2 * 386-specific Win32 dll<->dll snooping functions
4 * Copyright 1998 Marcus Meissner
14 #include "builtin32.h"
18 #include "selectors.h"
19 #include "stackframe.h"
23 char **debug_snoop_excludelist
= NULL
, **debug_snoop_includelist
= NULL
;
27 #ifdef NEED_UNDERSCORE_PREFIX
33 /* Well, not exactly extern since they are in the same file (in the lines
34 * below). But the C Compiler doesn't see them there, so we have to help a bit.
36 extern void SNOOP_Return();
37 extern void SNOOP_Entry();
38 __asm__(".align 4\n\t"
39 ".globl "PREFIX
"SNOOP_Entry\n\t"
40 ".type "PREFIX
"SNOOP_Entry,@function\n\t"
41 PREFIX
"SNOOP_Entry:\n\t"
42 "pushl $"PREFIX
"__regs_SNOOP_Entry\n\t"
43 "pushl $"PREFIX
"CALL32_Regs\n\t"
46 ".globl "PREFIX
"SNOOP_Return\n\t"
47 ".type "PREFIX
"SNOOP_Return,@function\n\t"
48 PREFIX
"SNOOP_Return:\n\t"
49 "pushl $"PREFIX
"__regs_SNOOP_Return\n\t"
50 "pushl $"PREFIX
"CALL32_Regs\n\t"
56 typedef struct tagSNOOP_FUN
{
58 BYTE lcall
; /* 0xe8 call snoopentry (relative) */
59 /* NOTE: If you move snoopentry OR nrofargs fix the relative offset
62 DWORD snoopentry
; /* SNOOP_Entry relative */
69 typedef struct tagSNOOP_DLL
{
74 struct tagSNOOP_DLL
*next
;
76 typedef struct tagSNOOP_RETURNENTRY
{
78 BYTE lcall
; /* 0xe8 call snoopret relative*/
79 /* NOTE: If you move snoopret OR origreturn fix the relative offset
82 DWORD snoopret
; /* SNOOP_Ret relative */
88 DWORD
*args
; /* saved args across a stdcall */
91 typedef struct tagSNOOP_RETURNENTRIES
{
92 SNOOP_RETURNENTRY entry
[4092/sizeof(SNOOP_RETURNENTRY
)];
93 struct tagSNOOP_RETURNENTRIES
*next
;
94 } SNOOP_RETURNENTRIES
;
98 static SNOOP_DLL
*firstdll
= NULL
;
99 static SNOOP_RETURNENTRIES
*firstrets
= NULL
;
101 /***********************************************************************
102 * SNOOP_ShowDebugmsgSnoop
104 * Simple function to decide if a particular debugging message is
107 int SNOOP_ShowDebugmsgSnoop(const char *dll
, int ord
, const char *fname
) {
109 if(debug_snoop_excludelist
|| debug_snoop_includelist
) {
112 int len
, len2
, itemlen
, show
;
114 if(debug_snoop_excludelist
) {
116 listitem
= debug_snoop_excludelist
;
119 listitem
= debug_snoop_includelist
;
123 sprintf(buf
, "%s.%d", dll
, ord
);
125 for(; *listitem
; listitem
++) {
126 itemlen
= strlen(*listitem
);
127 if((itemlen
== len
&& !strncmp(*listitem
, buf
, len
)) ||
128 (itemlen
== len2
&& !strncmp(*listitem
, buf
, len2
)) ||
129 !strcmp(*listitem
, fname
)) {
140 SNOOP_RegisterDLL(HMODULE32 hmod
,LPCSTR name
,DWORD nrofordinals
) {
141 SNOOP_DLL
**dll
= &(firstdll
);
144 if (!TRACE_ON(snoop
)) return;
146 if ((*dll
)->hmod
== hmod
)
147 return; /* already registered */
148 dll
= &((*dll
)->next
);
150 *dll
= (SNOOP_DLL
*)HeapAlloc(SystemHeap
,HEAP_ZERO_MEMORY
,sizeof(SNOOP_DLL
));
153 (*dll
)->nrofordinals
= nrofordinals
;
154 (*dll
)->name
= HEAP_strdupA(SystemHeap
,0,name
);
155 if ((s
=strrchr((*dll
)->name
,'.')))
157 (*dll
)->funs
= VirtualAlloc(NULL
,nrofordinals
*sizeof(SNOOP_FUN
),MEM_COMMIT
|MEM_RESERVE
,PAGE_EXECUTE_READWRITE
);
158 memset((*dll
)->funs
,0,nrofordinals
*sizeof(SNOOP_FUN
));
160 HeapFree(SystemHeap
,0,*dll
);
161 FIXME(snoop
,"out of memory\n");
167 SNOOP_GetProcAddress32(HMODULE32 hmod
,LPCSTR name
,DWORD ordinal
,FARPROC32 origfun
) {
168 SNOOP_DLL
*dll
= firstdll
;
171 IMAGE_SECTION_HEADER
*pe_seg
= PE_SECTIONS(hmod
);
173 if (!TRACE_ON(snoop
)) return origfun
;
174 if (!*(LPBYTE
)origfun
) /* 0x00 is an imposs. opcode, poss. dataref. */
176 for (j
=0;j
<PE_HEADER(hmod
)->FileHeader
.NumberOfSections
;j
++)
177 /* 0x42 is special ELF loader tag */
178 if ((pe_seg
[j
].VirtualAddress
==0x42) ||
179 (((DWORD
)origfun
-hmod
>=pe_seg
[j
].VirtualAddress
)&&
180 ((DWORD
)origfun
-hmod
<pe_seg
[j
].VirtualAddress
+
181 pe_seg
[j
].SizeOfRawData
185 /* If we looked through all sections (and didn't find one)
186 * or if the sectionname contains "data", we return the
187 * original function since it is most likely a datareference.
189 if ( (j
==PE_HEADER(hmod
)->FileHeader
.NumberOfSections
) ||
190 (strstr(pe_seg
[j
].Name
,"data")) ||
191 !(pe_seg
[j
].Characteristics
& IMAGE_SCN_CNT_CODE
)
196 if (hmod
== dll
->hmod
)
200 if (!dll
) /* probably internal */
202 if (!SNOOP_ShowDebugmsgSnoop(dll
->name
,ordinal
,name
))
204 assert(ordinal
<dll
->nrofordinals
);
205 fun
= dll
->funs
+ordinal
;
206 if (!fun
->name
) fun
->name
= HEAP_strdupA(SystemHeap
,0,name
);
208 /* NOTE: origreturn struct member MUST come directly after snoopentry */
209 fun
->snoopentry
= (char*)SNOOP_Entry
-((char*)(&fun
->nrofargs
));
210 fun
->origfun
= origfun
;
212 return (FARPROC32
)&(fun
->lcall
);
216 SNOOP_PrintArg(DWORD x
) {
217 static char buf
[200];
219 MEMORY_BASIC_INFORMATION mbi
;
222 !VirtualQuery((LPVOID
)x
,&mbi
,sizeof(mbi
)) ||
225 sprintf(buf
,"%08lx",x
);
229 if (!IsBadStringPtr32A((LPSTR
)x
,80)) {
234 if (s
[i
]<0x20) {nostring
=1;break;}
235 if (s
[i
]>=0x80) {nostring
=1;break;}
240 sprintf(buf
,"%08lx \"",x
);
241 strncat(buf
,(LPSTR
)x
,198-strlen(buf
)-2);
248 if (!IsBadStringPtr32W((LPWSTR
)x
,80)) {
253 if (s
[i
]<0x20) {nostring
=1;break;}
254 if (s
[i
]>0x100) {nostring
=1;break;}
259 sprintf(buf
,"%08lx L",x
);
260 strcat(buf
,debugstr_wn((LPWSTR
)x
,198-strlen(buf
)-2));
265 sprintf(buf
,"%08lx",x
);
269 #define CALLER1REF (*(DWORD*)(ESP_reg(context)+4))
270 REGS_ENTRYPOINT(SNOOP_Entry
) {
271 DWORD ordinal
=0,entry
= EIP_reg(context
)-5;
272 SNOOP_DLL
*dll
= firstdll
;
273 SNOOP_FUN
*fun
= NULL
;
274 SNOOP_RETURNENTRIES
**rets
= &firstrets
;
275 SNOOP_RETURNENTRY
*ret
;
279 if ( ((char*)entry
>=(char*)dll
->funs
) &&
280 ((char*)entry
<=(char*)(dll
->funs
+dll
->nrofordinals
))
282 fun
= (SNOOP_FUN
*)entry
;
283 ordinal
= fun
-dll
->funs
;
289 FIXME(snoop
,"entrypoint 0x%08lx not found\n",entry
);
292 /* guess cdecl ... */
293 if (fun
->nrofargs
<0) {
294 /* Typical cdecl return frame is:
296 * which has (for xxxxxxxx up to 255 the opcode "83 C4 xx".
297 * (after that 81 C2 xx xx xx xx)
299 LPBYTE reteip
= (LPBYTE
)CALLER1REF
;
302 if ((reteip
[0]==0x83)&&(reteip
[1]==0xc4))
303 fun
->nrofargs
=reteip
[2]/4;
309 for (i
=0;i
<sizeof((*rets
)->entry
)/sizeof((*rets
)->entry
[0]);i
++)
310 if (!(*rets
)->entry
[i
].origreturn
)
312 if (i
!=sizeof((*rets
)->entry
)/sizeof((*rets
)->entry
[0]))
314 rets
= &((*rets
)->next
);
317 *rets
= VirtualAlloc(NULL
,4096,MEM_COMMIT
|MEM_RESERVE
,PAGE_EXECUTE_READWRITE
);
318 memset(*rets
,0,4096);
319 i
= 0; /* entry 0 is free */
321 ret
= &((*rets
)->entry
[i
]);
323 /* NOTE: origreturn struct member MUST come directly after snoopret */
324 ret
->snoopret
= ((char*)SNOOP_Return
)-(char*)(&ret
->origreturn
);
325 ret
->origreturn
= (FARPROC32
)CALLER1REF
;
326 CALLER1REF
= (DWORD
)&ret
->lcall
;
329 ret
->ordinal
= ordinal
;
330 ret
->origESP
= ESP_reg(context
);
332 EIP_reg(context
)= (DWORD
)fun
->origfun
;
334 DPRINTF("Call %s.%ld: %s(",dll
->name
,ordinal
,fun
->name
);
335 if (fun
->nrofargs
>0) {
336 max
= fun
->nrofargs
; if (max
>16) max
=16;
338 DPRINTF("%s%s",SNOOP_PrintArg(*(DWORD
*)(ESP_reg(context
)+8+sizeof(DWORD
)*i
)),(i
<fun
->nrofargs
-1)?",":"");
339 if (max
!=fun
->nrofargs
)
341 } else if (fun
->nrofargs
<0) {
342 DPRINTF("<unknown, check return>");
343 ret
->args
= HeapAlloc(SystemHeap
,0,16*sizeof(DWORD
));
344 memcpy(ret
->args
,(LPBYTE
)(ESP_reg(context
)+8),sizeof(DWORD
)*16);
346 DPRINTF(") ret=%08lx fs=%04lx\n",(DWORD
)ret
->origreturn
,FS_reg(context
));
349 REGS_ENTRYPOINT(SNOOP_Return
) {
350 SNOOP_RETURNENTRY
*ret
= (SNOOP_RETURNENTRY
*)(EIP_reg(context
)-5);
352 /* We haven't found out the nrofargs yet. If we called a cdecl
353 * function it is too late anyway and we can just set '0' (which
354 * will be the difference between orig and current ESP
355 * If stdcall -> everything ok.
357 if (ret
->dll
->funs
[ret
->ordinal
].nrofargs
<0)
358 ret
->dll
->funs
[ret
->ordinal
].nrofargs
=(ESP_reg(context
)-ret
->origESP
-4)/4;
359 EIP_reg(context
) = (DWORD
)ret
->origreturn
;
363 DPRINTF("Ret %s.%ld: %s(",ret
->dll
->name
,ret
->ordinal
,ret
->dll
->funs
[ret
->ordinal
].name
);
364 max
= ret
->dll
->funs
[ret
->ordinal
].nrofargs
;
368 DPRINTF("%s%s",SNOOP_PrintArg(ret
->args
[i
]),(i
<max
-1)?",":"");
369 DPRINTF(") retval = %08lx ret=%08lx fs=%04lx\n",
370 EAX_reg(context
),(DWORD
)ret
->origreturn
,FS_reg(context
)
372 HeapFree(SystemHeap
,0,ret
->args
);
375 DPRINTF("Ret %s.%ld: %s() retval = %08lx ret=%08lx fs=%04lx\n",
376 ret
->dll
->name
,ret
->ordinal
,ret
->dll
->funs
[ret
->ordinal
].name
,
377 EAX_reg(context
),(DWORD
)ret
->origreturn
,FS_reg(context
)
379 ret
->origreturn
= NULL
; /* mark as empty */
381 #else /* !__i386__ */
382 void SNOOP_RegisterDLL(HMODULE32 hmod
,LPCSTR name
,DWORD nrofordinals
) {
383 FIXME(snoop
,"snooping works only on i386 for now.\n");
387 FARPROC32
SNOOP_GetProcAddress32(HMODULE32 hmod
,LPCSTR name
,DWORD ordinal
,FARPROC32 origfun
) {
390 #endif /* !__i386__ */