#ifndef _NTMMAPI_H
// Sections
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateSection(
_Out_ PHANDLE SectionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PLARGE_INTEGER MaximumSize,
_In_ ULONG SectionPageProtection,
_In_ ULONG AllocationAttributes,
_In_opt_ HANDLE FileHandle
);
View code on GitHub
#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreateSection(
_Out_ PHANDLE SectionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PLARGE_INTEGER MaximumSize,
_In_ ULONG SectionPageProtection,
_In_ ULONG AllocationAttributes,
_In_opt_ HANDLE FileHandle
);
View code on GitHub
This function is documented in Windows Driver Kit here and here.
Function NtCreateSection
creates Section Object (virtual memory block with associated file).
Result of call - HANDLE
to Section Object.
Access mask. Can be combination of:
SECTION_QUERY
SECTION_MAP_WRITE
SECTION_MAP_READ
SECTION_MAP_EXECUTE
SECTION_EXTEND_SIZE
SECTION_ALL_ACCESS
Pointer to OBJECT_ATTRIBUTES
structure contains section name, in Object Namespace format.
Optionally define maximum size of section. Must be defined when caller create section based on system PageFile.
Can be one or combination of:
PAGE_NOACCESS
PAGE_READONLY
PAGE_READWRITE
PAGE_WRITECOPY
PAGE_EXECUTE
PAGE_EXECUTE_READ
PAGE_EXECUTE_READWRITE
PAGE_EXECUTE_WRITECOPY
PAGE_GUARD
PAGE_NOCACHE
PAGE_WRITECOMBINE
Can be one or combination of:
Optionally HANDLE
to File Object opened with proper access.