What is an Access Violation?
An access violation (AV) occurs when the program performs and action on a memory address that does not align with the page protection for that memory.
3 common types:
- Execute from non-executable
In order to determine the cause for the AV, you first need to know which type you are dealing with. With both the read and write scenario, you evaluate the address that is referenced and try to figure out why the address got to be in such a state that would cause an AV.
The most common AV pattern will be a read or write to address 0 (zero). A common programming issue involves several scenarios where the programmer expects a value to be a valid address, but for whatever reason it did not get set properly (e.g. a function failed and returned 0 instead of the expected value). In order to address this common mistake, the OS sets the first page of memory in each process up as a trap (think big metal thing to catch an animal) to catch this issue. The trap is created by marking the first page of memory in each process, address 0, to be NO_ACCESS.
Reference: Reserved Virtual Address Ranges
0:001> !address 0
Base Address: 00000000
End Address: 00010000
Region Size: 00010000
State: 00010000 MEM_FREE
Protect: 00000001 PAGE_NOACCESS <--- We can see the page protection on this address is NO ACCESS
Type: <info not present at the target>
Execute from non-executable (DEP - Data Execution Prevention)
Another AV can occur if the instruction pointer is ever set to memory that does not include the option to enable execution.
Reference: Data Execution Prevention (Wikipedia)
If we look at the exception record, we see it was a DEP access violation
0:034> .exr -1
ExceptionCode: c0000005 (Access violation)
Attempt to execute non-executable address 00610524
In this case, we don't look at the failing instruction, we focus on the fact that EIP was set to a value that did not have the execute flag.
eax=00000000 ebx=00610000 ecx=0182ffb4 edx=7c82ed54 esi=00000000 edi=00000000
eip=00610524 esp=0182ffbc ebp=0182ffec iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
00610524 55 push ebp
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0182ffb8 77e6608b 00610000 00000000 00000000 0x610524
0182ffec 00000000 00610524 00610000 00000000 kernel32!BaseThreadStart+0x34
0:034> !address 00610524
Base Address: 00610000
End Address: 00611000
Region Size: 00001000
State: 00001000 MEM_COMMIT
Protect: 00000004 PAGE_READWRITE <-- does not include execute
Type: 00020000 MEM_PRIVATE
Allocation Base: 00610000
Allocation Protect: 00000004 PAGE_READWRITE
Compare this page protect to that of a Windows function
0:034> !x kernel32!ReportEventW
0:034> !address 77ec0285
Base Address: 77e41000
End Address: 77ecb000
Region Size: 0008a000
State: 00001000 MEM_COMMIT
Protect: 00000020 PAGE_EXECUTE_READ <-- does include execute
Type: 01000000 MEM_IMAGE
Allocation Base: 77e40000
Allocation Protect: 00000080 PAGE_EXECUTE_WRITECOPY
Image Path: C:\WINDOWS\system32\kernel32.dll
Module Name: kernel32
Loaded Image Name: kernel32.dll