NtFreeVirtualMemory

Prototype

NTSTATUS NtFreeVirtualMemory(
  HANDLE  ProcessHandle,
  PVOID  *BaseAddress,
  PSIZE_T RegionSize,
  ULONG   FreeType
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 1E 00 00 00      mov eax, 0x1E
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtFreeVirtualMemory keeps SSN `0x1E` across every Windows 10 / 11 / Server build observed. It is the natural pair to NtAllocateVirtualMemory and dispatches through MmFreeVirtualMemory. MEM_DECOMMIT keeps the VAD reservation but releases physical pages; MEM_RELEASE tears down the reservation entirely (and requires RegionSize == 0 and BaseAddress to match the original allocation base).

Common malware usage

Used at the *end* of a payload's lifecycle rather than the beginning — wipe shellcode after execution so a follow-up memory scan finds zeroed or unmapped pages. The technique was popularised by `Hunt-Sleeping-Beacons`-style countermeasures: rather than leave RWX pages full of recognisable beacon code resident across long sleeps, modern loaders allocate, execute, then NtFreeVirtualMemory the region (or NtProtectVirtualMemory it back to PAGE_NOACCESS, encrypt, and re-protect on resume). Also used by hollowing implementations to free the original PEB-anchored image base mapping before remapping a malicious image.

Detection opportunities

Standalone calls are extremely noisy. Interesting patterns are short-lived MEM_COMMIT|EXECUTE → execute → MEM_RELEASE sequences (visible via ETW Threat Intelligence Memory events on Win10 2004+) and frees that target regions whose VAD shows recent PAGE_EXECUTE_READWRITE protection changes. Free events of the original image base in a process whose start image differs from its on-disk image are a strong process-hollowing tell.

Direct syscall examples

; Direct syscall stub for NtFreeVirtualMemory (SSN 0x1E, all builds)
NtFreeVirtualMemory PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 1Eh          ; SSN
    syscall
    ret
NtFreeVirtualMemory ENDP

// Allocate, run, then free — defeats post-mortem memory scans.
PVOID  base = NULL;
SIZE_T size = shellcode_len;
NtAllocateVirtualMemory(NtCurrentProcess(), &base, 0, &size,
                        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
memcpy(base, shellcode, shellcode_len);

ULONG old;
NtProtectVirtualMemory(NtCurrentProcess(), &base, &size,
                       PAGE_EXECUTE_READ, &old);
((void(*)(void))base)();

// Zero before unmap to defeat free-list residue grabs.
RtlSecureZeroMemory(base, shellcode_len);
SIZE_T zero = 0;
NtFreeVirtualMemory(NtCurrentProcess(), &base, &zero, MEM_RELEASE);

// Cargo: ntapi = "0.4", windows-sys = "0.59"
use ntapi::ntmmapi::NtFreeVirtualMemory;
use windows_sys::Win32::System::Memory::MEM_RELEASE;

pub struct VirtualRegion { base: *mut core::ffi::c_void, len: usize }

impl Drop for VirtualRegion {
    fn drop(&mut self) {
        let mut base = self.base;
        let mut len: usize = 0; // MEM_RELEASE requires 0
        unsafe {
            NtFreeVirtualMemory(-1isize as _, &mut base, &mut len, MEM_RELEASE);
        }
    }
}

MITRE ATT&CK mappings

• T1055Process Injectionmitre ↗
• T1027.009Obfuscated Files or Information: Embedded Payloadsmitre ↗
• T1106Native APImitre ↗