NtCreateSection - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
#ifndef _NTMMAPI_H
// Sections
#if (PHNT_MODE != PHNT_MODE_KERNEL)

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateSection(
    _Out_ PHANDLE SectionHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
    _In_opt_ PLARGE_INTEGER MaximumSize,
    _In_ ULONG SectionPageProtection,
    _In_ ULONG AllocationAttributes,
    _In_opt_ HANDLE FileHandle
    );

#endif
#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreateSection(
    _Out_ PHANDLE SectionHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_opt_ PLARGE_INTEGER MaximumSize,
    _In_ ULONG SectionPageProtection,
    _In_ ULONG AllocationAttributes,
    _In_opt_ HANDLE FileHandle
    );

#endif

View code on GitHub

This function is documented in Windows Driver Kit here and here.


Function NtCreateSection creates Section Object (virtual memory block with associated file).

SectionHandle

Result of call - HANDLE to Section Object.

DesiredAccess

Access mask. Can be combination of:

ObjectAttributes

Pointer to OBJECT_ATTRIBUTES structure contains section name, in Object Namespace format.

MaximumSize

Optionally define maximum size of section. Must be defined when caller create section based on system PageFile.

PageAttributes

Can be one or combination of:

SectionAttributes

Can be one or combination of:

FileHandle

Optionally HANDLE to File Object opened with proper access.

Documented by

See also