从.Net使用IAmsiStream会导致AccessViolationException

编程问答 2022-06-11

问题描述

我正在尝试通过C＃使用Antimalware Scan Interface (AMSI)。我知道有一些使用AmsiScanBuffer方法的实现，但是我想扫描更大的文件。因此，我想使用amsi.h中定义的IAntimalware COM接口。

到目前为止，我想出了以下代码：

using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Text;

namespace AmsiTest
{
    [Guid("82d29c2e-f062-44e6-b5c9-3d9a2f24a2df"),InterfaceType(ComInterfaceType.InterfaceIsIUnkNown),ComImport]
    public interface IAntiMalware {
        uint Scan([MarshalAs(UnmanagedType.Interface)] IAmsiStream stream,out AMSI_RESULT result,[MarshalAs(UnmanagedType.Interface)] out IAntimalwareProvider provider);
        void CloseSession(ulong session);
    }

    [Guid("b2cabfe3-fe04-42b1-a5df-08d483d4d125"),InterfaceType(ComInterfaceType.InterfaceIsIUnkNown)]
    public interface IAntimalwareProvider
    {
        uint Scan([In,MarshalAs(UnmanagedType.Interface)] IAmsiStream stream,[Out] out AMSI_RESULT result);
        void CloseSession(ulong session);
        uint displayName(ref IntPtr displayName);
    }

    [ComImport]
    [Guid("fdb00e52-a214-4aa1-8fba-4357bb0072ec")]
    [ComSourceInterfaces(typeof(IAntiMalware))]
    public class CAntimalware
    {
    }

    public enum AMSI_ATTRIBUTE
    {
        AMSI_ATTRIBUTE_APP_NAME = 0,AMSI_ATTRIBUTE_CONTENT_NAME = 1,AMSI_ATTRIBUTE_CONTENT_SIZE = 2,AMSI_ATTRIBUTE_CONTENT_ADDRESS  = 3,AMSI_ATTRIBUTE_SESSION  = 4,AMSI_ATTRIBUTE_REDIRECT_CHAIN_SIZE  = 5,AMSI_ATTRIBUTE_REDIRECT_CHAIN_ADDRESS   = 6,AMSI_ATTRIBUTE_ALL_SIZE = 7,AMSI_ATTRIBUTE_ALL_ADDRESS  = 8,AMSI_ATTRIBUTE_QUIET    = 9
    }   


    [Guid("3e47f2e5-81d4-4d3b-897f-545096770373"),InterfaceType(ComInterfaceType.InterfaceIsIUnkNown)]
    public interface IAmsiStream
    {
        uint GetAttribute(AMSI_ATTRIBUTE attribute,uint dataSize,[MarshalAs(UnmanagedType.LPArray,SizeParamIndex = 1)] byte[] data,out int retData);
        
        int Read(
            /* [in] */
            long position,/* [range][in] */
            int size,/* [length_is][size_is][out] */
            [MarshalAs(UnmanagedType.LPArray,SizeParamIndex = 1)]
            byte[] buffer,/* [out] */
            [Out] out int readSize);
    }

    public class AmsiStream : IAmsiStream
    {
        private readonly Stream _Input;

        public uint GetAttribute(AMSI_ATTRIBUTE attribute,byte[] data,out int retData)
        {
            const uint E_INSUFFICIENT_BUFFER = 0x8007007A;
            retData = 100;
            return E_INSUFFICIENT_BUFFER;
        }

        public int Read(long position,int size,byte[] buffer,out int readSize)
        {
            _Input.Seek(position,SeekOrigin.Begin);
            readSize = _Input.Read(buffer,size);
            return 0;
        }

            public AmsiStream(Stream input)
        {
            _Input = input ?? throw new ArgumentNullException(nameof(input));
        }

    }

    public enum AMSI_RESULT
    {
        AMSI_RESULT_CLEAN,AMSI_RESULT_NOT_DETECTED,AMSI_RESULT_BLOCKED_BY_ADMIN_START,AMSI_RESULT_BLOCKED_BY_ADMIN_END,AMSI_RESULT_DETECTED
    }


    class Program
    {
        static void Main(string[] args)
        {
            var scanner = new CAntimalware() as IAntiMalware;
            var scanResult = AMSI_RESULT.AMSI_RESULT_BLOCKED_BY_ADMIN_END;
            IAntimalwareProvider provider = null;
            IAmsiStream stream = new AmsiStream(new MemoryStream(Encoding.ASCII.GetBytes("TestString")));
            var result = scanner.Scan(stream,out scanResult,out provider);
        }
    }
}

运行该程序时，我看到一次GetAttribute方法被调用（attribute设置为AMSI_ATTRIBUTE_APP_NAME，dataSize设置为1和{设置为data Read`方法的{1}}永远不会被调用，但是不管我返回什么，它总是以AccessViolationException结尾（当以64个处理器执行时）：

byte[1]'. The

如果我将其作为32位程序运行，则会得到以下信息：

mscorlib.dll!System.StubHelpers.StubHelpers.GetCOMHRExceptionObject(int hr,system.intPtr pCPCMD,object pThis)
[Native to Managed Transition]
ntdll.dll!RtlpFreeHeapInternal()
ntdll.dll!RtlFreeHeap()
mscorlib.ni.dll!00007ff8cad6a76e()
[Managed to Native Transition]
ConsoleApp6.exe!AmsiTest.Program.Main(string[] args) Line 109
    at c:\temp\ConsoleApp6\Program.cs(109)
[Native to Managed Transition]
mscoreei.dll!00007ff8cfb78c01()
mscoree.dll!00007ff8d684ac42()
kernel32.dll!00007ff8e4416fd4()
ntdll.dll!RtlUserThreadStart()

据此，我认为我的COM声明有些错误，但是我无法弄清楚。我还尝试将System.ArgumentException: 'Value does not fall within the expected range.' ConsoleApp6.exe!AmsiTest.Program.Main(string[] args) Line 109 at c:\temp\ConsoleApp6\Program.cs(109) [Native to Managed Transition] mscoreei.dll!__CorExeMain@0() mscoree.dll!_ShellShim__CorExeMain@0() mscoree.dll!__CorExeMain_Exported@0() ntdll.dll!773974b4() 声明替换为byte[] data，但无济于事。

有什么想法我在这里做错了吗？

这些是amsi.idl文件中的声明：

IntPtr

解决方法

您需要告诉.NET，数组是IAnsiStream中的Out参数，如下所示：

[Guid("3e47f2e5-81d4-4d3b-897f-545096770373"),InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
public interface IAmsiStream
{
    [PreserveSig]
    int GetAttribute(AMSI_ATTRIBUTE attribute,int dataSize,[Out,MarshalAs(UnmanagedType.LPArray,SizeParamIndex = 1)] byte[] data,out int retData);
    
    [PreserveSig]
    int Read(long position,int size,SizeParamIndex = 1)] byte[] buffer,out int readSize);
}

还请注意，我使用PreserveSig来将方法的返回值明确定义为HRESULT。

这是GetAttribute方法的示例实现：

public int GetAttribute(AMSI_ATTRIBUTE attribute,byte[] data,out int retData)
{
    const int E_NOT_SUFFICIENT_BUFFER = unchecked((int)0x8007007A);
    switch (attribute)
    {
        case AMSI_ATTRIBUTE.AMSI_ATTRIBUTE_APP_NAME:
            const string appName = "My App Name";
            var bytes = Encoding.Unicode.GetBytes(appName + "\0"); // force terminating zero
            retData = bytes.Length;
            if (dataSize < bytes.Length)
                return E_NOT_SUFFICIENT_BUFFER;

            Array.Copy(bytes,data,bytes.Length);
            return 0;

        // TODO: implement what's needed

        default:
            retData = 0;
            const int E_NOTIMPL = unchecked((int)0x80004001);
            return E_NOTIMPL;
    }
}
c#c#c++comcomcomcom-interop