NtUnmapViewOfSection - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
#ifndef _NTMMAPI_H
//
// Sections
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtUnmapViewOfSection routine unmaps a view of a section from the virtual address space of a subject process.
 *
 * \param ProcessHandle Handle to a process object that was previously passed to NtMapViewOfSection.
 * \param BaseAddress Pointer to the base virtual address of the view to unmap. This value can be any virtual address within the view.
 * \return NTSTATUS Successful or errant status.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwunmapviewofsection
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnmapViewOfSection(
    _In_ HANDLE ProcessHandle,
    _In_opt_ PVOID BaseAddress
    );

#endif
#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwUnmapViewOfSection(
    _In_ HANDLE ProcessHandle,
    _In_opt_ PVOID BaseAddress
    );

#endif

View code on GitHub
// wdm.h

NTSYSAPI NTSTATUS ZwUnmapViewOfSection(
  [in]           HANDLE ProcessHandle,
  [in, optional] PVOID  BaseAddress
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Windows Driver Kit DDI reference (nf-wdm-zwunmapviewofsection)

Description

The ZwUnmapViewOfSection routine unmaps a view of a section from the virtual address space of a subject process.

Parameters

ProcessHandle [in]

Handle to a process object that was previously passed to ZwMapViewOfSection.

BaseAddress [in, optional]

Pointer to the base virtual address of the view to unmap. This value can be any virtual address within the view.

Return value

ZwUnmapViewOfSection returns an NTSTATUS value. Possible return values include:

Return code Description
STATUS_SUCCESS The routine successfully performed the requested operation.
STATUS_ACCESS_DENIED The caller does not have access rights to the process object or to the base virtual address of the view.

Remarks

This routine unmaps the entire view of the section that contains BaseAddress from the virtual address space of the specified process—even if BaseAddress does not point to the beginning of the view.

On return from ZwUnmapViewOfSection, the virtual-address region occupied by the view is no longer reserved and is available to map other views or private pages. If the view was also the last reference to the underlying section, all committed pages in the section are decommitted, and the section is deleted.

If the call to this function occurs in user mode, you should use the name "NtUnmapViewOfSection" instead of "ZwUnmapViewOfSection".

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

Using Nt and Zw Versions of the Native System Services Routines

ZwMapViewOfSection

ZwOpenSection


NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows Driver Kit.


See also