通过Unsafe导致EXCEPTION_ACCESS_VIOLATION修改内存

时间:2014-05-17 08:49:33

标签: java access-violation

首先,我知道我不应该在阳光下使用任何东西。*包但这是供个人使用。

好的,所以我的main方法创建了一个长度为10的字符串

public static void main(String[] args)
    {
        String someString = "aaaaaaaaaa";

        MemoryEditor.eraseStringFromMemory(someString);
    }

并且通过方法名称,它是自我解释的,我试图从内存中“擦除”它。

所以我的问题是它可以在一台PC上工作但不能在另一台PC上工作

PC A(不起作用)

  • 操作系统Windows 8.1 64位
  • Java SE运行时环境(7.0_55-b13)(构建 1.7.0_55-B13)

PC B(工作)

  • 操作系统Windows 8.1 64位
  • Java SE运行时环境(7.0_55-b13)(版本1.7.0_55-b13)

以下代码输出

Trying to erase address: 0xf005cb98 With size of: 24B 
Base offset: 16
Contents: aaaaaaaaaa 
Expected value: xxxxxxxxxx, Recieved: xxxxxxxxxx

转储日志位于帖子的最底部。

与MemoryEditor.eraseStringFromMemory(String)相关的代码

private static sun.misc.Unsafe unsafe;

    private static final sun.misc.Unsafe getUnsafe()
    {
        return unsafe;
    }

    static
    {
        try
        {
            Field f = sun.misc.Unsafe.class.getDeclaredField("theUnsafe");
            f.setAccessible(true);
            unsafe = (sun.misc.Unsafe) f.get(null);
        }
        catch (NoSuchFieldException | SecurityException | IllegalArgumentException | IllegalAccessException e)
        {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }

public static void eraseStringFromMemory(String string)
    {
        try
        {
            String fake = new String(string.replaceAll(".", "x"));

            long address = toAddress(string);
            long size = sizeOf(string);

            System.out.println("Trying to erase address: 0x" + Long.toHexString(address) + " With size of: " + size + "B");
            System.out.println("Base offset: " + toBaseOffset(string));
            System.out.println("Contents: " + string);
            getUnsafe().copyMemory(fake, 0L, null, address, size);// fatal EXCEPTION_ACCESS_VIOLATION

            System.out.println("Expected value: " + fake + ", Recieved: " + string); 

            Field stringValue = String.class.getDeclaredField("value");

            stringValue.setAccessible(true);
            char[] mem = (char[]) stringValue.get(string);
            for (int i = 0; i < mem.length; i++)
            {
                mem[i] = '?';
            }
        }
        catch (NoSuchFieldException | SecurityException e)
        {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        catch (IllegalArgumentException | IllegalAccessException e)
        {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }

static long toAddress(Object obj)
    {
        Object[] array = new Object[]
        {
                obj
        };
        long baseOffset = getUnsafe().arrayBaseOffset(Object[].class);
        return normalize(getUnsafe().getInt(array, baseOffset));
    }

public static long sizeOf(Object o)
    {
        HashSet<Field> fields = new HashSet<Field>();
        Class c = o.getClass();
        while (c != Object.class)
        {
            for (Field f : c.getDeclaredFields())
            {
                if ((f.getModifiers() & Modifier.STATIC) == 0)
                {
                    fields.add(f);
                }
            }
            c = c.getSuperclass();
        }

        // get offset
        long maxSize = 0;
        for (Field f : fields)
        {
            long offset = getUnsafe().objectFieldOffset(f);
            if (offset > maxSize)
            {
                maxSize = offset;
            }
        }

        return ((maxSize / 8) + 1) * 8;   // padding
    }

错误日志:

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x000000005aaebb2b, pid=2448, tid=43896
#
# JRE version: Java(TM) SE Runtime Environment (7.0_55-b13) (build 1.7.0_55-b13)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (24.55-b03 mixed mode windows-amd64 compressed oops)
# Problematic frame:
# V  [jvm.dll+0x1ebb2b]
#
# Failed to write core dump. Minidumps are not enabled by default on client versions of Windows
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.sun.com/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread (0x00000000020d0800):  JavaThread "main" [_thread_in_vm, id=43896, stack(0x0000000001ed0000,0x0000000001fd0000)]

siginfo: ExceptionCode=0xc0000005, writing address 0x00000000f00a13b6

Registers:
RAX=0x0000000000000005, RBX=0x00000000020d0800, RCX=0x00000006904744b2, RDX=0x00000000f00a13b8
RSP=0x0000000001fcf5a8, RBP=0x0000000780515868, RSI=0x0000000000000018, RDI=0x0000000000000000
R8 =0x000000000000000b, R9 =0x00000000f00a13b6, R10=0x00000000021e3064, R11=0x000000005aadfc90
R12=0x0000000000000000, R13=0x000000067bcf0ff8, R14=0x0000000001fcf700, R15=0x00000000020d0800
RIP=0x000000005aaebb2b, EFLAGS=0x0000000000010202

Top of Stack: (sp=0x0000000001fcf5a8)
0x0000000001fcf5a8:   000000005aaaef20 00000000021d60f8
0x0000000001fcf5b8:   00000000021e2f19 0000000001fcf6c0
0x0000000001fcf5c8:   00000000020d0800 000000067bcf0ff8
0x0000000001fcf5d8:   0000000000000000 0000000000000000
0x0000000001fcf5e8:   00000000021e3090 00000000021d60f8
0x0000000001fcf5f8:   000000067bcf0ff8 0000000001fcf6a0
0x0000000001fcf608:   00000000cf7b6749 0000000000000000
0x0000000001fcf618:   00000000f00a13b6 0000000000000018
0x0000000001fcf628:   000000067bf183b3 00000000000000b6
0x0000000001fcf638:   00000000020d0c58 00000000020cee08
0x0000000001fcf648:   000000067bd31088 00000000020d0800
0x0000000001fcf658:   0000000001fcf798 0000000001fcf660
0x0000000001fcf668:   000000067bcf0ff8 0000000001fcf700
0x0000000001fcf678:   000000067bcf3bf0 0000000000000000
0x0000000001fcf688:   000000067bcf0ff8 0000000000000000
0x0000000001fcf698:   0000000001fcf6c0 0000000001fcf748 

Instructions: (pc=0x000000005aaebb2b)
0x000000005aaebb0b:   25 70 9a 36 00 48 3b ca 76 1e 4d 85 c0 74 48 48
0x000000005aaebb1b:   2b ca 0f 1f 00 0f b7 04 11 48 83 c2 02 49 ff c8
0x000000005aaebb2b:   66 89 42 fe 75 ef f3 c3 4e 8d 4c 41 fe 4a 8d 4c
0x000000005aaebb3b:   42 fe 4d 85 c0 74 20 4c 2b c9 66 66 66 0f 1f 84 


Register to memory mapping:

RAX=0x0000000000000005 is an unknown value
RBX=0x00000000020d0800 is a thread
RCX=
[error occurred during error reporting (printing register info), id 0xc0000005]

Stack: [0x0000000001ed0000,0x0000000001fd0000],  sp=0x0000000001fcf5a8,  free space=1021k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [jvm.dll+0x1ebb2b]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  sun.misc.Unsafe.copyMemory(Ljava/lang/Object;JLjava/lang/Object;JJ)V+0
j  com.jordan30001.unsafe.MemoryEditor.eraseStringFromMemory(Ljava/lang/String;)V+123
j  zPictureStuff.Main.main([Ljava/lang/String;)V+17
v  ~StubRoutines::call_stub

---------------  P R O C E S S  ---------------

Java Threads: ( => current thread )
  0x00000000021c8800 JavaThread "Service Thread" daemon [_thread_blocked, id=53908, stack(0x0000000016f10000,0x0000000017010000)]
  0x00000000021c7000 JavaThread "C2 CompilerThread1" daemon [_thread_blocked, id=35844, stack(0x0000000016e10000,0x0000000016f10000)]
  0x00000000021c0000 JavaThread "C2 CompilerThread0" daemon [_thread_blocked, id=23120, stack(0x0000000016d10000,0x0000000016e10000)]
  0x00000000021bd000 JavaThread "Attach Listener" daemon [_thread_blocked, id=65172, stack(0x0000000016c10000,0x0000000016d10000)]
  0x00000000021bc800 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=37524, stack(0x0000000016b10000,0x0000000016c10000)]
  0x00000000140bf000 JavaThread "Finalizer" daemon [_thread_blocked, id=62056, stack(0x0000000016a10000,0x0000000016b10000)]
  0x00000000140b4000 JavaThread "Reference Handler" daemon [_thread_blocked, id=38312, stack(0x0000000016910000,0x0000000016a10000)]
=>0x00000000020d0800 JavaThread "main" [_thread_in_vm, id=43896, stack(0x0000000001ed0000,0x0000000001fd0000)]

Other Threads:
  0x00000000140b1800 VMThread [stack: 0x0000000016810000,0x0000000016910000] [id=12864]
  0x00000000021ca800 WatcherThread [stack: 0x0000000017010000,0x0000000017110000] [id=59456]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
 PSYoungGen      total 114688K, used 1966K [0x0000000780480000, 0x0000000788480000, 0x0000000800000000)
  eden space 98304K, 2% used [0x0000000780480000,0x000000078066b8c0,0x0000000786480000)
  from space 16384K, 0% used [0x0000000787480000,0x0000000787480000,0x0000000788480000)
  to   space 16384K, 0% used [0x0000000786480000,0x0000000786480000,0x0000000787480000)
 ParOldGen       total 261120K, used 0K [0x0000000680e00000, 0x0000000690d00000, 0x0000000780480000)
  object space 261120K, 0% used [0x0000000680e00000,0x0000000680e00000,0x0000000690d00000)
 PSPermGen       total 21504K, used 3201K [0x000000067bc00000, 0x000000067d100000, 0x0000000680e00000)
  object space 21504K, 14% used [0x000000067bc00000,0x000000067bf20608,0x000000067d100000)

Card table byte_map: [0x00000000051d0000,0x0000000005e00000] byte_map_base: 0x0000000001df2000

Polling page: 0x0000000001d90000

Code Cache  [0x00000000021d0000, 0x0000000002440000, 0x00000000051d0000)
 total_blobs=178 nmethods=0 adapters=146 free_code_cache=48767Kb largest_free_block=49937408

Compilation events (0 events):
No events

GC Heap History (0 events):
No events

Deoptimization events (0 events):
No events

Internal exceptions (7 events):
Event: 0.029 Thread 0x00000000020d0800 Threw 0x000000078048b750 at C:\re\jdk7u55\869\hotspot\src\share\vm\prims\jni.cpp:3991
Event: 0.063 Thread 0x00000000020d0800 Threw 0x00000007804d2a28 at C:\re\jdk7u55\869\hotspot\src\share\vm\prims\jvm.cpp:1244
Event: 0.075 Thread 0x00000000020d0800 Threw 0x00000007804f78d0 at C:\re\jdk7u55\869\hotspot\src\share\vm\prims\jvm.cpp:1244
Event: 0.075 Thread 0x00000000020d0800 Threw 0x00000007804f79f8 at C:\re\jdk7u55\869\hotspot\src\share\vm\prims\jvm.cpp:1244
Event: 0.075 Thread 0x00000000020d0800 Threw 0x00000007804faf30 at C:\re\jdk7u55\869\hotspot\src\share\vm\prims\jvm.cpp:1244
Event: 0.075 Thread 0x00000000020d0800 Threw 0x00000007804fb058 at C:\re\jdk7u55\869\hotspot\src\share\vm\prims\jvm.cpp:1244
Event: 8.858 Thread 0x00000000020d0800 Threw 0x000000078050a2b8 at C:\re\jdk7u55\869\hotspot\src\share\vm\prims\jvm.cpp:1244

Events (10 events):
Event: 8.860 loading class 0x0000000002147260
Event: 8.860 loading class 0x0000000002147260 done
Event: 8.860 loading class 0x000000001580a950
Event: 8.860 loading class 0x000000001580ac70
Event: 8.861 loading class 0x000000001580ac70 done
Event: 8.861 loading class 0x000000001580a950 done
Event: 8.861 loading class 0x000000000214fa90
Event: 8.861 loading class 0x000000000214fa90 done
Event: 8.861 loading class 0x000000000214fa60
Event: 8.861 loading class 0x000000000214fa60 done


Dynamic libraries:
0x00007ff6d4e40000 - 0x00007ff6d4e73000     C:\Windows\system32\java.exe
0x00007ffd5fc20000 - 0x00007ffd5fdc9000     C:\WINDOWS\SYSTEM32\ntdll.dll
0x00007ffd5e240000 - 0x00007ffd5e379000     C:\WINDOWS\system32\KERNEL32.DLL
0x00007ffd5c3f0000 - 0x00007ffd5c4fe000     C:\WINDOWS\system32\KERNELBASE.dll
0x00007ffd5ad50000 - 0x00007ffd5addb000     C:\WINDOWS\system32\apphelp.dll
0x00007ffd484b0000 - 0x00007ffd484ff000     C:\WINDOWS\AppPatch\AppPatch64\AcGenral.DLL
0x00007ffd5e840000 - 0x00007ffd5e8e7000     C:\WINDOWS\system32\msvcrt.dll
0x00007ffd5bff0000 - 0x00007ffd5c01b000     C:\Windows\system32\SspiCli.dll
0x00007ffd5e8f0000 - 0x00007ffd5e941000     C:\WINDOWS\system32\SHLWAPI.dll
0x00007ffd5ebb0000 - 0x00007ffd5ed21000     C:\WINDOWS\system32\USER32.dll
0x00007ffd5c650000 - 0x00007ffd5c7c6000     C:\WINDOWS\system32\ole32.dll
0x00007ffd5c830000 - 0x00007ffd5dc40000     C:\WINDOWS\system32\SHELL32.dll
0x00007ffd5b7d0000 - 0x00007ffd5b7ef000     C:\Windows\system32\USERENV.dll
0x00007ffd5ddf0000 - 0x00007ffd5de95000     C:\WINDOWS\system32\ADVAPI32.dll
0x00007ffd54830000 - 0x00007ffd5484b000     C:\Windows\system32\MPR.dll
0x00007ffd5e3d0000 - 0x00007ffd5e506000     C:\WINDOWS\system32\RPCRT4.dll
0x00007ffd5c7d0000 - 0x00007ffd5c827000     C:\WINDOWS\SYSTEM32\sechost.dll
0x00007ffd5df00000 - 0x00007ffd5e0d7000     C:\WINDOWS\SYSTEM32\combase.dll
0x00007ffd5dca0000 - 0x00007ffd5dde5000     C:\WINDOWS\system32\GDI32.dll
0x00007ffd5c140000 - 0x00007ffd5c154000     C:\Windows\system32\profapi.dll
0x00007ffd5a750000 - 0x00007ffd5a7f1000     C:\Windows\system32\SHCORE.dll
0x00007ffd5e380000 - 0x00007ffd5e3b4000     C:\WINDOWS\system32\IMM32.DLL
0x00007ffd5e520000 - 0x00007ffd5e658000     C:\WINDOWS\system32\MSCTF.dll
0x00007ffd59ec0000 - 0x00007ffd5a11a000     C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\COMCTL32.dll
0x000000005b8b0000 - 0x000000005b982000     F:\Program Files\Java\jre7\bin\msvcr100.dll
0x000000005a900000 - 0x000000005b0c9000     F:\Program Files\Java\jre7\bin\server\jvm.dll
0x00007ffd58320000 - 0x00007ffd58329000     C:\Windows\system32\WSOCK32.dll
0x00007ffd58450000 - 0x00007ffd5846f000     C:\Windows\system32\WINMM.dll
0x00007ffd5e3c0000 - 0x00007ffd5e3c7000     C:\WINDOWS\system32\PSAPI.DLL
0x00007ffd5dc40000 - 0x00007ffd5dc98000     C:\WINDOWS\system32\WS2_32.dll
0x00007ffd58410000 - 0x00007ffd5843a000     C:\Windows\system32\WINMMBASE.dll
0x00007ffd5e230000 - 0x00007ffd5e239000     C:\WINDOWS\system32\NSI.dll
0x00007ffd5c600000 - 0x00007ffd5c64a000     C:\WINDOWS\SYSTEM32\cfgmgr32.dll
0x00007ffd5afc0000 - 0x00007ffd5afe6000     C:\Windows\system32\DEVOBJ.dll
0x000000005b610000 - 0x000000005b61f000     F:\Program Files\Java\jre7\bin\verify.dll
0x000000005b5e0000 - 0x000000005b608000     F:\Program Files\Java\jre7\bin\java.dll
0x000000005b5c0000 - 0x000000005b5d5000     F:\Program Files\Java\jre7\bin\zip.dll
0x00007ffd4ce00000 - 0x00007ffd4cf88000     C:\Windows\system32\dbghelp.dll

VM Arguments:
java_command: run.jar
Launcher Type: SUN_STANDARD

Environment Variables:
PATH=F:\Python33\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;F:\Program Files (x86)\QT Lite\QTSystem;C:\ProgramData\Razer\SwitchBlade\SDK;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;F:\Program Files (x86)\Gource\cmd;C:\Users\JLT\AppData\Local\GitHub\PortableGit_0f65d050d0c352fd38a0b25d82ee942deb19ef87\bin;C:\Users\JLT\AppData\Local\GitHub\PortableGit_0f65d050d0c352fd38a0b25d82ee942deb19ef87\cmd;C:\Program Files\Microsoft\Web Platform Installer\;C:\Program Files (x86)\Microsoft ASP.NET\ASP.NET Web Pages\v1.0\;C:\Program Files (x86)\Windows Kits\8.0\Windows Performance Toolkit\;C:\Program Files\Microsoft SQL Server\110\Tools\Binn\;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;F:\Program Files\NodeJS\;C:\Users\JLT\AppData\Roaming\npm
USERNAME=JLT
OS=Windows_NT
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 45 Stepping 7, GenuineIntel



---------------  S Y S T E M  ---------------

OS: Windows 8.1 , 64 bit Build 9600 

CPU:total 12 (6 cores per cpu, 2 threads per core) family 6 model 45 stepping 7, cmov, cx8, fxsr, mmx, sse, sse2, sse3, ssse3, sse4.1, sse4.2, popcnt, avx, aes, ht, tsc, tscinvbit, tscinv

Memory: 4k page, physical 25106112k(19125752k free), swap 29202112k(20782980k free)

vm_info: Java HotSpot(TM) 64-Bit Server VM (24.55-b03) for windows-amd64 JRE (1.7.0_55-b13), built on Mar 17 2014 19:45:30 by "java_re" with unknown MS VC++:1600

time: Sat May 17 09:17:24 2014
elapsed time: 8 seconds

0 个答案:

没有答案