c# - VirtualProtect-AV : Attempted to read or write protected memory

Question

我有 Delphi 6 DLL，它在内部使用第三方库来进行自动资源字符串翻译。

在库源代码中，2 个 RTL 函数(ShortCutToText 和 LoadResString)被替换为对应的多语言函数(trShortCutToText 和 trLoadResString )。代码如下:

VirtualProtect(@ShortCutToText, SIZE_C, PAGE_READWRITE, @protectType);
Move((@ShortCutToText)^, shortCutBuffer, SIZE_C);
Move((@trShortCutToText)^, (@ShortCutToText)^, SIZE_C);
VirtualProtect(@ShortCutToText, SIZE_C, protectType, @protectType);
FlushInstructionCache(GetCurrentProcess, @ShortCutToText, SIZE_C);

和

VirtualProtect(@LoadResString, SIZE_C, PAGE_READWRITE, @protectType);
Move((@LoadResString)^, loadResStringBuffer, SIZE_C);
Move((@trLoadResString)^, (@LoadResString)^, SIZE_C);
VirtualProtect(@LoadResString, SIZE_C, protectType, @protectType); //<--Exception thrown at this line
FlushInstructionCache(GetCurrentProcess, @LoadResString, SIZE_C);

现在，当我从另一个 Delphi 6 应用程序中调用此 DLL 的函数时，一切正常。

但是，当我从 C# 应用程序(在 64 位机器上编译为 32 位应用程序)调用 DLL 时，我的 C# 应用程序崩溃了。

在调试 DLL 时，我发现上述第 3 方代码的第一个 block 执行没有任何问题，但第二个 block 在倒数第二行失败。

错误信息如下所示:

System.AccessViolationException was unhandled
  Message="Attempted to read or write protected memory. This is often an indication that other memory is corrupt."
  Source="TestWinform"
  StackTrace:
       at TestWinform.TestSwitching()
       at TestWinform.Form1.button1_Click(Object sender, EventArgs e)
       at System.Windows.Forms.Control.OnClick(EventArgs e)
       at System.Windows.Forms.Button.OnClick(EventArgs e)
       at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
       at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
       at System.Windows.Forms.Control.WndProc(Message& m)
       at System.Windows.Forms.ButtonBase.WndProc(Message& m)
       at System.Windows.Forms.Button.WndProc(Message& m)
       at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
       at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
       at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
       at System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG& msg)
       at System.Windows.Forms.Application.ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(Int32 dwComponentID, Int32 reason, Int32 pvLoopData)
       at System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner(Int32 reason, ApplicationContext context)
       at System.Windows.Forms.Application.ThreadContext.RunMessageLoop(Int32 reason, ApplicationContext context)
       at System.Windows.Forms.Application.Run(Form mainForm)
       at TestWinform.Program.Main()
       at System.AppDomain._nExecuteAssembly(Assembly assembly, String[] args)
       at System.AppDomain.ExecuteAssembly(String assemblyFile, Evidence assemblySecurity, String[] args)
       at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
       at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
       at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
       at System.Threading.ThreadHelper.ThreadStart()
  InnerException:

编辑:

我已经在 Delphi 6 中创建了一个示例 DLL 项目来重现该问题。

DelphiDllTest.dpr 文件的源代码如下:

library DelphiDllTest;
uses
  SysUtils,
  Classes,
  MyUnit in 'MyUnit.pas';

{$R *.res}

procedure TestSwitching; export;
var
  myDict : TMyDictionary;
begin
  myDict := TMyDictionary.Create(nil);
  try        
    myDict.Open;
  finally
    myDict.Close;
    FreeAndNil(myDict);
  end;
end;

exports
TestSwitching;
begin
end.

MyUnit.pas 的来源如下:

    unit MyUnit;

    interface

    uses
      Classes, Windows;

    type

     TMyDictionary = class(TComponent)
      public
        constructor Create(owner: TComponent); override;
        destructor Destroy; override;
        procedure Open; virtual;
        procedure Close; virtual;
     end;

    function TranslateLoadResString(resStringRec: PResStringRec): String;
    function trLoadResString(resStringRec: PResStringRec): String;

    const
      SIZE_C = 32;

    var
      loadResStringBuffer: array[0..SIZE_C] of Byte;

    implementation

    constructor TMyDictionary.Create(owner: TComponent);
    begin
      inherited Create(owner);
    end;

    destructor TMyDictionary.Destroy;
    begin
      inherited Destroy;
    end;

    procedure TMyDictionary.Open;
    var
      protect: Integer;
    begin
      VirtualProtect(@LoadResString, SIZE_C, PAGE_READWRITE, @protect);
      Move((@LoadResString)^, loadResStringBuffer, SIZE_C);
      Move((@trLoadResString)^, (@LoadResString)^, SIZE_C);
      VirtualProtect(@LoadResString, SIZE_C, protect, @protect);
      FlushInstructionCache(GetCurrentProcess, @LoadResString, SIZE_C);
    end;

    procedure TMyDictionary.Close;
    var
      protect: Integer;
    begin
        VirtualProtect(@LoadResString, SIZE_C, PAGE_READWRITE, @protect);
        Move(loadResStringBuffer, (@LoadResString)^, SIZE_C);
        VirtualProtect(@LoadResString, SIZE_C, protect, @protect);
    end;


    function TranslateLoadResString(resStringRec: PResStringRec): String;
    var
      buffer: array[0..1023] of Char;
    begin
      try
        if resStringRec <> nil then
        begin
          if resStringRec.Identifier < 64*1024 then
          begin
            SetString(
              Result,
              buffer,
              LoadString(
                FindResourceHInstance(resStringRec.Module^),
                resStringRec.Identifier,
                buffer,
                SizeOf(buffer)));
          end
          else
            Result := PChar(resStringRec.Identifier);
        end
        else
          Result := '';

      except
        Result := '';
      end;
    end;

    function trLoadResString(resStringRec: PResStringRec): String;
    asm
      PUSH  EBP
      MOV   EBP, ESP
      ADD   ESP, $-8
      MOV   [EBP-$8], EDX
      MOV   [EBP-$4], EAX
      MOV   EDX, [EBP-$8]
      MOV   EAX, [EBP-$4]
      MOV   ECX, OFFSET Addr(TranslateLoadResString)-$1
      CALL  ECX
      MOV   ESP,EBP
      POP   EBP
    end;

    end.

现在终于在下面给出了使用该 DLL 的 C# 代码:

using System;
using System.Windows.Forms;
using System.Runtime.InteropServices;

namespace TestWinform
{
    public partial class Form1 : Form
    {
        [DllImport("DelphiDllTest.dll")]
        public static extern void TestSwitching();

        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            TestSwitching();            
        }
    }
}

希望这足以生成 AV。

Answer 1

我认为 DEP 应对异常负责。问题出在您使用的保护选项上。您需要使用 PAGE_EXECUTE_READWRITE 而不是 PAGE_READWRITE。在 Open 中，您需要保护 @trLoadResString 以及 @LoadResString，您缺少对 VirtualProtect 的调用.

大概是这样的:

VirtualProtect(@LoadResString, SIZE_C, PAGE_EXECUTE_READWRITE, @protect);
Move((@LoadResString)^, loadResStringBuffer, SIZE_C);
VirtualProtect(@LoadResString, SIZE_C, protect, @protect);
FlushInstructionCache(GetCurrentProcess, @LoadResString, SIZE_C);

VirtualProtect(@trLoadResString, SIZE_C, PAGE_EXECUTE_READWRITE, @protect);
Move((@trLoadResString)^, (@LoadResString)^, SIZE_C);
VirtualProtect(@trLoadResString, SIZE_C, protect, @protect);
FlushInstructionCache(GetCurrentProcess, @trLoadResString, SIZE_C);

并且您需要在 Close 方法中执行类似的操作。也许您需要恢复 trLoadResString。

您导出的函数正在使用 register 调用约定，但它应该导出为 stdcall。 export 指令被忽略。只有 exports 才是重要的。