23

Platform Interoperability and Unsafe Code

C# has great capabilities, especially when you consider that the underlying framework is entirely managed. Sometimes, however, you need to escape out of all the safety that C# provides and step back into the world of memory addresses and pointers. C# supports this action in two significant ways. The first option is to go through Platform Invoke (P/Invoke) and calls into APIs exposed by unmanaged dynamic link libraries (DLLs). The second way is through unsafe code, which enables access to memory pointers and addresses.

The majority of the chapter discusses interoperability with unmanaged code and the use of unsafe code. This discussion culminates with a small program that determines the processor ID of a computer. The code requires that you do the following:

1.
Call into an operating system DLL and request allocation of a portion of memory for executing instructions.
2.
Write some assembler instructions into the allocated area.
3.
Inject an address location into the assembler instructions.
4.
Execute the assembler code.

Aside from the P/Invoke and unsafe constructs covered here, the complete listing demonstrates the full power of C# and the fact that the capabilities of unmanaged code are still accessible from C# and managed code.

Platform Invoke

Whether a developer is trying to call a library of existing unmanaged code, accessing unmanaged code in the operating system not exposed in any managed API, or trying to achieve maximum performance for an algorithm by avoiding the runtime overhead of type checking and garbage collection, at some point there must be a call into unmanaged code. The Common Language Infrastructure (CLI) provides this capability through P/Invoke. With P/Invoke, you can make API calls into exported functions of unmanaged DLLs.

The APIs invoked in this section are Windows APIs. Although the same APIs are not available on other platforms, developers can still use P/Invoke for APIs native to their operating systems or for calls into their own DLLs. The guidelines and syntax are the same.

Declaring External Functions

Once the target function is identified, the next step of P/Invoke is to declare the function with managed code. Just as with all regular methods that belong to a class, you need to declare the targeted API within the context of a class, but by using the extern modifier. Listing 23.1 demonstrates how to do this.

Listing 23.1: Declaring an External Method
1. using System;
2. using System.Runtime.InteropServices;
3. public class VirtualMemoryManager
4. {
5.     [DllImport("kernel32.dll", EntryPoint = "GetCurrentProcess")]
6.     internal static extern IntPtr GetCurrentProcessHandle();
7. }

In this case, the class is VirtualMemoryManager, because it will contain functions associated with managing memory. (This particular function is available directly off the System.Diagnostics.Processor class, so there is no need to declare it in real code.) Note that the method returns an IntPtr; this type is explained in the next section.

The extern methods never include any body and are (almost) always static. Instead of a method body, the DllImport attribute, which accompanies the method declaration, points to the implementation. At a minimum, the attribute needs the name of the DLL that defines the function. The runtime determines the function name from the method name, although you can override this default by using the EntryPoint named parameter to provide the function name. (The .NET framework will automatically attempt calls to the Unicode [...W] or ASCII [...A] API version.)

In this case, the external function, GetCurrentProcess(), retrieves a pseudohandle for the current process that you will use in the call for virtual memory allocation. Here’s the unmanaged declaration:

HANDLE GetCurrentProcess();

Parameter Data Types

Assuming the developer has identified the targeted DLL and exported function, the most difficult step is identifying or creating the managed data types that correspond to the unmanaged types in the external function.1 Listing 23.2 shows a more difficult API.

Listing 23.2: The VirtualAllocEx() API
1. LPVOID VirtualAllocEx(
2.     HANDLE hProcess,        // The handle to a process. The
3.                             // function allocates memory within
4.                             // the virtual address space of this
5.                             // process.
6.     LPVOID lpAddress,       // The pointer that specifies a
7.                             // desired starting address for the
8.                             // region of pages that you want to
9.                             // allocate. If lpAddress is NULL,
10.                             // the function determines where to
11.                             // allocate the region.
12.     SIZE_T dwSize,          // The size of the region of memory to
13.                             // allocate, in bytes. If lpAddress
14.                             // is NULL, the function rounds dwSize
15.                             // up to the next page boundary.
16.     DWORD flAllocationType, // The type of memory allocation
17.     DWORD flProtect);       // The type of memory allocation

VirtualAllocEx() allocates virtual memory that the operating system specifically designates for execution or data. To call it, you need corresponding definitions in managed code for each data type; although common in Win32 programming, HANDLE, LPVOID, SIZE_T, and DWORD are undefined in the CLI managed code. The declaration in C# for VirtualAllocEx(), therefore, is shown in Listing 23.3.

Listing 23.3: Declaring the VirtualAllocEx() API in C#
1. using System;
2. using System.Runtime.InteropServices;
3.  
4. public class VirtualMemoryManager
5. {
6.     [DllImport("kernel32.dll")]
7.     internal static extern IntPtr GetCurrentProcess();
8.  
9.     [DllImport("kernel32.dll", SetLastError = true)]
10.     private static extern IntPtr VirtualAllocEx(
11.         IntPtr hProcess,
12.         IntPtr lpAddress,
13.         IntPtr dwSize,
14.         AllocationType flAllocationType,
15.         uint flProtect);
16. }

One distinct characteristic of managed code is that primitive data types such as int do not change their size on the basis of the processor. Whether the processor is 32 or 64 bits, int is always 32 bits. In unmanaged code, however, memory pointers will vary depending on the processor. Therefore, instead of mapping types such as HANDLE and LPVOID simply to ints, you need to map to System.IntPtr, whose size will vary depending on the processor memory layout. This example also uses an AllocationType enum, which we discuss in the section “Simplifying API Calls with Wrappers” later in this chapter.

An interesting point to note about Listing 23.3 is that IntPtr is useful for more than just pointers—that is, it is useful for other things such as quantities. IntPtr does not mean just “pointer stored in an integer”; it also means “integer that is the size of a pointer.” An IntPtr need not contain a pointer but simply needs to contain something the size of a pointer. Lots of things are the size of a pointer but are not actually pointers.

Native sized integers

C# 9.0 introduced new contextual keywords, nint and nunit that represent native machine-size integers. These are both signed integers that will either be 32 or 64 bits depending on the running process. Internally nint and nuint are implemented with System.IntPtr and System.UIntPtr. In C# 11 these are updated to simply be aliases for the types they represent.

Using ref Rather Than Pointers

Frequently, unmanaged code uses pointers for pass-by-reference parameters. In these cases, P/Invoke doesn’t require that you map the data type to a pointer in managed code. Instead, you map the corresponding parameters to ref (or out, depending on whether the parameter is in/out or just out). In Listing 23.4, lpflOldProtect, whose data type is PDWORD, returns the “pointer to a variable that receives the previous access protection of the first page in the specified region of pages.”2

Listing 23.4: Using ref and out Rather Than Pointers
1. public class VirtualMemoryManager
2. {
3.     // ...
4.     [DllImport("kernel32.dll", SetLastError = true)]
5.     static extern bool VirtualProtectEx(
6.         IntPtr hProcess, IntPtr lpAddress,
7.         IntPtr dwSize, uint flNewProtect,
8.         ref uint lpflOldProtect);
9. }

Although lpflOldProtect is documented as [out] (even though the signature doesn’t enforce it), the description also mentions that the parameter must point to a valid variable and not NULL. This inconsistency is confusing but commonly encountered. The guideline is to use ref rather than out for P/Invoke type parameters, since the callee can always ignore the data passed with ref, but the converse will not necessarily succeed.

The other parameters are virtually the same as VirtualAllocEx() except that lpAddress is the address returned from VirtualAllocEx(). In addition, flNewProtect specifies the exact type of memory protection: page execute, page read-only, and so on.

Using StructLayoutAttribute for Sequential Layout

Some APIs involve types that have no corresponding managed type. Calling these types requires redeclaration of the type in managed code. You declare the unmanaged COLORREF struct, for example, in managed code (see Listing 23.5).

Listing 23.5: Declaring Types from Unmanaged Structs
1. [StructLayout(LayoutKind.Sequential)]
2. struct ColorRef
3. {
4.     public byte Red;
5.     public byte Green;
6.     public byte Blue;
7.     // Turn off the warning about not accessing Unused
8. #pragma warning disable 414
9.     private byte Unused;
10. #pragma warning restore 414
11.  
12.     public ColorRef(byte red, byte green, byte blue)
13.     {
14.         Blue = blue;
15.         Green = green;
16.         Red = red;
17.         Unused = 0;
18.     }
19. }

Various Microsoft Windows color APIs use COLORREF to represent RGB colors (i.e., levels of red, green, and blue).

The key in the Listing 23.5 declaration is StructLayoutAttribute. By default, managed code can optimize the memory layouts of types, so layouts may not be sequential from one field to the next. To force sequential layouts so that a type maps directly and can be copied bit for bit (blitted) from managed to unmanaged code, and vice versa, you add the StructLayoutAttribute with the LayoutKind.Sequential enum value. (This is also useful when writing data to and from filestreams where a sequential layout may be expected.)

Since the unmanaged (C++) definition for struct does not map to the C# definition, there is no direct mapping of unmanaged struct to managed struct. Instead, developers should follow the usual C# guidelines about whether the type should behave like a value or a reference type, and whether the size is small (approximately less than 16 bytes).

Inline Arrays

Often it can be helpful to declare struct types as buffers. With C# 12.0 structs can be decorated so that they can be used as a fixed size array. Inline arrays are implicitly convertible to Span<T> or ReadOnlySpan<T> as an easy way to interact with the inline array. You can also directly access the elements in the inline array with a familiar indexer syntax, including ranges and index for reading and writing elements. To create an inline array, declare a struct with a single field and decorated with the System.Runtime.CompilerServices.InlineArrayAttribute specifying the size of the inline array in the attribute.

Skip Initializing Locals

Since C# 1.0, local variables have been initialized to zero values. However, in some high-performance situations, these zero initialized values are then overridden. C# 9.0 introduced a new SkipLocalsInitAttribute. This attribute will result in the compiler not outputting the localsinit CIL flag. The result is that locals may not be zero initialized. Accessing uninitialized data is discouraged because the behavior is undefined.

Error Handling

One inconvenient aspect of Win32 API programming is the fact that the APIs frequently report errors in inconsistent ways. For example, some APIs return a value (0, 1, false, and so on) to indicate an error, whereas others set an out parameter in some way. Furthermore, the details of what went wrong require additional calls to the GetLastError() API and then an additional call to FormatMessage() to retrieve an error message corresponding to the error. In summary, Win32 error reporting in unmanaged code seldom occurs via exceptions.

Fortunately, the P/Invoke designers provided a mechanism for error handling. To enable it, if the SetLastError named parameter of the DllImport attribute is true, it is possible to instantiate a System.ComponentModel.Win32Exception() that is automatically initialized with the Win32 error data immediately following the P/Invoke call (see Listing 23.6).

Listing 23.6: Win32 Error Handling
1. public class VirtualMemoryManager
2. {
3.     [DllImport("kernel32.dll", SetLastError = true)]
4.     private static extern IntPtr VirtualAllocEx(
5.         IntPtr hProcess,
6.         IntPtr lpAddress,
7.         IntPtr dwSize,
8.         AllocationType flAllocationType,
9.         uint flProtect);
10.  
11.     // ...
12.     [DllImport("kernel32.dll", SetLastError = true)]
13.     static extern bool VirtualProtectEx(
14.         IntPtr hProcess, IntPtr lpAddress,
15.         IntPtr dwSize, uint flNewProtect,
16.         ref uint lpflOldProtect);
17.  
18.     [Flags]
19.     internal enum AllocationType : uint
20.     {
21.         // ...
22.     }
23.  
24.     [Flags]
25.     private enum ProtectionOptions
26.     {
27.         // ...
28.     }
29.  
30.     [Flags]
31.     internal enum MemoryFreeType
32.     {
33.         // ...
34.     }
35.  
36.     public static IntPtr AllocExecutionBlock(
37.         int size, IntPtr hProcess)
38.     {
39.         IntPtr codeBytesPtr;
40.         codeBytesPtr = VirtualAllocEx(
41.             hProcess, IntPtr.Zero,
42.             (IntPtr)size,
43.             AllocationType.Reserve | AllocationType.Commit,
44.             (uint)ProtectionOptions.PageExecuteReadWrite);
45.  
46.         if (codeBytesPtr == IntPtr.Zero)
47.         {
48.             throw new System.ComponentModel.Win32Exception();
49.         }
50.  
51.         uint lpflOldProtect = 0;
52.         if (!VirtualProtectEx(
53.             hProcess, codeBytesPtr,
54.             (IntPtr)size,
55.             (uint)ProtectionOptions.PageExecuteReadWrite,
56.             ref lpflOldProtect))
57.         {
58.             throw new System.ComponentModel.Win32Exception();
59.         }
60.         return codeBytesPtr;
61.     }
62.  
63.     public static IntPtr AllocExecutionBlock(int size)
64.     {
65.         return AllocExecutionBlock(
66.             size, GetCurrentProcessHandle());
67.     }
68.     
69.     // ...
70. }

This code enables developers to provide the custom error checking that each API uses while still reporting the error in a standard manner.

Listing 23.1 and Listing 23.3 declared the P/Invoke methods as internal or private. Except for the simplest of APIs, wrapping methods in public wrappers that reduce the complexity of the P/Invoke API calls is a good guideline that increases API usability and moves toward object-oriented type structure. The AllocExecutionBlock() declaration in Listing 23.6 provides a good example of this approach.

Guidelines
DO create public managed wrappers around unmanaged methods that use the conventions of managed code, such as structured exception handling.
Using SafeHandle

Frequently, P/Invoke involves a resource, such as a handle, that code needs to clean up after using. Instead of requiring developers to remember this step is necessary and manually code it each time, it is helpful to provide a class that implements IDisposable and a finalizer. In Listing 23.7, for example, the address returned after VirtualAllocEx() and VirtualProtectEx() requires a follow-up call to VirtualFreeEx(). To provide built-in support for this process, you define a VirtualMemoryPtr class that derives from System.Runtime.InteropServices.SafeHandle.

Listing 23.7: Managed Resources Using SafeHandle
1. public class VirtualMemoryPtr :
2.   System.Runtime.InteropServices.SafeHandle
3. {
4.     public VirtualMemoryPtr(int memorySize) :
5.         base(IntPtr.Zero, true)
6.     {
7.         _ProcessHandle =
8.             VirtualMemoryManager.GetCurrentProcessHandle();
9.         _MemorySize = (IntPtr)memorySize;
10.         _AllocatedPointer =
11.             VirtualMemoryManager.AllocExecutionBlock(
12.             memorySize, _ProcessHandle);
13.         _Disposed = false;
14.     }
15.  
16.     public readonly IntPtr _AllocatedPointer;
17.     private readonly IntPtr _ProcessHandle;
18.     private readonly IntPtr _MemorySize;
19.     private bool _Disposed;
20.  
21.     public static implicit operator IntPtr(
22.         VirtualMemoryPtr virtualMemoryPointer)
23.     {
24.         return virtualMemoryPointer._AllocatedPointer;
25.     }
26.  
27.     // SafeHandle abstract member
28.     public override bool IsInvalid
29.     {
30.         get
31.         {
32.             return _Disposed;
33.         }
34.     }
35.  
36.     // SafeHandle abstract member
37.     protected override bool ReleaseHandle()
38.     {
39.         if (!_Disposed)
40.         {
41.             _Disposed = true;
42.             GC.SuppressFinalize(this);
43.             VirtualMemoryManager.VirtualFreeEx(_ProcessHandle,
44.                 _AllocatedPointer, _MemorySize);
45.         }
46.         return true;
47.     }
48. }

System.Runtime.InteropServices.SafeHandle includes the abstract members IsInvalid and ReleaseHandle(). You place your cleanup code in the latter; the former indicates whether this code has executed yet.

With VirtualMemoryPtr, you can allocate memory simply by instantiating the type and specifying the needed memory allocation.

Calling External Functions

Once you declare the P/Invoke functions, you invoke them just as you would any other class member. The key, however, is that the imported DLL must be in the path, including the executable directory, so that it can be successfully loaded. Listing 23.6 and Listing 23.7 demonstrate this approach. However, they rely on some constants.

Since flAllocationType and flProtect are flags, it is a good practice to provide constants or enums for each. Instead of expecting the caller to define these constants or enums, encapsulation suggests that you provide them as part of the API declaration, as shown in Listing 23.8.

Listing 23.8: Encapsulating the APIs Together
1. public class VirtualMemoryManager
2. {
3.     // ...
4.  
5.     /// <summary>
6.     /// The type of memory allocation. This parameter must
7.     /// contain one of the following values.
8.     /// </summary>
9.     [Flags]
10.     private enum AllocationType : uint
11.     {
12.         /// <summary>
13.         /// Allocates physical storage in memory or in the
14.         /// paging file on disk for the specified reserved
15.         /// memory pages. The function initializes the memory
16.         /// to zero.
17.         /// </summary>
18.         Commit = 0x1000,
19.         /// <summary>
20.         /// Reserves a range of the process's virtual address
21.         /// space without allocating any actual physical
22.         /// storage in memory or in the paging file on disk.
23.         /// </summary>
24.         Reserve = 0x2000,
25.         /// <summary>
26.         /// Indicates that data in the memory range specified by
27.         /// lpAddress and dwSize is no longer of interest. The
28.         /// pages should not be read from or written to the
29.         /// paging file. However, the memory block will be used
30.         /// again later, so it should not be decommitted. This
31.         /// value cannot be used with any other value.
32.         /// </summary>
33.         Reset = 0x80000,
34.         /// <summary>
35.         /// Allocates physical memory with read-write access.
36.         /// This value is solely for use with Address Windowing
37.         /// Extensions (AWE) memory.
38.         /// </summary>
39.         Physical = 0x400000,
40.         /// <summary>
41.         /// Allocates memory at the highest possible address.
42.         /// </summary>
43.         TopDown = 0x100000,
44.     }
45.  
46.     /// <summary>
47.     /// The memory protection for the region of pages to be
48.     /// allocated.
49.     /// </summary>
50.     [Flags]
51.     private enum ProtectionOptions : uint
52.     {
53.         /// <summary>
54.         /// Enables execute access to the committed region of
55.         /// pages. An attempt to read or write to the committed
56.         /// region results in an access violation.
57.         /// </summary>
58.         Execute = 0x10,
59.         /// <summary>
60.         /// Enables execute and read access to the committed
61.         /// region of pages. An attempt to write to the
62.         /// committed region results in an access violation.
63.         /// </summary>
64.         PageExecuteRead = 0x20,
65.         /// <summary>
66.         /// Enables execute, read, and write access to the
67.         /// committed region of pages.
68.         /// </summary>
69.         PageExecuteReadWrite = 0x40,
70.         // ...
71.     }
72.  
73.     /// <summary>
74.     /// The type of free operation.
75.     /// </summary>
76.     [Flags]
77.     private enum MemoryFreeType : uint
78.     {
79.         /// <summary>
80.         /// Decommits the specified region of committed pages.
81.         /// After the operation, the pages are in the reserved
82.         /// state.
83.         /// </summary>
84.         Decommit = 0x4000,
85.         /// <summary>
86.         /// Releases the specified region of pages. After this
87.         /// operation, the pages are in the free state.
88.         /// </summary>
89.         Release = 0x8000
90.     }
91.  
92.     // ...
93. }

The advantage of enums is that they group together the various values. Furthermore, they can limit the scope to nothing else besides these values.

Simplifying API Calls with Wrappers

Whether they are focused on error handling, structs, or constant values, one goal of effective API developers is to provide a simplified managed API that wraps the underlying Win32 API. For example, Listing 23.9 overloads VirtualFreeEx() with public versions that simplify the call.

Listing 23.9: Wrapping the Underlying API
1. public class VirtualMemoryManager
2. {
3.     // ...
4.  
5.     [DllImport("kernel32.dll", SetLastError = true)]
6.     static extern bool VirtualFreeEx(
7.         IntPtr hProcess, IntPtr lpAddress,
8.         IntPtr dwSize, IntPtr dwFreeType);
9.     public static bool VirtualFreeEx(
10.         IntPtr hProcess, IntPtr lpAddress,
11.         IntPtr dwSize)
12.     {
13.         bool result = VirtualFreeEx(
14.             hProcess, lpAddress, dwSize,
15.             (IntPtr)MemoryFreeType.Decommit);
16.         if (!result)
17.         {
18.             throw new System.ComponentModel.Win32Exception();
19.         }
20.         return result;
21.     }
22.     public static bool VirtualFreeEx(
23.         IntPtr lpAddress, IntPtr dwSize)
24.     {
25.         return VirtualFreeEx(
26.             GetCurrentProcessHandle(), lpAddress, dwSize);
27.     }
28.  
29.     [DllImport("kernel32", SetLastError = true)]
30.     static extern IntPtr VirtualAllocEx(
31.         IntPtr hProcess,
32.         IntPtr lpAddress,
33.         IntPtr dwSize,
34.         AllocationType flAllocationType,
35.         uint flProtect);
36.  
37.     // ...
38. }
Function Pointers Map to Delegates

One last key point related to P/Invoke is that function pointers in unmanaged code map to delegates in managed code. To set up a timer, for example, you would provide a function pointer that the timer could call back on, once it had expired. Specifically, you would pass a delegate instance that matches the signature of the callback.

C# 11 introduced an additional construct for storing pointers to functions. These function pointers can provide a performance improvement over using delegates to invoke methods. These are only available in unsafe code which is covered in more detail later in this chapter.

P/Invoke Guidelines

Given the idiosyncrasies of P/Invoke, there are several guidelines to aid in the process of writing such code.

Guidelines
DO NOT unnecessarily replicate existing managed classes that already perform the function of the unmanaged API.
DO declare extern methods as private or internal.
DO provide public wrapper methods that use managed conventions such as structured exception handling, use of enums for special values, and so on.
DO simplify the wrapper methods by choosing default values for unnecessary parameters.
DO use the SetLastErrorAttribute on Windows to turn APIs that use SetLastError error codes into methods that throw Win32Exception.
DO extend SafeHandle or implement IDisposable and create a finalizer to ensure that unmanaged resources can be cleaned up effectively.
DO use delegate types that match the signature of the desired method when an unmanaged API requires a function pointer.
DO use ref parameters rather than pointer types when possible.

________________________________________

1. One particularly helpful resource for declaring Win32 APIs is https://github.com/microsoft/CsWin32. It provides a great starting point for many APIs, helping you avoid some of the subtle problems that can arise when coding an external API call from scratch.
2. MSDN documentation.
{{ snackbarMessage }}
;