VirtualAlloc and Python - Access Violation

Question

非常简单的python脚本给了我访问冲突，我只是不知道为什么。

import ctypes
def Test():
data = bytearray( "xDExADxBExEFx0BxADxC0xDE", 'utf-16' )
dataLen = len( data )
try :
ptr = ctypes.windll.kernel32.VirtualAlloc( ctypes.c_int( 0 ),
ctypes.c_int( dataLen ),
ctypes.c_int( 0x3000 ),
ctypes.c_int( 0x40 ) )
buf = ( ctypes.c_char * dataLen ).from_buffer( data )
ctypes.windll.kernel32.RtlMoveMemory( ctypes.c_int( ptr ),
buf,
ctypes.c_int( dataLen ) )
except Exception as e :
print( e )
exit(-1)

错误：

Traceback (most recent call last):
File "c:vs17...ptvsd_launcher.py", line 119, in <module>
vspd.debug(filename, port_num, debug_id, debug_options, run_as)
File "c:vs17...ptvsddebugger.py", line 37, in debug
run(address, filename, *args, **kwargs)
File "c:vs17...ptvsd_local.py", line 64, in run_file
run(argv, addr, **kwargs)
File "c:vs17...ptvsd_local.py", line 125, in _run
_pydevd.main()
File "c:vs17..ptvsd_vendoredpydevdpydevd.py", line 1752, in main
globals = debugger.run(setup['file'], None, None, is_module)
File "c:vs17...ptvsd_vendoredpydevdpydevd.py", line 1099, in run
return self._exec(is_module, entry_point_fn, module_name, file, globals, locals)
File "c:vs17...ptvsd_vendoredpydevdpydevd.py", line 1106, in _exec
pydev_imports.execfile(file, globals, locals)  # execute the script
File "c:vs17...ptvsd_vendoredpydevd_pydev_imps_pydev_execfile.py", line 25, in execfile
exec(compile(contents+"n", file, 'exec'), glob, loc)
File "D:DevPythonVirtualAlloc_TestingVirtualAlloc_Testing.py", line 31, in <module>
main()
File "D:DevPythonVirtualAlloc_TestingVirtualAlloc_Testing.py", line 29, in main
Test()
File "D:DevPythonVirtualAlloc_TestingVirtualAlloc_Testing.py", line 19, in Test
ctypes.c_int( dataLen ) )
OSError: exception: access violation writing 0x00000000212F0000

Answer 1

遇到同样的问题。对我来说，原因是大小错误VirtualAllocrestype定义为 32 位值。

实际上，ctypes 函数没有原型化并返回 C 默认类型：c_int。在 Windows 上，c_int是c_long的别名，它是一个有符号的 32 位整数。因此，当系统分配超过x32限制的内存块时，VirtualAlloc返回的地址将被切断。

例如，在您的情况下，VirtualAlloc可以返回0000001A212F0000，但只有下部0x212F0000被用作ptr的值。

使用前添加下一行：

ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_void_p

同样的东西是关于RtlCopyMemory.argtypes：

ctypes.windll.kernel32.RtlCopyMemory.argtypes = ( ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t ) 

效果很好