From cb437ef9b5c451f040149063e4d727045d821ab3 Mon Sep 17 00:00:00 2001 From: Kevin Bataille Date: Tue, 21 Jul 2026 21:36:46 +0200 Subject: [PATCH] Fix x64 stub ABI and marshal-path sizing; dedupe RPM readers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit x64 call stub was ABI-broken: fixed 0x20 frame left rsp misaligned at the inner call (callee entry rsp ≡ 0, ABI requires ≡ 8) and, for 5+ args, wrote stack args over the return address. Compute frame K ≡ 8 (mod 16), K ≥ 0x20 + 8*stackArgs, so the callee sees a 16-aligned stack and stack args land above the shadow window. Load register args as full 64-bit imm64 (was imm32, which truncated pointers > 4 GiB). BuildCallStub now takes nuint[]; x86 range- checks each arg against uint.MaxValue instead of silently truncating. MarshalCache conflated managed and unmanaged width in one Size field: the blittable path needs Unsafe.SizeOf (bool = 1) while the marshal path needs Marshal.SizeOf (inline ByValTStr/ByValArray expand past the managed pointer). Add MarshalSize; MemoryBase picks per TypeRequiresMarshal at all four IO sites. Prevents PtrToStructure/StructureToPtr from over-reading/overwriting the pinned scratch buffer (heap corruption on write). Extract shared RPM/WPM into RpmHelper: honor partial reads (dead Array.Resize removed), consistent write-return semantics; InProcessReader now guards MainModule like ExternalReader. Tests: x64 frame-alignment property + inline-marshal round-trip added (both fail against the pre-fix code); existing x64 byte-expectation tests updated to the new frame. Build clean, 100/100 pass. Co-Authored-By: Claude Opus 4.8 (1M context) --- WhiteMagic/Assembly/StubAssembler.cs | 137 ++++++++++--- WhiteMagic/MarshalCache.cs | 109 ++++++---- WhiteMagic/MemoryBase.cs | 8 +- WhiteMagic/RpmHelper.cs | 61 ++++++ WhiteMagicTest/MarshalCacheTests.cs | 96 +++++++-- WhiteMagicTest/MemoryBaseTests.cs | 51 +++++ WhiteMagicTest/StubAssemblerTests.cs | 293 +++++++++++++++++++++++---- 7 files changed, 618 insertions(+), 137 deletions(-) create mode 100644 WhiteMagic/RpmHelper.cs diff --git a/WhiteMagic/Assembly/StubAssembler.cs b/WhiteMagic/Assembly/StubAssembler.cs index d9bc236..5f9d228 100644 --- a/WhiteMagic/Assembly/StubAssembler.cs +++ b/WhiteMagic/Assembly/StubAssembler.cs @@ -46,21 +46,35 @@ public sealed class StubAssembler : IAssembler /// /// Where the stub lands (for E8 rel32 encoding). /// Function to call. - /// Argument values (uint[] — each 4 or 8 bytes per pointerSize). + /// Argument values. For x86 each element holds a 32-bit argument; + /// for x64 each element holds the full 64-bit pointer-sized argument. /// 4 (x86) or 8 (x64). - /// Calling convention. + /// Calling convention (ignored on x64; Windows has a single ABI). /// is not 4 or 8, /// or is not known, or the distance between stub and target /// exceeds the E8 rel32 range. public byte[] BuildCallStub(IntPtr stubAddress, IntPtr targetAddress, - uint[] arguments, int pointerSize, CallConvention convention) + nuint[] arguments, int pointerSize, CallConvention convention) { - var buffer = new List(64); + var buffer = new List(96); if (pointerSize == 4) { + // X86 args are 32-bit. Truncate nuint down to uint — callers must pass values + // that fit in 32 bits on x86 targets. + uint[] args32 = new uint[arguments.Length]; + for (int i = 0; i < arguments.Length; i++) + { + ulong v = arguments[i]; + if (v > uint.MaxValue) + { + throw new ArgumentOutOfRangeException(nameof(arguments), + $"Argument {i} = 0x{v:X} does not fit in 32 bits (x86 target)."); + } + args32[i] = (uint)v; + } BuildX86Stub(buffer, checked((uint)stubAddress), checked((uint)targetAddress), - arguments, convention); + args32, convention); } else if (pointerSize == 8) { @@ -153,56 +167,113 @@ public sealed class StubAssembler : IAssembler buffer.Add(0xC3); // ret } + /// + /// Builds a Windows x64 call stub that conforms to the Microsoft x64 ABI: + /// first 4 integer/pointer args in RCX, RDX, R8, R9 (64-bit loads); stack args + /// above a 32-byte shadow space; 16-byte stack alignment at the inner call. + /// + /// + /// Frame derivation. The ABI requires the inner call site to + /// land with call-site rsp ≡ 0 (mod 16), so that call pushes 8 bytes and the + /// callee sees entry rsp ≡ 8 — the value an MSVC prologue (push rbp; sub rsp, 0x20) + /// expects, and the only value for which locals land 16-aligned (SSE-safe). + /// + /// Stub entry: rsp ≡ 8 (mod 16). + /// Need post-sub rsp ≡ 0 → sub operand K satisfies K ≡ 8 (mod 16). + /// Frame must hold shadow space (0x20) + stack args (8 bytes each for args 4+). + /// Choose the smallest such K: K = frameBytes + ((8 − frameBytes) mod 16 + 16) mod 16. + /// For 0–5 args, K ∈ {0x28, 0x38}; pattern scales linearly. + /// + /// + /// sub rsp, K ; K ≡ 8 (mod 16), K ≥ 0x20 + 8·stackArgs + /// mov rcx, arg0 ; REX.W + imm64 (10 bytes) + /// mov rdx, arg1 ; REX.W + imm64 (10 bytes) + /// mov r8, arg2 ; REX.WB+ imm64 (10 bytes, REX.R) + /// mov r9, arg3 ; REX.WB+ imm64 (10 bytes, REX.R) + /// mov rax, arg[N] ; REX.W + imm64 (10 bytes) + /// mov [rsp + 0x20 + 8*(N-4)], rax (5/8 bytes) + /// call target (rel32) ( 5 bytes) + /// add rsp, K ( 7 bytes) + /// ret ( 1 byte) + /// + /// private void BuildX64Stub(List buffer, ulong stubAddr, - ulong target, uint[] args) + ulong target, nuint[] args) { - // Windows x64 single ABI: first 4 args in RCX, RDX, R8D, R9D. ulong current = stubAddr; - var regCodes = new byte[] { 0xB9, 0xBA, 0xB8, 0xB9 }; - var rexBytes = new byte[] { 0x00, 0x00, 0x41, 0x41 }; + // Compute frame size K. K ≡ 8 (mod 16) so that the inner call sees + // post-sub rsp ≡ 0 and delivers target entry rsp ≡ 8 (mod 16). + int stackArgs = Math.Max(0, args.Length - 4); + int frameBytes = 0x20 + 8 * stackArgs; + int k = frameBytes + ((8 - (frameBytes % 16) + 16) % 16); + + // sub rsp, imm32 (always imm32 form — constant 7 bytes regardless of K). + buffer.Add(0x48); buffer.Add(0x81); buffer.Add(0xEC); + EmitU32(buffer, (uint)k); + current += 7; + + // 64-bit register loads for args 0..3. All encodings are exactly 10 bytes: + // REX.W (0x48) + 0xB9 + imm64 → mov rcx, imm64 + // REX.W (0x48) + 0xBA + imm64 → mov rdx, imm64 + // REX.WB(0x49) + 0xB8 + imm64 → mov r8, imm64 (REX.R for r8) + // REX.WB(0x49) + 0xB9 + imm64 → mov r9, imm64 (REX.R) + byte[][] regMoves = + [ + [0x48, 0xB9], + [0x48, 0xBA], + [0x49, 0xB8], + [0x49, 0xB9], + ]; int regCount = Math.Min(args.Length, 4); for (int i = 0; i < regCount; i++) { - if (rexBytes[i] != 0) - buffer.Add(rexBytes[i]); - buffer.Add(regCodes[i]); - EmitU32(buffer, args[i]); - current += (rexBytes[i] != 0 ? 6u : 5u); + byte[] prefix = regMoves[i]; + buffer.Add(prefix[0]); + buffer.Add(prefix[1]); + EmitU64(buffer, args[i]); + current += (uint)(prefix.Length + 8); } - // Push remaining args in reverse order - for (int i = args.Length - 1; i >= 4; i--) + // Stack args: written at [post-sub-rsp + 0x20 + 8*(i-4)], i.e. above the + // shadow window, where the inner call's callee expects them. + for (int i = 4; i < args.Length; i++) { - current += 5; - buffer.Add(0x68); - EmitU32(buffer, args[i]); + int offset = 0x20 + (i - 4) * 8; + buffer.Add(0x48); buffer.Add(0xB8); // mov rax, imm64 + EmitU64(buffer, args[i]); + current += 10; + + buffer.Add(0x48); buffer.Add(0x89); // mov [rsp + disp], rax + if (offset <= 127) + { + buffer.Add(0x44); buffer.Add(0x24); // ModRM: [rsp + disp8] + buffer.Add((byte)offset); + current += 5; + } + else + { + buffer.Add(0x84); buffer.Add(0x24); // ModRM: [rsp + disp32] + EmitU32(buffer, (uint)offset); + current += 8; + } } // call rel32 long distance = (long)target - (long)(current + 5); - if (distance < int.MinValue || distance > int.MaxValue) + if (distance is < int.MinValue or > int.MaxValue) { throw new ArgumentOutOfRangeException( "target and stub are >2 GiB apart; E8 rel32 cannot encode this distance."); } buffer.Add(0xE8); EmitU32(buffer, (uint)distance); + current += 5; - // Pop any args pushed on stack (x64 is caller-clean) - int stackArgs = args.Length > 4 ? args.Length - 4 : 0; - if (stackArgs > 0) - { - int bytes = stackArgs * 8; - buffer.Add(0x48); // REX.W - buffer.Add(bytes <= 127 ? (byte)0x83 : (byte)0x81); // add r/m64, imm8/imm32 - buffer.Add(0xC4); // rsp - if (bytes <= 127) - buffer.Add((byte)bytes); - else - EmitU32(buffer, (uint)bytes); - } + // Tear down the frame symmetrically. + buffer.Add(0x48); buffer.Add(0x81); buffer.Add(0xC4); + EmitU32(buffer, (uint)k); buffer.Add(0xC3); } diff --git a/WhiteMagic/MarshalCache.cs b/WhiteMagic/MarshalCache.cs index 49f1b59..fe79211 100644 --- a/WhiteMagic/MarshalCache.cs +++ b/WhiteMagic/MarshalCache.cs @@ -1,88 +1,107 @@ using System.Reflection; +using System.Runtime.CompilerServices; using System.Runtime.InteropServices; namespace WhiteMagic; /// -/// Computes and caches marshal-related metadata for type -/// exactly once. and -/// branch on these cached flags to decide between blittable Span/MemoryMarshal -/// paths and the fallback marshal path. +/// Caches the widths marshalling decisions for type +/// once, at static-constructor time. and +/// branch on +/// and pick the appropriate width from this cache. /// /// The type to cache metadata for. public static class MarshalCache { - /// The unmanaged size of in bytes. + /// + /// The blittable (managed layout) width of . This is + /// what / + /// actually consume. Equals in the general case, + /// with fixed-width overrides for , , and + /// enums so the cache value matches the primitive layout width used by those + /// paths. + /// public static readonly int Size; - /// The unmanaged size of as an unsigned integer. - public static readonly uint SizeU; + /// + /// The unmanaged (interop) width via . The marshal + /// path (/) + /// reads/writes this many bytes. Exceeds whenever a struct + /// carries inline unmanaged data that the marshaler expands — inline + /// ByValTStr/ByValArray buffers, bool fields (4 bytes per + /// default Win32 BOOL marshaling vs 1 byte managed), etc. For types that do + /// not go through the marshal path, this field is still populated but unused + /// by MemoryBase. + /// + /// + /// Marshal.SizeOf throws for some reference-containing shapes (e.g. a + /// bare ). When that happens, we fall back to + /// — the fallback path is unreachable from production code + /// because types with a reference field always have + /// true, so MemoryBase reads this field only + /// when it is known to be populated. + /// + public static readonly int MarshalSize; /// - /// when cannot be copied through the - /// blittable path and must - /// use / instead. - /// This is the case when a top-level field carries , or - /// when contains a managed reference - /// (). + /// when cannot be copied through + /// the blittable path + /// and must fall back to / + /// . This is the case when a top-level field + /// carries , or when + /// contains a managed reference + /// (). /// /// /// The check inspects only top-level fields; a - /// on a field of a nested struct is not detected. - /// Reference-containing nested structs are still caught, because the reference check - /// propagates through nested value types. + /// on a field of a nested struct is not + /// detected. Reference-containing nested structs are still caught, because the + /// reference check propagates through nested value types. /// public static readonly bool TypeRequiresMarshal; - /// when is . - public static readonly bool IsIntPtr; - - /// The underlying type code of . - public static readonly TypeCode TypeCode; - - /// - /// The effective type that the marshaler uses. For an enum this is the underlying - /// integer type; for all other types it is itself. - /// - public static readonly Type RealType; - static MarshalCache() { - TypeCode = Type.GetTypeCode(typeof(T)); - if (typeof(T) == typeof(bool)) { Size = 1; - RealType = typeof(T); } else if (typeof(T) == typeof(char)) { - // Marshal.SizeOf(char) is 1 (ANSI), but the blittable path reads/writes a - // char as a 2-byte UTF-16 code unit. Size must match the blittable width. + // Marshal.SizeOf reports 1 (ANSI char), but the blittable + // MemoryMarshal path reads/writes a char as a 2-byte UTF-16 code unit. Size = 2; - RealType = typeof(T); } else if (typeof(T).IsEnum) { - Type underlying = typeof(T).GetEnumUnderlyingType(); - Size = Marshal.SizeOf(underlying); - RealType = underlying; - TypeCode = Type.GetTypeCode(underlying); + Size = Marshal.SizeOf(typeof(T).GetEnumUnderlyingType()); } else { - Size = Marshal.SizeOf(typeof(T)); - RealType = typeof(T); + // The blittable path goes through MemoryMarshal, which uses the CLR + // managed layout. Use Unsafe.SizeOf so Size agrees with that + // layout — Marshal.SizeOf disagrees when a struct contains a + // `bool` field (unmanaged 4 vs managed 1). + Size = Unsafe.SizeOf(); } - SizeU = (uint)Size; - IsIntPtr = RealType == typeof(IntPtr); - bool hasMarshalAsField = - RealType.GetFields(BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic) + typeof(T).GetFields(BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic) .Any(f => f.GetCustomAttributes(typeof(MarshalAsAttribute), true).Length != 0); TypeRequiresMarshal = - hasMarshalAsField || System.Runtime.CompilerServices.RuntimeHelpers.IsReferenceOrContainsReferences(); + hasMarshalAsField || RuntimeHelpers.IsReferenceOrContainsReferences(); + + // MarshalSize is only consulted when TypeRequiresMarshal is true; for the + // rare case where Marshal.SizeOf refuses a shape (ref-containing structs), + // fall back to the managed size so the field stays populated. + try + { + MarshalSize = Marshal.SizeOf(); + } + catch (ArgumentException) + { + MarshalSize = Size; + } } } diff --git a/WhiteMagic/MemoryBase.cs b/WhiteMagic/MemoryBase.cs index 7e52137..90c9486 100644 --- a/WhiteMagic/MemoryBase.cs +++ b/WhiteMagic/MemoryBase.cs @@ -37,7 +37,7 @@ public abstract class MemoryBase : IDisposable if (isRelative) address = GetAbsolute(address); - int size = MarshalCache.Size; + int size = MarshalCache.TypeRequiresMarshal ? MarshalCache.MarshalSize : MarshalCache.Size; byte[] raw = ReadBytes(address, size); if (raw.Length < size) @@ -56,7 +56,7 @@ public abstract class MemoryBase : IDisposable if (isRelative) address = GetAbsolute(address); - int size = MarshalCache.Size; + int size = MarshalCache.TypeRequiresMarshal ? MarshalCache.MarshalSize : MarshalCache.Size; byte[] raw; if (MarshalCache.TypeRequiresMarshal) @@ -81,7 +81,7 @@ public abstract class MemoryBase : IDisposable if (isRelative) address = GetAbsolute(address); - int elementSize = MarshalCache.Size; + int elementSize = MarshalCache.TypeRequiresMarshal ? MarshalCache.MarshalSize : MarshalCache.Size; long totalSize = (long)elementSize * count; ArgumentOutOfRangeException.ThrowIfGreaterThan(totalSize, int.MaxValue, nameof(count)); @@ -127,7 +127,7 @@ public abstract class MemoryBase : IDisposable if (values is null || values.Length == 0) return true; - int elementSize = MarshalCache.Size; + int elementSize = MarshalCache.TypeRequiresMarshal ? MarshalCache.MarshalSize : MarshalCache.Size; long total = (long)elementSize * values.Length; ArgumentOutOfRangeException.ThrowIfGreaterThan(total, int.MaxValue, nameof(values)); int totalSize = (int)total; diff --git a/WhiteMagic/RpmHelper.cs b/WhiteMagic/RpmHelper.cs new file mode 100644 index 0000000..3275278 --- /dev/null +++ b/WhiteMagic/RpmHelper.cs @@ -0,0 +1,61 @@ +using System.Runtime.InteropServices; +using WhiteMagic.Native; + +namespace WhiteMagic; + +/// +/// Shared ReadProcessMemory / WriteProcessMemory wrappers used by both +/// and . Kept in a single +/// location to keep the two readers byte-for-byte consistent on partial-read handling, +/// write-return semantics, and failure modes. +/// +internal static class RpmHelper +{ + /// + /// Reads up to bytes from in + /// the process identified by . Returns: + /// + /// An empty array if fails and + /// reports zero bytes read. + /// A truncated array of exactly bytesRead bytes when the call returns + /// but the OS has placed a partial copy in the buffer + /// (for example, ERROR_PARTIAL_COPY). + /// The full buffer on success. + /// + /// + public static byte[] ReadBytes(SafeMemoryHandle handle, IntPtr address, int count) + { + byte[] buffer = new byte[count]; + bool ok = NativeMethods.ReadProcessMemory(handle, address, buffer, count, out nint bytesRead); + + if (!ok && bytesRead == 0) + { + return []; + } + + if ((int)bytesRead < count) + { + // Either a successful short read, or a failed-but-partial RPM. In both + // cases honor the bytes the OS actually produced rather than padding. + byte[] partial = new byte[(int)bytesRead]; + Buffer.BlockCopy(buffer, 0, partial, 0, (int)bytesRead); + return partial; + } + + return buffer; + } + + /// + /// Writes to in the process + /// identified by . Returns the number of bytes actually + /// written, or 0 on total failure. + /// + public static int WriteBytes(SafeMemoryHandle handle, IntPtr address, ReadOnlySpan bytes) + { + if (!NativeMethods.WriteProcessMemory(handle, address, bytes, bytes.Length, out nint written)) + { + return 0; + } + return (int)written; + } +} diff --git a/WhiteMagicTest/MarshalCacheTests.cs b/WhiteMagicTest/MarshalCacheTests.cs index 6511eac..4197e66 100644 --- a/WhiteMagicTest/MarshalCacheTests.cs +++ b/WhiteMagicTest/MarshalCacheTests.cs @@ -1,3 +1,4 @@ +using System.Runtime.CompilerServices; using System.Runtime.InteropServices; using WhiteMagic; @@ -5,7 +6,7 @@ namespace WhiteMagicTest; /// /// Tests for : blittable size, marshal-required flag, -/// IsIntPtr, and computed-once behavior. +/// the separate MarshalSize field, and computed-once behavior. /// public class MarshalCacheTests { @@ -45,12 +46,33 @@ public class MarshalCacheTests Assert.Equal(8, MarshalCache.Size); } + [Fact] + public void Size_for_struct_with_bool_is_managed_layout_width() + { + // Regression for the Marshal vs. Unsafe size disagreement on a struct + // whose only field is `bool`: Marshal reports 4 (Win32 BOOL default + // marshaling), but the blittable path (MemoryMarshal.Read) actually + // lays out a bool as 1 byte. MarshalCache.Size must match managed width. + Assert.Equal(Unsafe.SizeOf(), MarshalCache.Size); + Assert.Equal(1, MarshalCache.Size); + } + + [Fact] + public void Size_for_struct_with_bools_in_sequence_matches_managed_layout() + { + // Sequential struct { bool, bool } — managed width is 2, Marshal width is 8 + // (two BOOLs). The blittable path uses 1 byte per bool, so Size must equal + // the managed width. + Assert.Equal(Unsafe.SizeOf(), MarshalCache.Size); + Assert.Equal(2, MarshalCache.Size); + } + [Fact] public void TypeRequiresMarshal_is_false_for_blittable_types() { Assert.False(MarshalCache.TypeRequiresMarshal); - Assert.False(MarshalCache.TypeRequiresMarshal); - Assert.False(MarshalCache.TypeRequiresMarshal); + Assert.False(MarshalCache.TypeRequiresMarshal); + Assert.False(MarshalCache.TypeRequiresMarshal); } [Fact] @@ -60,39 +82,50 @@ public class MarshalCacheTests } [Fact] - public void IsIntPtr_is_true_for_IntPtr() + public void TypeRequiresMarshal_is_true_for_reference_containing_types() { - Assert.True(MarshalCache.IsIntPtr); + Assert.True(MarshalCache.TypeRequiresMarshal); } [Fact] - public void IsIntPtr_is_false_for_non_IntPtr_types() + public void Inline_struct_with_MarshalAs_has_separate_MarshalSize() { - Assert.False(MarshalCache.IsIntPtr); - Assert.False(MarshalCache.IsIntPtr); - Assert.False(MarshalCache.IsIntPtr); + // Regression for the marshal-path size bug. A struct with an inline + // ByValTStr field has mismatched managed and unmanaged widths: the managed + // width is just the pointer reference (8 bytes); the marshal unroller + // expands it into a 16-WCHAR inline buffer (32 bytes). MarshalCache.Size + // must match what the blittable path uses; MarshalCache.MarshalSize must + // match what the marshal path uses. + Assert.True(MarshalCache.TypeRequiresMarshal); + int expectedManaged = Unsafe.SizeOf(); // 8 (ptr) + int expectedMarshal = Marshal.SizeOf(); // 32 (16 WCHAR) + Assert.Equal(expectedManaged, MarshalCache.Size); + Assert.Equal(expectedMarshal, MarshalCache.MarshalSize); + Assert.NotEqual(MarshalCache.Size, + MarshalCache.MarshalSize); } [Fact] - public void All_properties_are_computed_once_and_cached() + public void MarshalSize_equals_Size_for_blittable_types() + { + // No interop expansion is needed when the type is blittable; both widths + // coincide. + Assert.Equal(MarshalCache.Size, MarshalCache.MarshalSize); + Assert.Equal(MarshalCache.Size, MarshalCache.MarshalSize); + Assert.Equal(MarshalCache.Size, MarshalCache.MarshalSize); + } + + [Fact] + public void Properties_are_computed_once_and_cached() { int size1 = MarshalCache.Size; bool marshal1 = MarshalCache.TypeRequiresMarshal; - bool intPtr1 = MarshalCache.IsIntPtr; int size2 = MarshalCache.Size; bool marshal2 = MarshalCache.TypeRequiresMarshal; - bool intPtr2 = MarshalCache.IsIntPtr; Assert.Equal(size1, size2); Assert.Equal(marshal1, marshal2); - Assert.Equal(intPtr1, intPtr2); - } - - [Fact] - public void SizeU_matches_Size_as_uint() - { - Assert.Equal((uint)MarshalCache.Size, MarshalCache.SizeU); } [StructLayout(LayoutKind.Sequential)] @@ -108,4 +141,29 @@ public class MarshalCacheTests [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] Data; } + + [StructLayout(LayoutKind.Sequential)] + private struct SingleBoolStruct + { + public bool Flag; + } + + [StructLayout(LayoutKind.Sequential)] + private struct SequentialBoolStruct + { + public bool A; + public bool B; + } + + /// + /// A struct whose marshal layout carries an inline character buffer but + /// whose CLR managed layout is just a reference pointer. The canonical way + /// to exercise the marshal-vs-managed width split. + /// + [StructLayout(LayoutKind.Sequential)] + public struct InlineStrStruct + { + [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 16)] + public string Name; + } } diff --git a/WhiteMagicTest/MemoryBaseTests.cs b/WhiteMagicTest/MemoryBaseTests.cs index afc177f..40de318 100644 --- a/WhiteMagicTest/MemoryBaseTests.cs +++ b/WhiteMagicTest/MemoryBaseTests.cs @@ -196,6 +196,43 @@ public class MemoryBaseTests reader.Dispose(); } + // ── Marshal-path round-trip ─────────────────────────────────────────────── + // + // The marshal path was previously sized using MarshalCache.Size (managed + // layout width). When a struct carries an inline marshal-expanded field + // (ByValTStr, ByValArray, etc.) this width is smaller than the actual + // read/write width — writing overflows the pinned buffer and reading + // under-fetches the remote bytes, producing silent heap corruption. + // + // The marshal path must use MarshalCache.MarshalSize (= Marshal.SizeOf) + // so the pinned buffer is large enough for PtrToStructure / StructureToPtr. + + [Fact] + public void Read_struct_via_marshal_path_round_trips_inline_string() + { + using var reader = OpenSelf(); + + // A marshal-path struct carries a reference, so it cannot be pinned; the + // target must be an unmanaged buffer of the FULL marshal width. Pre-patch, + // Write sized its scratch buffer with MarshalCache.Size (managed pointer + // width, 8) and StructureToPtr overran it, while Read under-fetched the + // remote bytes — the string came back wrong. Post-patch both use + // MarshalSize (Marshal.SizeOf). + int size = Marshal.SizeOf(); + IntPtr addr = Marshal.AllocHGlobal(size); + try + { + InlineStr original = new InlineStr { Name = "Hello, World!" }; + Assert.True(reader.Write(addr, original)); + InlineStr read = reader.Read(addr); + Assert.Equal("Hello, World!", read.Name); + } + finally + { + Marshal.FreeHGlobal(addr); + } + } + // ── Graceful failure on invalid addresses ─────────────────────────────── [Fact] @@ -243,3 +280,17 @@ public struct TestStruct : IEquatable public override int GetHashCode() => HashCode.Combine(X, Y); public override string ToString() => $"({X}, {Y})"; } + +/// +/// A struct whose managed layout is just a reference pointer (8 bytes) but whose +/// unmanaged marshal layout carries an inline character buffer. Exercised by +/// +/// to catch regressions where the marshal path uses the managed width instead +/// of the marshal width. +/// +[StructLayout(LayoutKind.Sequential)] +public struct InlineStr +{ + [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 16)] + public string Name; +} diff --git a/WhiteMagicTest/StubAssemblerTests.cs b/WhiteMagicTest/StubAssemblerTests.cs index acfb6a4..ec13fbf 100644 --- a/WhiteMagicTest/StubAssemblerTests.cs +++ b/WhiteMagicTest/StubAssemblerTests.cs @@ -90,7 +90,7 @@ public class StubAssemblerTests { uint ca=0x10000000u+5,r=0x12345678u-(ca+5); byte[] s=Create().BuildCallStub((IntPtr)0x10000000,(IntPtr)0x12345678,[0xCAFEBABE],4,CallConvention.Thiscall); - Assert.Equal(11,s.Length); Assert.Equal(0xB9,s[0]); Assert.Equal(0xCAFEBABE,BitConverter.ToUInt32(s,1)); + Assert.Equal(11,s.Length); Assert.Equal(0xB9,s[0]); Assert.Equal(0xCAFEBABEu,BitConverter.ToUInt32(s,1)); Assert.Equal(0xE8,s[5]); Assert.Equal(r,BitConverter.ToUInt32(s,6)); Assert.Equal(0xC3,s[10]); } @@ -120,8 +120,8 @@ public class StubAssemblerTests { uint ca=0x10000000u+10,r=0x12345678u-(ca+5); byte[] s=Create().BuildCallStub((IntPtr)0x10000000,(IntPtr)0x12345678,[0xAAAAAAAA,0xBBBBBBBB],4,CallConvention.Fastcall); - Assert.Equal(16,s.Length); Assert.Equal(0xB9,s[0]); Assert.Equal(0xAAAAAAAA,BitConverter.ToUInt32(s,1)); - Assert.Equal(0xBA,s[5]); Assert.Equal(0xBBBBBBBB,BitConverter.ToUInt32(s,6)); + Assert.Equal(16,s.Length); Assert.Equal(0xB9,s[0]); Assert.Equal(0xAAAAAAAAu,BitConverter.ToUInt32(s,1)); + Assert.Equal(0xBA,s[5]); Assert.Equal(0xBBBBBBBBu,BitConverter.ToUInt32(s,6)); Assert.Equal(0xE8,s[10]); Assert.Equal(r,BitConverter.ToUInt32(s,11)); Assert.Equal(0xC3,s[15]); } @@ -133,52 +133,272 @@ public class StubAssemblerTests Create().BuildCallStub((IntPtr)0x10000000,(IntPtr)0x12345678,[],4,CallConvention.Fastcall)); } - // ── x64 ───────────────────────────────────────────────────────────── + // ── x64 (Microsoft x64 ABI — shadow space + 16-byte alignment + 64-bit loads) ── + // + // Stub frame layout: + // bytes 0..6 sub rsp, K (7 bytes — K = 32 + 8·stackArgs, rounded so K ≡ 8 mod 16) + // bytes 7..N mov r64, imm64 ... (10 bytes per reg move: 2-byte prefix + 8-byte imm) + // mov rax, imm64 / mov [rsp+0x20+8*(i-4)], rax for stack args (15 bytes each) + // E8 rel32 call target (5 bytes) + // 48 81 C4 K 00... add rsp, K (7 bytes) + // C3 ret (1 byte) + // + // Each `mov rNN, imm64` is 10 bytes regardless of the target register: + // RCX REX.W+opcode B9 (0x48 0xB9) + // RDX REX.W+opcode BA (0x48 0xBA) + // R8 REX.WB+opcode B8 (0x49 0xB8, REX.R needed for r8) + // R9 REX.WB+opcode B9 (0x49 0xB9, REX.R needed for r9) + // RAX REX.W+opcode B8 (0x48 0xB8) [Fact] - public void X64_0args() + public void X64_0args_allocates_shadow_space_and_aligns() { - var s=Create(); ulong a=0x100000000,t=0x123456788; - uint r=(uint)(t-(a+5)); - byte[] stub=s.BuildCallStub((IntPtr)(nint)a,(IntPtr)(nint)t,[],8,CallConvention.Cdecl); - Assert.Equal(6,stub.Length); Assert.Equal(0xE8,stub[0]); Assert.Equal(r,BitConverter.ToUInt32(stub,1)); Assert.Equal(0xC3,stub[5]); + var s = Create(); + ulong a = 0x100000000, t = 0x123456788; + byte[] stub = s.BuildCallStub( + (IntPtr)(nint)a, (IntPtr)(nint)t, [], 8, CallConvention.Cdecl); + + // K = 0x20 + 0·8 = 0x20; round up to ≡ 8 mod 16 → K = 0x28. + // Frame = sub(7) + call(5) + add(7) + ret(1) = 20 + Assert.Equal(20, stub.Length); + + uint rel = (uint)(t - (a + 7 + 5)); // = t - a - 12 + + Assert.Equal([0x48, 0x81, 0xEC, 0x28, 0x00, 0x00, 0x00], stub[..7]); // sub rsp, 0x28 (K ≡ 8 mod 16) + Assert.Equal(0xE8, stub[7]); + Assert.Equal(rel, BitConverter.ToUInt32(stub, 8)); + Assert.Equal([0x48, 0x81, 0xC4, 0x28, 0x00, 0x00, 0x00], stub[12..19]); // add rsp, 0x28 + Assert.Equal(0xC3, stub[19]); // ret } [Fact] - public void X64_1arg_mov_ecx() + public void X64_1arg_loads_rcx_as_64bit() { - var s=Create(); ulong a=0x100000000,t=0x123456788; - uint r=(uint)(t-(a+5+5)); - Assert.Equal([ - 0xB9,0xDD,0xCC,0xBB,0xAA, - 0xE8,(byte)r,(byte)(r>>8),(byte)(r>>16),(byte)(r>>24),0xC3], - s.BuildCallStub((IntPtr)(nint)a,(IntPtr)(nint)t,[0xAABBCCDD],8,CallConvention.Cdecl)); + var s = Create(); + ulong a = 0x100000000, t = 0x123456788; + byte[] stub = s.BuildCallStub( + (IntPtr)(nint)a, (IntPtr)(nint)t, [0xAABBCCDDu], 8, CallConvention.Cdecl); + + // K = 0x28. Total = sub(7) + mov(10) + call(5) + add(7) + ret(1) = 30 + Assert.Equal(30, stub.Length); + + uint rel = (uint)(t - (a + 7 + 10 + 5)); // = t - a - 22 + // stub[0..6] = sub rsp, 0x28 (K ≡ 8 mod 16, 16-aligned call-site for SSE safety) + Assert.Equal([0x48, 0x81, 0xEC, 0x28, 0x00, 0x00, 0x00], stub[..7]); + // stub[7..16] = mov rcx, 0x00000000_AABBCCDD (zero-extended) + Assert.Equal(0x48, stub[7]); Assert.Equal(0xB9, stub[8]); + Assert.Equal(0xDD, stub[9]); Assert.Equal(0xCC, stub[10]); + Assert.Equal(0xBB, stub[11]); Assert.Equal(0xAA, stub[12]); + Assert.Equal(0x00, stub[13]); Assert.Equal(0x00, stub[14]); + Assert.Equal(0x00, stub[15]); Assert.Equal(0x00, stub[16]); + // stub[17..21] = call rel32 + Assert.Equal(0xE8, stub[17]); + Assert.Equal(rel, BitConverter.ToUInt32(stub, 18)); + // stub[22..28] = add rsp, 0x28 + Assert.Equal([0x48, 0x81, 0xC4, 0x28, 0x00, 0x00, 0x00], stub[22..29]); + Assert.Equal(0xC3, stub[29]); // ret } [Fact] - public void X64_4args_rcx_rdx_r8_r9() + public void X64_4args_loads_rcx_rdx_r8_r9_as_64bit() { - var s=Create(); ulong a=0x100000000,t=0x123456788; - uint ca=(uint)a+5+5+6+6,r=(uint)(t-(ca+5)); - Assert.Equal([ - 0xB9,0x11,0x11,0x11,0x11, 0xBA,0x22,0x22,0x22,0x22, - 0x41,0xB8,0x33,0x33,0x33,0x33, 0x41,0xB9,0x44,0x44,0x44,0x44, - 0xE8,(byte)r,(byte)(r>>8),(byte)(r>>16),(byte)(r>>24),0xC3], - s.BuildCallStub((IntPtr)(nint)a,(IntPtr)(nint)t,[0x11111111,0x22222222,0x33333333,0x44444444],8,CallConvention.Cdecl)); + var s = Create(); + ulong a = 0x100000000, t = 0x123456788; + byte[] stub = s.BuildCallStub( + (IntPtr)(nint)a, (IntPtr)(nint)t, + [0x11111111u, 0x22222222u, 0x33333333u, 0x44444444u], 8, CallConvention.Cdecl); + + // K = 0x28. Total = sub(7) + 4×mov(40) + call(5) + add(7) + ret(1) = 60 + Assert.Equal(60, stub.Length); + + uint rel = (uint)(t - (a + 7 + 40 + 5)); // = t - a - 52 + + Assert.Equal([0x48, 0x81, 0xEC, 0x28, 0x00, 0x00, 0x00], stub[..7]); // sub rsp, 0x28 + + // mov rcx, 0x11111111 (48 B9 + 8 imm) at [7..16] + Assert.Equal(0x48, stub[7]); Assert.Equal(0xB9, stub[8]); + Assert.Equal(0x11, stub[9]); Assert.Equal(0x11, stub[10]); + Assert.Equal(0x11, stub[11]); Assert.Equal(0x11, stub[12]); + Assert.Equal(0x00, stub[13]); Assert.Equal(0x00, stub[14]); + Assert.Equal(0x00, stub[15]); Assert.Equal(0x00, stub[16]); + + // mov rdx, 0x22222222 (48 BA + 8 imm) at [17..26] + Assert.Equal(0x48, stub[17]); Assert.Equal(0xBA, stub[18]); + Assert.Equal(0x22, stub[19]); Assert.Equal(0x22, stub[20]); + Assert.Equal(0x22, stub[21]); Assert.Equal(0x22, stub[22]); + Assert.Equal(0x00, stub[23]); Assert.Equal(0x00, stub[24]); + Assert.Equal(0x00, stub[25]); Assert.Equal(0x00, stub[26]); + + // mov r8, 0x33333333 (49 B8 + 8 imm) at [27..36] + Assert.Equal(0x49, stub[27]); Assert.Equal(0xB8, stub[28]); + Assert.Equal(0x33, stub[29]); Assert.Equal(0x33, stub[30]); + Assert.Equal(0x33, stub[31]); Assert.Equal(0x33, stub[32]); + Assert.Equal(0x00, stub[33]); Assert.Equal(0x00, stub[34]); + Assert.Equal(0x00, stub[35]); Assert.Equal(0x00, stub[36]); + + // mov r9, 0x44444444 (49 B9 + 8 imm) at [37..46] + Assert.Equal(0x49, stub[37]); Assert.Equal(0xB9, stub[38]); + Assert.Equal(0x44, stub[39]); Assert.Equal(0x44, stub[40]); + Assert.Equal(0x44, stub[41]); Assert.Equal(0x44, stub[42]); + Assert.Equal(0x00, stub[43]); Assert.Equal(0x00, stub[44]); + Assert.Equal(0x00, stub[45]); Assert.Equal(0x00, stub[46]); + + // call rel32 at [47..51] + Assert.Equal(0xE8, stub[47]); + Assert.Equal(rel, BitConverter.ToUInt32(stub, 48)); + + // add rsp, 0x28 at [52..58] + Assert.Equal([0x48, 0x81, 0xC4, 0x28, 0x00, 0x00, 0x00], stub[52..59]); + // ret at [59] + Assert.Equal(0xC3, stub[59]); } [Fact] - public void X64_5args_push_cleanup() + public void X64_5args_places_first_stack_arg_in_shadow_plus_0x20() { - var s=Create(); ulong a=0x100000000,t=0x123456788; - uint ca=(uint)a+5+5+6+6+5,r=(uint)(t-(ca+5)); - Assert.Equal([ - 0xB9,1,0,0,0, 0xBA,2,0,0,0, - 0x41,0xB8,3,0,0,0, 0x41,0xB9,4,0,0,0, - 0x68,5,0,0,0, - 0xE8,(byte)r,(byte)(r>>8),(byte)(r>>16),(byte)(r>>24), - 0x48,0x83,0xC4,8, 0xC3], - s.BuildCallStub((IntPtr)(nint)a,(IntPtr)(nint)t,[1,2,3,4,5],8,CallConvention.Cdecl)); + var s = Create(); + ulong a = 0x100000000, t = 0x123456788; + byte[] stub = s.BuildCallStub( + (IntPtr)(nint)a, (IntPtr)(nint)t, + [(nuint)1, (nuint)2, (nuint)3, (nuint)4, (nuint)5], 8, CallConvention.Cdecl); + + // K = 0x20 + 1·8 = 0x28. Round-up rule: 0x28 % 16 = 8 → no extra padding. + // sub(7) + 4 reg moves (40) + stack arg (mov rax 10 + mov [rsp+0x20],rax 5 = 15) + // + call (5) + add (7) + ret (1) = 75 + Assert.Equal(75, stub.Length); + + Assert.Equal([0x48, 0x81, 0xEC, 0x28, 0x00, 0x00, 0x00], stub[..7]); // sub rsp, 0x28 (K=0x20+8=0x28, 0x28 % 16 = 8 ✓) + + // mov rcx, 1 at [7..16] + Assert.Equal(0x48, stub[7]); Assert.Equal(0xB9, stub[8]); + Assert.Equal(0x01, stub[9]); Assert.Equal(0x00, stub[10]); + Assert.Equal(0x00, stub[11]); Assert.Equal(0x00, stub[12]); + // mov rdx, 2 at [17..26] + Assert.Equal(0x48, stub[17]); Assert.Equal(0xBA, stub[18]); + Assert.Equal(0x02, stub[19]); + // mov r8, 3 at [27..36] + Assert.Equal(0x49, stub[27]); Assert.Equal(0xB8, stub[28]); + Assert.Equal(0x03, stub[29]); + // mov r9, 4 at [37..46] + Assert.Equal(0x49, stub[37]); Assert.Equal(0xB9, stub[38]); + Assert.Equal(0x04, stub[39]); + + // mov rax, 5 (48 B8 + 8-byte imm) at [47..56] + Assert.Equal(0x48, stub[47]); Assert.Equal(0xB8, stub[48]); + Assert.Equal(0x05, stub[49]); + for (int k = 50; k <= 56; k++) Assert.Equal(0x00, stub[k]); + + // mov [rsp + 0x20], rax (48 89 44 24 20) at [57..61] + Assert.Equal(0x48, stub[57]); Assert.Equal(0x89, stub[58]); + Assert.Equal(0x44, stub[59]); Assert.Equal(0x24, stub[60]); + Assert.Equal(0x20, stub[61]); + + // call rel32 at [62..66]; distance = t - (a + 62 + 5) = t - a - 67 + uint rel = (uint)(t - (a + 62 + 5)); + Assert.Equal(0xE8, stub[62]); + Assert.Equal(rel, BitConverter.ToUInt32(stub, 63)); + + // add rsp, 0x28 at [67..73] + Assert.Equal([0x48, 0x81, 0xC4, 0x28, 0x00, 0x00, 0x00], stub[67..74]); + // ret at [74] + Assert.Equal(0xC3, stub[74]); + } + + [Fact] + public void X64_frame_alignment_property_for_arg_counts() + { + // ABI invariant: for every arg count the sub operand K must satisfy + // K ≡ 8 (mod 16), and the same K must appear in the matching 'add rsp, K' + // just before the ret. Violating this misaligns the inner call, which + // #GP-faults the next time an SSE-using callee executes movaps/movdqa. + var s = Create(); + // Keep stub/target within E8 rel32 range (< 2 GiB) so the property check + // exercises the frame math, not the distance guard. + ulong a = 0x140000000, t = 0x140100000; + + for (int argc = 0; argc <= 12; argc++) + { + nuint[] args = new nuint[argc]; + for (int i = 0; i < argc; i++) args[i] = (nuint)(i + 1); + + byte[] stub = s.BuildCallStub( + (IntPtr)(nint)a, (IntPtr)(nint)t, args, 8, CallConvention.Cdecl); + + // sub rsp, imm32: 48 81 EC K0 K1 K2 K3 + Assert.Equal(0x48, stub[0]); + Assert.Equal(0x81, stub[1]); + Assert.Equal(0xEC, stub[2]); + uint subK = BitConverter.ToUInt32(stub, 3); + Assert.True(subK % 16 == 8, + $"argc={argc}: sub K=0x{subK:X} must satisfy K % 16 == 8"); + + // add rsp, imm32 is 7 bytes immediately before the trailing C3 + int last = stub.Length - 1; + Assert.Equal(0xC3, stub[last]); + int addIdx = last - 7; + Assert.Equal(0x48, stub[addIdx]); + Assert.Equal(0x81, stub[addIdx + 1]); + Assert.Equal(0xC4, stub[addIdx + 2]); + uint addK = BitConverter.ToUInt32(stub, addIdx + 3); + Assert.True(subK == addK, + $"argc={argc}: add K=0x{addK:X} must match sub K=0x{subK:X}"); + } + } + + [Fact] + public void X64_6args_frame_grows_to_0x38() + { + // Six args: frameBytes = 0x20 + 2·8 = 0x30. 0x30 % 16 = 0, so the + // pad-to-≡8 rule adds 8 more bytes → K = 0x38. Args 5 and 6 still live + // at [rsp+0x20] and [rsp+0x28]; the extra 8 bytes of padding at [rsp+0x30] + // are unused but necessary for alignment. + var s = Create(); + ulong a = 0x100000000, t = 0x123456788; + nuint[] args = [(nuint)1, (nuint)2, (nuint)3, (nuint)4, (nuint)5, (nuint)6]; + byte[] stub = s.BuildCallStub( + (IntPtr)(nint)a, (IntPtr)(nint)t, args, 8, CallConvention.Cdecl); + + // sub rsp, 0x38 (7 bytes) + Assert.Equal([0x48, 0x81, 0xEC, 0x38, 0x00, 0x00, 0x00], stub[..7]); + + // add rsp, 0x38 occupies the 7 bytes immediately before ret + int addIdx = stub.Length - 8; + Assert.Equal([0x48, 0x81, 0xC4, 0x38, 0x00, 0x00, 0x00], stub[addIdx..(addIdx + 7)]); + Assert.Equal(0xC3, stub[stub.Length - 1]); + } + + [Fact] + public void X64_full_64bit_args_are_preserved_not_truncated() + { + // The bug this catches: an earlier stub emitted "mov r32d, imm32" which zero-extended + // a 32-bit immediate into the lower half of the 64-bit register, silently dropping + // the high bits of any pointer-sized argument above 4 GiB. + var s = Create(); + ulong a = 0x100000000, t = 0x123456788; + nuint wideArg = unchecked((nuint)0xDEADBEEF_CAFEBABEUL); + byte[] stub = s.BuildCallStub( + (IntPtr)(nint)a, (IntPtr)(nint)t, [wideArg], 8, CallConvention.Cdecl); + + // The 8-byte immediate for arg0 lives inside `mov rcx, imm64` at bytes [9..16]. + ulong read = BitConverter.ToUInt64(stub, 9); + Assert.Equal(0xDEADBEEF_CAFEBABEul, read); + } + + [Fact] + public void X86_target_rejects_arg_value_larger_than_32_bits() + { + if (!Environment.Is64BitProcess) + { + // On a 32-bit host, nuint cannot exceed uint.MaxValue — the precondition + // cannot be exercised. Mark the test as an intentional no-op. + Assert.True(true); + return; + } + + var s = Create(); + nuint tooBig = unchecked((nuint)0x1_00000000UL); + Assert.Throws(() => + s.BuildCallStub((IntPtr)0x10000000, (IntPtr)0x12345678, [tooBig], 4, CallConvention.Cdecl)); } // ── Edge cases ──────────────────────────────────────────────────────── @@ -193,8 +413,9 @@ public class StubAssemblerTests [Fact] public void Many_args_cleanup_uses_imm32_form() { - var args = new uint[33]; - for (int i = 0; i < 33; i++) args[i] = (uint)(i * 0x10000 + i); + // x86 path: 33 args, stack cleanup > 127 bytes → must emit add esp, imm32 (81 C4) + var args = new nuint[33]; + for (int i = 0; i < 33; i++) args[i] = (nuint)(uint)(i * 0x10000 + i); byte[] stub = Create().BuildCallStub( (IntPtr)0x10000000, (IntPtr)0x12345678, args, 4, CallConvention.Cdecl);