
 259         return buf;
 260 }
 261
 262 #define CALLER1REF (*(DWORD*)(ESP_reg(context)+4))
 263 REGS_ENTRYPOINT(SNOOP_Entry) {
 264         DWORD           ordinal=0,entry = EIP_reg(context)-5;
 265         SNOOP_DLL       *dll = firstdll;
 266         SNOOP_FUN       *fun = NULL;
 267         SNOOP_RETURNENTRIES     **rets = &firstrets;
 268         SNOOP_RETURNENTRY       *ret;
 269         int             i,max,show;
 270
 271         while (dll) {
 272                 if (    ((char*)entry>=(char*)dll->funs)        &&
 273                         ((char*)entry<=(char*)(dll->funs+dll->nrofordinals))
 274                 ) {
 275                         fun = (SNOOP_FUN*)entry;
 276                         ordinal = fun-dll->funs;
 277                         break;
 278                 }
 279                 dll=dll->next;
 280         }
 281         if (!dll) {
 282                 FIXME(snoop,"entrypoint 0x%08lx not found\n",entry);
 283                 return; /* oops */
 284         }
 285         /* guess cdecl ... */
 286         if (fun->nrofargs<0) {
 287                 /* Typical cdecl return frame is:
 288                  *      add esp, xxxxxxxx
 289                  * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
 290                  */
 291                 LPBYTE  reteip = (LPBYTE)CALLER1REF;
 292
 293                 if (reteip) {
 294                         if ((reteip[0]==0x83)&&(reteip[1]==0xc4))
 295                                 fun->nrofargs=reteip[2]/4;
 296                 }
 297         }
 298
 299         while (*rets) {
 300                 for (i=0;i<sizeof((*rets)->entry)/sizeof((*rets)->entry[0]);i++)
 301                         if (!(*rets)->entry[i].origreturn)
 302                                 break;
 303                 if (i!=sizeof((*rets)->entry)/sizeof((*rets)->entry[0]))
 304                         break;
 305                 rets = &((*rets)->next);
 306         }
 307         if (!*rets) {
 308                 *rets = VirtualAlloc(NULL,4096,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
 309                 memset(*rets,0,4096);
 310                 i = 0;  /* entry 0 is free */
 311         }
 312         ret = &((*rets)->entry[i]);
 313         ret->lcall      = 0xe8;
 314         /* NOTE: origreturn struct member MUST come directly after snoopret */
 315         ret->snoopret   = ((char*)SNOOP_Return)-(char*)(&ret->origreturn);
 316         ret->origreturn = (FARPROC32)CALLER1REF;
 317         CALLER1REF      = (DWORD)&ret->lcall;
 318         ret->dll        = dll;
 319         ret->args       = NULL;
 320         ret->ordinal    = ordinal;
 321         ret->origESP    = ESP_reg(context);
 322
 323         EIP_reg(context)= (DWORD)fun->origfun;
 324
 325         ret->show = SNOOP_ShowDebugmsgSnoop(dll->name, ordinal, fun->name);
 326         if(!ret->show) return;
 327         DPRINTF("Call %s.%ld: %s(",dll->name,ordinal,fun->name);
 328         if (fun->nrofargs>0) {
 329                 max = fun->nrofargs; if (max>16) max=16;
 330                 for (i=0;i<max;i++)
 331                         DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD*)(ESP_reg(context)+8+sizeof(DWORD)*i)),(i<fun->nrofargs-1)?",":"");
 332                 if (max!=fun->nrofargs)
 333                         DPRINTF(" ...");
 334         } else if (fun->nrofargs<0) {
 335                 DPRINTF("<unknown, check return>");
 336                 ret->args = HeapAlloc(SystemHeap,0,16*sizeof(DWORD));
 337                 memcpy(ret->args,(LPBYTE)(ESP_reg(context)+8),sizeof(DWORD)*16);
 338         }
 339         DPRINTF(") ret=%08lx fs=%04lx\n",ret->origreturn,FS_reg(context));
 340 }
 341
 342 REGS_ENTRYPOINT(SNOOP_Return) {
 343         SNOOP_RETURNENTRY       *ret = (SNOOP_RETURNENTRY*)(EIP_reg(context)-5);
 344
 345         /* We haven't found out the nrofargs yet. If we called a cdecl
 346          * function it is too late anyway and we can just set '0' (which
 347          * will be the difference between orig and current ESP
 348          * If stdcall -> everything ok.
 349          */
 350         if (ret->dll->funs[ret->ordinal].nrofargs<0)
 351                 ret->dll->funs[ret->ordinal].nrofargs=(ESP_reg(context)-ret->origESP-4)/4;
 352         EIP_reg(context) = (DWORD)ret->origreturn;
 353         if(!ret->show) {
 354                 ;
 355         } else if (ret->args) {
 356                 int     i,max;
 357
 358                 DPRINTF("Ret  %s.%ld: %s(",ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name);
 359                 max = ret->dll->funs[ret->ordinal].nrofargs;
 360                 if (max>16) max=16;
 361
 362                 for (i=0;i<max;i++)
 363                         DPRINTF("%s%s",SNOOP_PrintArg(ret->args[i]),(i<max-1)?",":"");
 364                 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
 365                         EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
 366                 );
 367                 HeapFree(SystemHeap,0,ret->args);
 368                 ret->args = NULL;
 369         } else
 370                 DPRINTF("Ret  %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
 371                         ret->dll->name,ret->ordinal,ret->dll->funs[ret->ordinal].name,
 372                         EAX_reg(context),(DWORD)ret->origreturn,FS_reg(context)
 373                 );
 374         ret->origreturn = NULL; /* mark as empty */
 375 }
 376 #else   /* !__i386__ */
 377 void SNOOP_RegisterDLL(HMODULE32 hmod,LPCSTR name,DWORD nrofordinals) {
 378         FIXME(snoop,"snooping works only on i386 for now.\n");
 379         return;
 380 }
 381
 382 FARPROC32 SNOOP_GetProcAddress32(HMODULE32 hmod,LPCSTR name,DWORD ordinal,FARPROC32 origfun) {
 383         return origfun;
 384 }
 385 #endif  /* !__i386__ */