C# API Attempted to read or write protected memory

[MystifiedSky]

No matter what I do I get attempted to write protected memory. I have allow unsafe code to run other then that and setting cpu to x64 everything is default and console application c#. First I was just trying to run the c# examples and breakpoint through to get a idea of what everything was doing but that gave the memory issues too. Then I took this snipped of code from another issue since it was simple and having the same issue.

The code is as follows.

using System;
using System.Runtime.InteropServices;
using vmmsharp;

namespace CSharpApex1
{
    internal class Program
    {
        static void Main(string[] args)
        {
            // initialize vmm with verbose mode with fpga device
            Vmm vmm = new Vmm("-printf", "-v", "-device", "fpga");
            uint dwExplorerPID;
            vmm.PidGetFromName("explorer.exe", out dwExplorerPID);
            Vmm.MAP_MODULEENTRY mModuleKernel32 = vmm.Map_GetModuleFromName(dwExplorerPID, "kernel32.dll");
            byte[] dataKernel32MZ = vmm.MemRead(dwExplorerPID, mModuleKernel32.vaBase, 128, 0);
        }
    }
}

The Error

[ufrisk]

Are you always getting this error when calling into the PidGetFromName() function?

If you do a physical memory dump of the system to a file are you able to replicate the issue and get the same result?

[MystifiedSky]

Are you always getting this error when calling into the PidGetFromName() function?

If you do a physical memory dump of the system to a file are you able to replicate the issue and get the same result?

I get it with the ConfigGet() function too this is just running through with a breakpoint of the c# example. I am by far a noob when it comes to this but am trying to learn something new :). To give a little more info I have a Squierrel with custom firmware (could that be the issue?)

[ufrisk]

Having different firmware on your PCIe device should not cause issues like this.

If you do a memory dump with PCILeech (alternatively copy the file M:\memory.pmem if you use my memprocfs program and then try to use the dump file in your C# program. Does it cause the same issue?

[MystifiedSky]

Having different firmware on your PCIe device should not cause issues like this.

If you do a memory dump with PCILeech (alternatively copy the file M:\memory.pmem if you use my memprocfs program and then try to use the dump file in your C# program. Does it cause the same issue?

Yes I experienced the same issue I am pretty sure I did this right after creating the dump with memproc and running from that I get the same issue. Sorry for the wait I took a nap.

This is the console log:

[ufrisk]

This is really good news. Then we have a way of locating this.

If you haven't already done it can you please check that you get the same error using the latest download from https://github.com/ufrisk/MemProcFS/releases/tag/v5.1 (at the bare minimum you'd need to make sure the vmm.dll and leechcore.dll in your installation are the most recent, copy from the download).

If the error persists, are you able to share the memory dump with me? zip it, upload it somewhere and send me the link to pcileech@frizk.net or if you shoot med a DM on Twitter.

[MystifiedSky]

This is really good news. Then we have a way of locating this.

If you haven't already done it can you please check that you get the same error using the latest download from https://github.com/ufrisk/MemProcFS/releases/tag/v5.1 (at the bare minimum you'd need to make sure the vmm.dll and leechcore.dll in your installation are the most recent, copy from the download).

If the error persists, are you able to share the memory dump with me? zip it, upload it somewhere and send me the link to pcileech@frizk.net or if you shoot med a DM on Twitter.

Son of a b**ch I must of been using a old copy / corrupt copy after replacing those two it is working fine now..... I appreciate the amazing support and making everything so understandable!

[ufrisk]

Awesome that you managed to fix it. Yeah best is probably to let the vmm.dll end leechcore.dll follow along the vmmsharp.cs file you're using.

Best wishes with your project. If you run into anything please let me know, or if you'd like for more features.

If you find my project useful in the end please consider sponsoring my project. It comes for as little as $2/month. Thank You 💖