InvalidArgument4 Error in NtFreeVirtualMemory Routine

When calling SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub() the call to NtFreeVirtualMemory returns an NTSTATUS = STATUS_INVALID_PARAMETER_4 (0xC00000F2).

I was attempting to call "NtAllocateVirtualMemory" this way:

``
IntPtr pSyscall = SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub("NtAllocateVirtualMemory");
``

This eventually causes this function to be called:

``
Native.NtFreeVirtualMemory((IntPtr)(-1), ref pImage, ref RegionSize, Execute.Win32.Kernel32.AllocationType.Reserve);
``

The error that was being returned was the catch-all error in Native.cs:

``
if (retValue != Execute.Native.NTSTATUS.Success)
{
// STATUS_OBJECT_TYPE_MISMATCH == 0xC0000024
throw new InvalidOperationException("There is a mismatch between the type of object that is required by the requested operation and the type of object that is specified in the request.");
}
``

Calling this code path, there is nothing that I can do to influence the variable type being used for the call to NtFreeVirtualMemory. I was able to add in an extra condition to get it to ignore the error as a work-around. It seems to not like the "Execute.Win32.Kernel32.AllocationType" being passed?

Commencez par SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub() et suivez l'appel jusqu'à Native.cs, en vous concentrant sur l'invocation de NtFreeVirtualMemory et sur la gestion de NTSTATUS. Reproduisez le chemin de NtAllocateVirtualMemory décrit dans l'issue, puis vérifiez que l'appel ne renvoie plus STATUS_INVALID_PARAMETER_4 et que les échecs réels restent signalés correctement.

Rédigé par le modèle d'indexation à partir du texte de l'issue.