AccessViolationException

[jaerith]

I'm attempting to use the library via a simple example:

YSInstance YSInstance = new YSInstance();

Dictionary<string, object> CONST_YS_EXTERNAL_VALUES = 
            new Dictionary<string, object>()
                {
                    { "filename", string.Empty },
                    { "filepath", string.Empty },
                    { "extension", string.Empty }
                };

//	Get list of YARA rules
List<string> ruleFilenames = 
                    Directory.GetFiles(@"F:\Configuration\Yara", "*.yara", SearchOption.AllDirectories).ToList();

YSRules reviewRules = null;

using (YSContext context = new YSContext())
{
    //	Compiling rules
    using (YSCompiler compiler = YSInstance.CompileFromFiles(ruleFilenames, CONST_YS_EXTERNAL_VALUES))
    {
        //  Get compiled rules
        reviewRules = compiler.GetRules();

        YSReport errors = compiler.GetErrors();
        YSReport warnings = compiler.GetWarnings();
    }
}

string[] list = new string[] { "Flare", "Something", "blah blah", "offensive" };
foreach (var TmpVal in list)
{
    byte[] commTextBytes = ASCIIEncoding.ASCII.GetBytes(TmpVal);

    List<YSMatches> Matches =
        YSInstance.ScanMemory(commTextBytes,
                                                  poReviewRules,
                                                  CONST_YS_EXTERNAL_VALUES,
                                                  1000);
}

But when I call "ScanMemory()", I get the following result:

System.AccessViolationException: 'Attempted to read or write protected memory. This is often an indication that other memory is corrupt.'

Have you seen this before?

[jaerith]

No worries. Thanks for the quick response!

I should mention that I'm a newb with the Yara stuff, and I was just trying different libraries, in order to get a feel for what's out there. In truth, I haven't installed Yara on my system yet or built the C++ library yet. I just pulled down the Nuget package and started calling the APIs to become more familiar with it. In fact, I assume that the AccessViolationException could be a result of not having the actual Yara library/executable installed on my machine. So, there's a chance that this is all my fault. :)

[AdamWhiteHat]

Have you seen this before?

Yeah, you're calling ScanMemory outside of your using statement: using (YSContext context = new YSContext()) { ... }

Your YSContext is already disposed of by then!

Try moving YSInstance.ScanMemory(...) to inside the curly braces.

[ChrisDavies-MSFT]

Yup, that's the answer! I'm sorry I never came back to this! FYI, at some point I plan to start a new repo and upgrade to V4. Unfortunately, StellarBear is no longer working on this project :(