InvalidArgument4 Error in NtFreeVirtualMemory Routine

When calling SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub() the call to NtFreeVirtualMemory returns an NTSTATUS = STATUS_INVALID_PARAMETER_4 (0xC00000F2).

I was attempting to call "NtAllocateVirtualMemory" this way:

``
IntPtr pSyscall = SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub("NtAllocateVirtualMemory");
``

This eventually causes this function to be called:

``
Native.NtFreeVirtualMemory((IntPtr)(-1), ref pImage, ref RegionSize, Execute.Win32.Kernel32.AllocationType.Reserve);
``

The error that was being returned was the catch-all error in Native.cs:

``
if (retValue != Execute.Native.NTSTATUS.Success)
{
// STATUS_OBJECT_TYPE_MISMATCH == 0xC0000024
throw new InvalidOperationException("There is a mismatch between the type of object that is required by the requested operation and the type of object that is specified in the request.");
}
``

Calling this code path, there is nothing that I can do to influence the variable type being used for the call to NtFreeVirtualMemory. I was able to add in an extra condition to get it to ignore the error as a work-around. It seems to not like the "Execute.Win32.Kernel32.AllocationType" being passed?

Comienza en SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub() y sigue la llamada hasta Native.cs, centrándote en la invocación de NtFreeVirtualMemory y en el tratamiento de NTSTATUS. Reproduce la ruta de NtAllocateVirtualMemory descrita en el issue y verifica después que la llamada ya no devuelve STATUS_INVALID_PARAMETER_4 y que los fallos reales se siguen notificando correctamente.

Escrito por el modelo de indexación a partir del texto del issue.