System.AccessViolationException

[ApoIIy0n]

I'm getting these access violations randomly while multi-threading. I first thought it was due to the use of a newer yara.dll version, however even when moving back to 4.1.1 (which comes pre-compiled with the NativePack) this problem reoccures randomly.

System.AccessViolationException
  HResult=0x80004003
  Message=Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
  Source=<Cannot evaluate the exception source>
  StackTrace:
<Cannot evaluate the exception stack trace>

The file:

• is not always the same
• does not exceeds 256 length
• is not locked nor in use by any other process
• does not contain special characters
• is on a normal disk
• type of file is also random

details:

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
Repeat 2 times:
--------------------------------
   at dnYara.Interop.Methods.yr_rules_scan_file(IntPtr, System.String, Int32, dnYara.Interop.YR_CALLBACK_FUNC, IntPtr, Int32)
--------------------------------
   at dnYara.Scanner.ScanFile(System.String, dnYara.CompiledRules, dnYara.Interop.YR_SCAN_FLAGS)

fyi, I do the following checks to make sure it couldn't be something on my end (hopefully):

• i check if the file exist
• i check if the scanner isn't null (though it be odd if it would be I suppose..)
• check if the rules contain any rules
• have it all in a try/catch (though this does not get caught by it.., since HandleProcessCorruptedStateExceptions isn't supported by .net core)

Am I doing something wrong here or is there something seriously broken?

[lld1995]

https://blog.csdn.net/nightwizard2030/article/details/131469533

[ApoIIy0n]

Thanks for the notification, but I ended up building my own wrapper and the latest version of libyara since I came across multiple issues which are now solved ☺️

…

On Fri, 30 Jun 2023, 05:39 lld1995, ***@***.***> wrote: https://blog.csdn.net/nightwizard2030/article/details/131469533 — Reply to this email directly, view it on GitHub <#10 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AZQVFLTYLSQY7IU3PJ5EPALXNY36DANCNFSM6AAAAAAUQDBCD4> . You are receiving this because you authored the thread.Message ID: ***@***.***>