InvalidArgument4 Error in NtFreeVirtualMemory Routine
- Dominant language
- C#
- Stars
- 1.9k
- Forks
- 317
- PR merge metrics
- No merged PRs in 30d
Description
When calling SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub() the call to NtFreeVirtualMemory returns an NTSTATUS = STATUS_INVALID_PARAMETER_4 (0xC00000F2).
I was attempting to call "NtAllocateVirtualMemory" this way:
``
IntPtr pSyscall = SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub("NtAllocateVirtualMemory");
``
This eventually causes this function to be called:
``
Native.NtFreeVirtualMemory((IntPtr)(-1), ref pImage, ref RegionSize, Execute.Win32.Kernel32.AllocationType.Reserve);
``
The error that was being returned was the catch-all error in Native.cs:
``
if (retValue != Execute.Native.NTSTATUS.Success)
{
// STATUS_OBJECT_TYPE_MISMATCH == 0xC0000024
throw new InvalidOperationException("There is a mismatch between the type of object that is required by the requested operation and the type of object that is specified in the request.");
}
``
Calling this code path, there is nothing that I can do to influence the variable type being used for the call to NtFreeVirtualMemory. I was able to add in an extra condition to get it to ignore the error as a work-around. It seems to not like the "Execute.Win32.Kernel32.AllocationType" being passed?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.