NtFreeUserPhysicalPages

Prototype

NTSTATUS NtFreeUserPhysicalPages(
  HANDLE     ProcessHandle,
  PULONG_PTR NumberOfPages,
  PULONG_PTR UserPfnArray
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1                  mov r10, rcx
B8 F6 00 00 00            mov eax, 0xF6
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03                     jne short +3
0F 05                     syscall
C3                        ret
CD 2E                     int 2Eh
C3                        ret

Undocumented notes

The cleanup counterpart to `NtAllocateUserPhysicalPages`. Walks the PFN array, decrements each page's reference count in the system PFN database, and returns the pages to the standby / free list. Pages that are still mapped via `NtMapUserPhysicalPages` are first unmapped from the caller's address-space window. Like its allocator twin, the call requires the process to either currently hold `SeLockMemoryPrivilege` or to have held it at the time of allocation — the kernel records the originating token at allocation time and uses it for ownership checks. Calling `NtFreeUserPhysicalPages` on PFN values that did not come from the same allocator returns `STATUS_INVALID_PARAMETER_3` without touching system state.

Common malware usage

Minimal direct offensive value — it is purely the destructor for an already-rare allocation path. Where it does appear is in **anti-forensics cleanup**: implants that staged shellcode in AWE-backed non-pageable pages (to survive memory-pressure swap captures) call `NtFreeUserPhysicalPages` immediately before the implant exits, so a post-incident `vmcore` or hibernation-file analysis sees no residual non-pageable region tied to the dead process. Also appears in **kernel R/W primitive teardown** chains where the attacker allocates AWE pages to alias kernel memory through a vulnerable driver and then frees them to remove the only persistent forensic trail. Commodity malware essentially never touches it.

Detection opportunities

Mirror of the allocator's signal — pair calls of `NtAllocateUserPhysicalPages` and `NtFreeUserPhysicalPages` from the same non-database-server process are the high-fidelity tell, especially when the lifetime is short (allocate → map → execute → free in the same second). Sysmon Event ID 1 for the parent process combined with kernel ETW `Microsoft-Windows-Kernel-Memory` event 14 (`PfnPageRelease` family) lets you reconstruct the lifecycle. The `SeLockMemoryPrivilege` audit (Event 4673) usually fires only on the allocate path; if you see a freeing process where the audit log has no matching grant, the privilege was already enabled in the parent token — investigate how it got there.

Direct syscall examples

// Pair with the NtAllocateUserPhysicalPages example: tear down the AWE working
// set so that the shellcode-bearing physical pages are returned to the free list
// before the implant exits.
#include <windows.h>

void awe_free(ULONG_PTR* pfn, SIZE_T pages, PVOID windowBase) {
    // First unmap from the window so no live VAD references the PFNs.
    MapUserPhysicalPages(windowBase, pages, NULL);
    VirtualFree(windowBase, 0, MEM_RELEASE);

    ULONG_PTR n = pages;
    FreeUserPhysicalPages(GetCurrentProcess(), &n, pfn);
    // Wrapper resolves to NtFreeUserPhysicalPages internally.
}

NtFreeUserPhysicalPages PROC
    mov  r10, rcx
    mov  eax, 0F6h
    syscall
    ret
NtFreeUserPhysicalPages ENDP

MITRE ATT&CK mappings

• T1106Native APImitre ↗
• T1070Indicator Removalmitre ↗