Undocumented functions of NTDLL

2OOO, 12 October



NtMapViewOfSection
NtMapViewOfSection

NTSYSAPI 
NTSTATUS
NTAPI

NtMapViewOfSection(


  IN HANDLE               SectionHandle,
  IN HANDLE               ProcessHandle,
  IN OUT PVOID            *BaseAddress OPTIONAL,
  IN ULONG                ZeroBits OPTIONAL,
  IN ULONG                CommitSize,
  IN OUT PLARGE_INTEGER   SectionOffset OPTIONAL,
  IN OUT PULONG           ViewSize,
  IN                      InheritDisposition,
  IN ULONG                AllocationType OPTIONAL,
  IN ULONG                Protect );



Function NtMapViewOfSection maps specified part of Section Object into process memory.


  • SectionHandle
    •     HANDLE to Section Object opened with one or more from SECTION_MAP_EXECUTE, SECTION_MAP_READ, SECTION_MAP_WRITE attributes.
  • ProcessHandle
    •     HANDLE to Process Object opened with PROCESS_VM_OPERATION access.
  • *BaseAddress
    •     Pointer to variable receiving virtual address of mapped memory. If this value is not NULL, system tries to allocate memory from specified value.
  • ZeroBits
    •     Indicates how many high bits must not be set in BaseAddress.
  • CommitSize
    •     Size of initially commited memory, in bytes.
  • SectionOffset
    •     Pointer to begin of mapped block in section. This value must be rounded up to X64K block size (0x10000 on X86).
  • ViewSize
    •     Pointer to size of mapped block, in bytes. This value is rounded up to page size (0x1000 on x86).
  • InheritDisposition
    •     How to child processes inherid maped section. See description of enumeration type SECTION_INHERIT.
  • AllocationType
    •     Can be one of:
  • Protect
    •     Page protection. Can be one of:


    Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003



    Documented by:
    Tomasz Nowak



    Requirements:
    Library: ntdll.lib


    See also:
    NtAllocateVirtualMemory
    NtCreateSection
    NtOpenSection
    NtUnmapViewOfSection