Undocumented functions of NTDLL

2OOO, 12 October

NTSYSAPI 
NTSTATUS
NTAPI


NtMapViewOfSection(



  IN HANDLE               SectionHandle,
  IN HANDLE               ProcessHandle,
  IN OUT PVOID            *BaseAddress OPTIONAL,
  IN ULONG                ZeroBits OPTIONAL,
  IN ULONG                CommitSize,
  IN OUT PLARGE_INTEGER   SectionOffset OPTIONAL,
  IN OUT PULONG           ViewSize,
  IN                      InheritDisposition,
  IN ULONG                AllocationType OPTIONAL,
  IN ULONG                Protect );

• SectionHandle     HANDLE to Section Object opened with one or more from SECTION_MAP_EXECUTE, SECTION_MAP_READ, SECTION_MAP_WRITE attributes.

• ProcessHandle     HANDLE to Process Object opened with PROCESS_VM_OPERATION access.

• *BaseAddress     Pointer to variable receiving virtual address of mapped memory. If this value is not NULL, system tries to allocate memory from specified value.

• ZeroBits     Indicates how many high bits must not be set in BaseAddress.

• CommitSize     Size of initially commited memory, in bytes.

• SectionOffset     Pointer to begin of mapped block in section. This value must be rounded up to X64K block size (0x10000 on X86).

• ViewSize     Pointer to size of mapped block, in bytes. This value is rounded up to page size (0x1000 on x86).

• InheritDisposition     How to child processes inherid maped section. See description of enumeration type SECTION_INHERIT.

• AllocationType     Can be one of:

• MEM_COMMIT
• MEM_RESERVE

• Protect     Page protection. Can be one of:

• PAGE_NOACCESS
• PAGE_READONLY
• PAGE_READWRITE
• PAGE_WRITECOPY
• PAGE_EXECUTE
• PAGE_EXECUTE_READ
• PAGE_EXECUTE_READWRITE
• PAGE_EXECUTE_WRITECOPY
• PAGE_GUARD
• PAGE_NOCACHE
• PAGE_WRITECOMBINE

Supported on system versions:

NT 4.0,Win 2000,Win XP/2003

Documented by:

Tomasz Nowak

Library: ntdll.lib

NtAllocateVirtualMemory

NtCreateSection

NtOpenSection

NtUnmapViewOfSection