Undocumented functions of NTDLL

2OO0, 26 November


SECTION_IMAGE_INFORMATION
SECTION_IMAGE_INFORMATION

typedef struct _SECTION_IMAGE_INFORMATION {

PVOID EntryPoint; ULONG StackZeroBits; ULONG StackReserved; ULONG StackCommit; ULONG ImageSubsystem; WORD SubSystemVersionLow; WORD SubSystemVersionHigh; ULONG Unknown1; ULONG ImageCharacteristics; ULONG ImageMachineType; ULONG Unknown2[3]; } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;



Structure SECTION_IMAGE_INFORMATION is returned as a result of call NtQuerySection with SectionImageInformation information class. System automatically check type and contents of File Object passed as a parameter to function NtCreateSection, and sets SEC_IMAGE bit on Section Attributes.

This structure is very useful in process creation, becouse caller can check most interesting of PE Header fields just before call to NtCreateProcess and without mapping section to target process'es memory.



Requirements:
Library: ntdll.lib


See also:
NtCreateProcess
NtCreateSection
NtMapViewOfSection
NtOpenSection
NtQuerySection
SECTION_BASIC_INFORMATION
SECTION_INFORMATION_CLASS