#ifndef _NTMMAPI_H
//
// Sections
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* Provides the capability to determine the base address, size, granted access, and allocation of an opened section object.
*
* @param SectionHandle An open handle to a section object.
* @param SectionInformationClass The section information class about which to retrieve information.
* @param SectionInformation A pointer to a buffer that receives the specified information. The format and content of the buffer depend on the specified section class.
* @param SectionInformationLength Specifies the length in bytes of the section information buffer.
* @param ReturnLength An optional pointer which, if specified, receives the number of bytes placed in the section information buffer.
* @return NTSTATUS Successful or errant status.
* @sa https://learn.microsoft.com/en-us/windows/win32/devnotes/ntquerysection
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySection(
_In_ HANDLE SectionHandle,
_In_ SECTION_INFORMATION_CLASS SectionInformationClass,
_Out_writes_bytes_(SectionInformationLength) PVOID SectionInformation,
_In_ SIZE_T SectionInformationLength,
_Out_opt_ PSIZE_T ReturnLength
);
View code on GitHub
#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQuerySection(
_In_ HANDLE SectionHandle,
_In_ SECTION_INFORMATION_CLASS SectionInformationClass,
_Out_writes_bytes_(SectionInformationLength) PVOID SectionInformation,
_In_ SIZE_T SectionInformationLength,
_Out_opt_ PSIZE_T ReturnLength
);
View code on GitHub
This function is documented in Windows SDK.
Use one of following:
SectionBasicInformation // Result is SECTION_BASIC_INFORMATION structure
SectionImageInformation // Result is SECTION_IMAGE_INFORMATION structure
SectionImageInformation
Are available only for file-based sections.