InvalidArgument4 Error in NtFreeVirtualMemory Routine

When calling SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub() the call to NtFreeVirtualMemory returns an NTSTATUS = STATUS_INVALID_PARAMETER_4 (0xC00000F2).

I was attempting to call "NtAllocateVirtualMemory" this way:

``
IntPtr pSyscall = SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub("NtAllocateVirtualMemory");
``

This eventually causes this function to be called:

``
Native.NtFreeVirtualMemory((IntPtr)(-1), ref pImage, ref RegionSize, Execute.Win32.Kernel32.AllocationType.Reserve);
``

The error that was being returned was the catch-all error in Native.cs:

``
if (retValue != Execute.Native.NTSTATUS.Success)
{
// STATUS_OBJECT_TYPE_MISMATCH == 0xC0000024
throw new InvalidOperationException("There is a mismatch between the type of object that is required by the requested operation and the type of object that is specified in the request.");
}
``

Calling this code path, there is nothing that I can do to influence the variable type being used for the call to NtFreeVirtualMemory. I was able to add in an extra condition to get it to ignore the error as a work-around. It seems to not like the "Execute.Win32.Kernel32.AllocationType" being passed?

SharpSploit.Execution.DynamicInvoke.Generic.GetSyscallStub() から開始し、Native.cs への呼び出しを追跡して、NtFreeVirtualMemory の呼び出しと NTSTATUS の処理に焦点を当てます。issue で説明されている NtAllocateVirtualMemory の経路を再現し、その後、呼び出しが STATUS_INVALID_PARAMETER_4 を返さなくなっていること、および実際の失敗が引き続き正しく報告されることを確認します。

索引モデルが issue の本文から書いたものです。