1

非常简单的 python 脚本给了我访问冲突，我就是不知道为什么。

import ctypes

def Test():
     data = bytearray( "\xDE\xAD\xBE\xEF\x0B\xAD\xC0\xDE", 'utf-16' )
     dataLen = len( data )

     try :
        ptr = ctypes.windll.kernel32.VirtualAlloc( ctypes.c_int( 0 ),
                                                   ctypes.c_int( dataLen ),
                                                   ctypes.c_int( 0x3000 ),
                                                   ctypes.c_int( 0x40 ) )

        buf = ( ctypes.c_char * dataLen ).from_buffer( data )

        ctypes.windll.kernel32.RtlMoveMemory( ctypes.c_int( ptr ),
                                              buf,
                                              ctypes.c_int( dataLen ) )
     except Exception as e :
        print( e )
        exit(-1)

错误：

Traceback (most recent call last):
  File "c:\vs17\...\ptvsd_launcher.py", line 119, in <module>
    vspd.debug(filename, port_num, debug_id, debug_options, run_as)
  File "c:\vs17\...\ptvsd\debugger.py", line 37, in debug
    run(address, filename, *args, **kwargs)
  File "c:\vs17\...\ptvsd\_local.py", line 64, in run_file
    run(argv, addr, **kwargs)
  File "c:\vs17\...\ptvsd\_local.py", line 125, in _run
    _pydevd.main()
  File "c:\vs17\..\ptvsd\_vendored\pydevd\pydevd.py", line 1752, in main
    globals = debugger.run(setup['file'], None, None, is_module)
  File "c:\vs17\...\ptvsd\_vendored\pydevd\pydevd.py", line 1099, in run
    return self._exec(is_module, entry_point_fn, module_name, file, globals, locals)
  File "c:\vs17\...\ptvsd\_vendored\pydevd\pydevd.py", line 1106, in _exec
    pydev_imports.execfile(file, globals, locals)  # execute the script
  File "c:\vs17\...\ptvsd\_vendored\pydevd\_pydev_imps\_pydev_execfile.py", line 25, in execfile
    exec(compile(contents+"\n", file, 'exec'), glob, loc)
  File "D:\Dev\Python\VirtualAlloc_Testing\VirtualAlloc_Testing.py", line 31, in <module>
    main()
  File "D:\Dev\Python\VirtualAlloc_Testing\VirtualAlloc_Testing.py", line 29, in main
    Test()
  File "D:\Dev\Python\VirtualAlloc_Testing\VirtualAlloc_Testing.py", line 19, in Test
    ctypes.c_int( dataLen ) )
OSError: exception: access violation writing 0x00000000212F0000
4

1 回答 1

1

遇到同样的问题。对我来说，原因是错误的VirtualAlloc restype大小，定义为 32 位值。

实际上，ctypes 函数没有原型并返回 C 默认类型：c_int。在 Windows 上，是一个有符号 32 位整数c_int的别名。c_long因此，当系统分配高于 x32 限制的内存块时，VirtualAlloc 返回的地址将被剪切。

例如，在您的情况下VirtualAlloc可以返回0000001A212F0000，但只有较低的部分0x212F0000用作ptr.

使用前添加下一行：

ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_void_p

同样的东西是关于RtlCopyMemory.argtypes：

ctypes.windll.kernel32.RtlCopyMemory.argtypes = ( ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t )

效果很好

于 2020-04-16T19:21:40.487 回答