title: Windows Defender Antivirus scan from C# [AccessViolation exception]
body: <p>We are writing a code to do on-demand scan of a file from C# using Windows Defender APIs.</p>
  
  <pre><code>        [DllImport(@"C:\Program Files\Windows Defender\MpClient.dll")]
          public static extern int WDStatus(out bool pfEnabled);
  
          [DllImport(@"C:\Program Files\Windows Defender\MpClient.dll")]
          public static extern int MpManagerOpen(uint dwReserved, out IntPtr phMpHandle);
  
          [DllImport(@"C:\Program Files\Windows Defender\MpClient.dll")]
          public static extern int MpScanStart(IntPtr hMpHandle, uint ScanType, uint dwScanOptions, IntPtr pScanResources, IntPtr pCallbackInfo, out IntPtr phScanHandle);
  
          [DllImport(@"C:\Program Files\Windows Defender\MpClient.dll")]
          public static extern int MpHandleClose(IntPtr hMpHandle);
  
          private void DoDefenderScan_Click(object sender, EventArgs e)
          {
              try
              {
                  bool pfEnabled;
                  int result = WDStatus(out pfEnabled); //Returns the defender status - It's working properly.
                  ErrorHandler.ThrowOnFailure(result, VSConstants.S_OK);
  
                  IntPtr phMpHandle;
                  uint dwReserved = 0;
  
                  IntPtr phScanHandle;
  
                  MpManagerOpen(dwReserved, out phMpHandle); //Opens Defender and returns the handle in phMpHandle. 
  
                  tagMPRESOURCE_INFO mpResourceInfo = new tagMPRESOURCE_INFO();
                  mpResourceInfo.Path = "eicar.com";
                  mpResourceInfo.Scheme = "file";
                  mpResourceInfo.Class = IntPtr.Zero;
  
                  tagMPRESOURCE_INFO[] pResourceList = new tagMPRESOURCE_INFO[1];
                  pResourceList.SetValue(mpResourceInfo, 0);
  
                  tagMPSCAN_RESOURCES scanResource = new tagMPSCAN_RESOURCES();
                  scanResource.dwResourceCount = 1;
                  scanResource.pResourceList = pResourceList;
                  IntPtr resourcePointer = StructToPtr(scanResource);
  
                  result = MpScanStart(phMpHandle, 3, 0, resourcePointer, IntPtr.Zero, out phScanHandle); **//Getting Access violation exception here**.
  
                  MpHandleClose(phMpHandle);
                  MpHandleClose(phScanHandle);
                  Marshal.FreeHGlobal(resourcePointer);
              }
              catch (Exception)
              { }
          }
  </code></pre>
  
  <p>And the structure is defined here.</p>
  
  <pre><code>    [StructLayout(LayoutKind.Sequential, Pack = 1)]
      public struct tagMPSCAN_RESOURCES
      {
          public uint dwResourceCount;
  
          [MarshalAs(UnmanagedType.ByValArray, ArraySubType = UnmanagedType.Struct, SizeConst = 1)]
          public tagMPRESOURCE_INFO[] pResourceList;
      }
  
      [StructLayout(LayoutKind.Sequential, Pack = 1)]
      public struct tagMPRESOURCE_INFO
      {
          [MarshalAs(UnmanagedType.LPWStr)]
          public String Scheme;
  
          [MarshalAs(UnmanagedType.LPWStr)]
          public String Path;
  
           public IntPtr Class;
      }
  
      public class MPRESOURCE_CLASS
      {
          public uint Value;
      }
  
      private static IntPtr StructToPtr(object obj)
      {
          var ptr = Marshal.AllocHGlobal(Marshal.SizeOf(obj));
          Marshal.StructureToPtr(obj, ptr, false);
          return ptr;
      }
  </code></pre>
  
  <p>The code is written based on the documentation available at</p>
  
  <p><a href="https://msdn.microsoft.com/en-us/library/vs/alm/dn920144(v=vs.85).aspx" rel="noreferrer">https://msdn.microsoft.com/en-us/library/vs/alm/dn920144(v=vs.85).aspx</a></p>
  
  <p>We are getting this exception</p>
  
  <p><strong>Attempted to read or write protected memory. This is often an indication that other memory is corrupt.</strong></p>
  
  <p>at</p>
  
  <pre><code>result = MpScanStart(phMpHandle, 3, 0, resourcePointer, IntPtr.Zero, out phScanHandle); **//Getting Access violation exception here**.
  </code></pre>
  
  <p>What could be the problem? Is the format of struct is correct?</p>
  
  <blockquote>
    <p>P.S - No information about MPRESOURCE_CLASS is available in msdn. </p>
  </blockquote>
  
  <p>I'm not sure, whether this line of code is correct.</p>
  
  <pre><code> mpResourceInfo.Class = IntPtr.Zero;
  </code></pre>
  
  <p><strong><em>Update:</em></strong></p>
  
  <p>Quick scan is working fine with this code:</p>
  
  <pre><code>result = MpScanStart(phMpHandle, 1, 0, IntPtr.Zero, IntPtr.Zero, out phScanHandle);
  </code></pre>
  
  <p>Defender logs in the event viewer [ Applications and Services Logs-Microsoft-Windows-Windows Defender/Operational ] as</p>
  
  <blockquote>
    <p>Windows Defender scan has started.<br>
    Scan ID:{CDC2AC0D-7648-4313-851C-4D8B7B5EB5CD}<br>
    Scan Type:AntiSpyware<br>
    Scan Parameters:Quick Scan</p>
  </blockquote>