#ifndef _NTMMAPI_H
//
// Virtual memory
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* Frees virtual memory allocated for a process.
*
* @param ProcessHandle A handle to the process whose virtual memory is to be freed.
* @param BaseAddress A pointer to the base address of the region of pages to be freed.
* @param RegionSize A pointer to a variable that specifies the size of the region of memory to be freed.
* @param FreeType The type of free operation. This parameter can be MEM_DECOMMIT or MEM_RELEASE.
* @return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFreeVirtualMemory(
_In_ HANDLE ProcessHandle,
_Inout_ __drv_freesMem(Mem) PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG FreeType
);
View code on GitHub
#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwFreeVirtualMemory(
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG FreeType
);
View code on GitHub
This function is documented in Windows Driver Kit here and here.
If you put pointer to NULL value as RegionSize
, system will free all region, and put size of it in result.
Can be one of the values: MEM_DECOMMIT
, or MEM_RELEASE
.