Fix AccessViolationException when scanning Unity 6 modules with protected memory pages (#267)

* Fix AccessViolation scanning Unity 6 modules with protected pages

FindSignatureInModule did a raw linear byte walk over the entire loaded
module. On Unity 6000.x the GameAssembly image maps regions as PAGE_NOACCESS
/ guard pages, so dereferencing them throws a process-fatal
AccessViolationException before the caller's signature-exhaustion fallback
can run (observed registering injected types on Priconne, Unity 6000.0.58f2).

Temporarily flip every committed region of the module to PAGE_EXECUTE_READWRITE
for the duration of the scan via VirtualQuery/VirtualProtect, then restore the
original protections in a finally block. Non-committed (MEM_FREE/MEM_RESERVE)
regions are skipped. Mirrors the approach used by downstream forks that already
support Unity 6.

* Guard the page-protection scan workaround to Windows only

Per @ds5678's review on #267: VirtualProtect/VirtualQuery are kernel32 (Windows-only)
and PAGE_NOACCESS is a Windows page state. Run the make-readable / restore dance only
when OperatingSystem.IsWindows(); on other platforms fall back to the direct
FindSignatureInBlock scan (its prior behaviour), so the kernel32 P/Invokes are never
called off-Windows. Also satisfies the CA1416 platform-compatibility analyzer.

* Scan only readable regions instead of changing page protections

Per @ds5678's review on #267 (relaying Discord feedback): modifying page protections
(VirtualProtect to PAGE_EXECUTE_READWRITE) is dangerous and unnecessary. VirtualQuery
already enumerates the module's regions, so skip the non-readable / guard / uncommitted
ones during the signature scan rather than forcing them readable. Removes VirtualProtect
and the RWX flip entirely; keeps the Windows-only guard (VirtualQuery is kernel32) with
the plain whole-module scan as the off-Windows fallback.

* Bound the signature scan to each region + apply review refinements

The per-region scan could read up to mask.Length-1 bytes past a readable region into the
adjacent guard / PAGE_NOACCESS page -> a fatal AccessViolationException. Cap
FindSignatureInBlock's loop at blockSize - mask.Length so every read stays inside the region.
Per @ds5678's review: GetModuleRegions now returns the list instead of an out parameter, and
its comment is XML documentation.

* Use TerraFX.Interop.Windows for VirtualQuery instead of a manual P/Invoke

Replace the hand-written kernel32 VirtualQuery DllImport and MEMORY_BASIC_INFORMATION struct with the TerraFX.Interop.Windows bindings, pinned to 10.0.22621.2 (the last release targeting .NET 6). The readable-region scan is unchanged.

* Annotate the region scan as Windows-only for CA1416

The TerraFX MEMORY_BASIC_INFORMATION fields are annotated for Windows 6.1+. Mark GetModuleRegions with the matching SupportedOSPlatform attribute and guard the call with OperatingSystem.IsWindowsVersionAtLeast(6, 1) so the platform-compatibility analyzer is satisfied.

* Use TerraFX MEM/PAGE constants instead of hand-rolled hex

Drop the manual MEM_COMMIT/PAGE_GUARD/PAGE_READABLE consts and the
`using static Windows` in favour of the constants TerraFX already
exposes (MEM.*, PAGE.*), qualify VirtualQuery, and default-init the
MEMORY_BASIC_INFORMATION. The readable mask moves inside the
windows6.1 guard so the const fold stays on a supported-platform path.

Author: HetCreep

Il2CppInterop.Runtime/Il2CppInterop.Runtime.csproj

@@ -33,6 +33,7 @@
 
   <ItemGroup>
     <PackageReference Include="Iced" Version="1.17.0" />
+    <PackageReference Include="TerraFX.Interop.Windows" Version="10.0.22621.2" />
     <PackageReference Include="PolySharp" Version="1.14.1">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

Il2CppInterop.Runtime/MemoryUtils.cs

@@ -1,20 +1,47 @@
-using System.Diagnostics;
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
 using System.Linq;
+using System.Runtime.Versioning;
 using Il2CppInterop.Common.XrefScans;
+using TerraFX.Interop.Windows;
 
 namespace Il2CppInterop.Runtime;
 
 internal class MemoryUtils
 {
-    public static nint FindSignatureInModule(ProcessModule module, SignatureDefinition sigDef)
+    public static unsafe nint FindSignatureInModule(ProcessModule module, SignatureDefinition sigDef)
     {
-        var ptr = FindSignatureInBlock(
-            module.BaseAddress,
-            module.ModuleMemorySize,
-            sigDef.pattern,
-            sigDef.mask,
-            sigDef.offset
-        );
+        // On newer Unity (6000.x) the loaded GameAssembly maps some pages PAGE_NOACCESS / guard pages; the raw
+        // linear byte walk in FindSignatureInBlock dereferences them and throws a fatal AccessViolationException.
+        // Use VirtualQuery to enumerate the module's regions and scan only the readable committed ones, skipping
+        // the rest -- without ever modifying page protections. VirtualQuery and the TerraFX MEMORY_BASIC_INFORMATION
+        // fields are Windows-only (the struct is annotated for Windows 6.1+); elsewhere (where this guard-page issue
+        // does not arise) fall back to the plain whole-module scan.
+        nint ptr = 0;
+        if (OperatingSystem.IsWindowsVersionAtLeast(6, 1))
+        {
+            // Protections that permit reading; TerraFX defines no single composite of these.
+            const uint pageReadable = PAGE.PAGE_READONLY | PAGE.PAGE_READWRITE | PAGE.PAGE_WRITECOPY |
+                                      PAGE.PAGE_EXECUTE_READ | PAGE.PAGE_EXECUTE_READWRITE | PAGE.PAGE_EXECUTE_WRITECOPY;
+            var regions = GetModuleRegions(module);
+            foreach (var region in regions)
+            {
+                if (region.State != MEM.MEM_COMMIT || (region.Protect & PAGE.PAGE_GUARD) != 0 ||
+                    (region.Protect & pageReadable) == 0)
+                    continue;
+                ptr = FindSignatureInBlock((nint)region.BaseAddress, (long)region.RegionSize,
+                    sigDef.pattern, sigDef.mask, sigDef.offset);
+                if (ptr != 0)
+                    break;
+            }
+        }
+        else
+        {
+            ptr = FindSignatureInBlock(module.BaseAddress, module.ModuleMemorySize,
+                sigDef.pattern, sigDef.mask, sigDef.offset);
+        }
+
         if (ptr != 0 && sigDef.xref)
             ptr = XrefScannerLowLevel.JumpTargets(ptr).FirstOrDefault();
         return ptr;
@@ -28,7 +55,11 @@ public static nint FindSignatureInBlock(nint block, long blockSize, string patte
     public static unsafe nint FindSignatureInBlock(nint block, long blockSize, char[] pattern, char[] mask,
         long sigOffset = 0)
     {
-        for (long address = 0; address < blockSize; address++)
+        // Stop at blockSize - mask.Length so the inner read (block + address + mask.Length - 1) never passes the
+        // end of this block. When the caller scans per-region (Unity 6 readable regions interleaved with guard /
+        // PAGE_NOACCESS pages), an overread off the tail would fault the adjacent page -> a fatal
+        // AccessViolationException that aborts the chainloader. If the block is smaller than the mask, scan nothing.
+        for (long address = 0; address <= blockSize - mask.Length; address++)
         {
             var found = true;
             for (uint offset = 0; offset < mask.Length; offset++)
@@ -45,6 +76,30 @@ public static unsafe nint FindSignatureInBlock(nint block, long blockSize, char[
         return 0;
     }
 
+    /// <summary>
+    /// Walks the module's address space via <c>VirtualQuery</c>, collecting each memory region so the scan can pick
+    /// the readable committed ones. Stops at the first <c>VirtualQuery</c> failure or once the module end is reached.
+    /// </summary>
+    [SupportedOSPlatform("windows6.1")]
+    internal static unsafe List<MEMORY_BASIC_INFORMATION> GetModuleRegions(ProcessModule module)
+    {
+        var regions = new List<MEMORY_BASIC_INFORMATION>();
+        var moduleEndAddress = (long)module.BaseAddress + module.ModuleMemorySize;
+        var currentAddress = (long)module.BaseAddress;
+        while (currentAddress < moduleEndAddress)
+        {
+            MEMORY_BASIC_INFORMATION memoryInfo = default;
+            var result = Windows.VirtualQuery((void*)currentAddress, &memoryInfo, (nuint)sizeof(MEMORY_BASIC_INFORMATION));
+            if (result == 0)
+                break; // error, or reached the end of the module's mapped memory
+
+            regions.Add(memoryInfo);
+            currentAddress = (long)memoryInfo.BaseAddress + (long)memoryInfo.RegionSize;
+        }
+
+        return regions;
+    }
+
     public struct SignatureDefinition
     {
         public string pattern;