c# - VirtualProtect-AV:尝试读取或写入 protected 内存

我有Delphi 6 DLL，该DLL在内部使用第三方库来进行自动资源字符串转换。

在库源代码中，将2种RTL函数（ShortCutToText和LoadResString）替换为多语言对应项（trShortCutToText和trLoadResString）。代码如下所示：

VirtualProtect(@ShortCutToText, SIZE_C, PAGE_READWRITE, @protectType);
Move((@ShortCutToText)^, shortCutBuffer, SIZE_C);
Move((@trShortCutToText)^, (@ShortCutToText)^, SIZE_C);
VirtualProtect(@ShortCutToText, SIZE_C, protectType, @protectType);
FlushInstructionCache(GetCurrentProcess, @ShortCutToText, SIZE_C);

和

VirtualProtect(@LoadResString, SIZE_C, PAGE_READWRITE, @protectType);
Move((@LoadResString)^, loadResStringBuffer, SIZE_C);
Move((@trLoadResString)^, (@LoadResString)^, SIZE_C);
VirtualProtect(@LoadResString, SIZE_C, protectType, @protectType); //<--Exception thrown at this line
FlushInstructionCache(GetCurrentProcess, @LoadResString, SIZE_C);

现在，当我从另一个Delphi 6应用程序中调用此DLL的函数时，一切正常。

但是，当我从C＃应用程序（在64位计算机上编译为32位应用程序）调用DLL时，我的c＃应用程序完全崩溃了。

在调试DLL时，我发现上面的第三方代码的第一个块执行没有任何问题，但是第二个块在倒数第二行失败。

错误消息如下所示：

System.AccessViolationException was unhandled
  Message="Attempted to read or write protected memory. This is often an indication that other memory is corrupt."
  Source="TestWinform"
  StackTrace:
       at TestWinform.TestSwitching()
       at TestWinform.Form1.button1_Click(Object sender, EventArgs e)
       at System.Windows.Forms.Control.OnClick(EventArgs e)
       at System.Windows.Forms.Button.OnClick(EventArgs e)
       at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
       at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
       at System.Windows.Forms.Control.WndProc(Message& m)
       at System.Windows.Forms.ButtonBase.WndProc(Message& m)
       at System.Windows.Forms.Button.WndProc(Message& m)
       at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
       at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
       at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
       at System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG& msg)
       at System.Windows.Forms.Application.ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(Int32 dwComponentID, Int32 reason, Int32 pvLoopData)
       at System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner(Int32 reason, ApplicationContext context)
       at System.Windows.Forms.Application.ThreadContext.RunMessageLoop(Int32 reason, ApplicationContext context)
       at System.Windows.Forms.Application.Run(Form mainForm)
       at TestWinform.Program.Main()
       at System.AppDomain._nExecuteAssembly(Assembly assembly, String[] args)
       at System.AppDomain.ExecuteAssembly(String assemblyFile, Evidence assemblySecurity, String[] args)
       at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
       at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
       at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
       at System.Threading.ThreadHelper.ThreadStart()
  InnerException:

编辑：

我已经在Delphi 6中创建了一个示例DLL项目来复制该问题。

下面给出了来自DelphiDllTest.dpr文件的源代码：

library DelphiDllTest;
uses
  SysUtils,
  Classes,
  MyUnit in 'MyUnit.pas';

{$R *.res}

procedure TestSwitching; export;
var
  myDict : TMyDictionary;
begin
  myDict := TMyDictionary.Create(nil);
  try
    myDict.Open;
  finally
    myDict.Close;
    FreeAndNil(myDict);
  end;
end;

exports
TestSwitching;
begin
end.

MyUnit.pas的来源如下：

    unit MyUnit;

    interface

    uses
      Classes, Windows;

    type

     TMyDictionary = class(TComponent)
      public
        constructor Create(owner: TComponent); override;
        destructor Destroy; override;
        procedure Open; virtual;
        procedure Close; virtual;
     end;

    function TranslateLoadResString(resStringRec: PResStringRec): String;
    function trLoadResString(resStringRec: PResStringRec): String;

    const
      SIZE_C = 32;

    var
      loadResStringBuffer: array[0..SIZE_C] of Byte;

    implementation

    constructor TMyDictionary.Create(owner: TComponent);
    begin
      inherited Create(owner);
    end;

    destructor TMyDictionary.Destroy;
    begin
      inherited Destroy;
    end;

    procedure TMyDictionary.Open;
    var
      protect: Integer;
    begin
      VirtualProtect(@LoadResString, SIZE_C, PAGE_READWRITE, @protect);
      Move((@LoadResString)^, loadResStringBuffer, SIZE_C);
      Move((@trLoadResString)^, (@LoadResString)^, SIZE_C);
      VirtualProtect(@LoadResString, SIZE_C, protect, @protect);
      FlushInstructionCache(GetCurrentProcess, @LoadResString, SIZE_C);
    end;

    procedure TMyDictionary.Close;
    var
      protect: Integer;
    begin
        VirtualProtect(@LoadResString, SIZE_C, PAGE_READWRITE, @protect);
        Move(loadResStringBuffer, (@LoadResString)^, SIZE_C);
        VirtualProtect(@LoadResString, SIZE_C, protect, @protect);
    end;


    function TranslateLoadResString(resStringRec: PResStringRec): String;
    var
      buffer: array[0..1023] of Char;
    begin
      try
        if resStringRec <> nil then
        begin
          if resStringRec.Identifier < 64*1024 then
          begin
            SetString(
              Result,
              buffer,
              LoadString(
                FindResourceHInstance(resStringRec.Module^),
                resStringRec.Identifier,
                buffer,
                SizeOf(buffer)));
          end
          else
            Result := PChar(resStringRec.Identifier);
        end
        else
          Result := '';

      except
        Result := '';
      end;
    end;

    function trLoadResString(resStringRec: PResStringRec): String;
    asm
      PUSH  EBP
      MOV   EBP, ESP
      ADD   ESP, $-8
      MOV   [EBP-$8], EDX
      MOV   [EBP-$4], EAX
      MOV   EDX, [EBP-$8]
      MOV   EAX, [EBP-$4]
      MOV   ECX, OFFSET Addr(TranslateLoadResString)-$1
      CALL  ECX
      MOV   ESP,EBP
      POP   EBP
    end;

    end.

现在，最后给出了使用该DLL的C＃代码：

using System;
using System.Windows.Forms;
using System.Runtime.InteropServices;

namespace TestWinform
{
    public partial class Form1 : Form
    {
        [DllImport("DelphiDllTest.dll")]
        public static extern void TestSwitching();

        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            TestSwitching();
        }
    }
}

希望这足以生成AV。

最佳答案

我相信DEP对例外负责。问题在于您使用的保护选项。代替PAGE_READWRITE，您需要使用PAGE_EXECUTE_READWRITE。在Open中，您需要同时保护@trLoadResString和@LoadResString，因此缺少对VirtualProtect的调用。

也许像这样：

VirtualProtect(@LoadResString, SIZE_C, PAGE_EXECUTE_READWRITE, @protect);
Move((@LoadResString)^, loadResStringBuffer, SIZE_C);
VirtualProtect(@LoadResString, SIZE_C, protect, @protect);
FlushInstructionCache(GetCurrentProcess, @LoadResString, SIZE_C);

VirtualProtect(@trLoadResString, SIZE_C, PAGE_EXECUTE_READWRITE, @protect);
Move((@trLoadResString)^, (@LoadResString)^, SIZE_C);
VirtualProtect(@trLoadResString, SIZE_C, protect, @protect);
FlushInstructionCache(GetCurrentProcess, @trLoadResString, SIZE_C);

并且您需要在Close方法中执行类似的操作。也许您需要还原trLoadResString。

您导出的函数正在使用register调用约定，但应将其导出为stdcall。 export指令将被忽略。只是exports重要。