#ifndef _NTMMAPI_H

typedef enum _SECTION_INFORMATION_CLASS
{
    SectionBasicInformation, // q; SECTION_BASIC_INFORMATION
    SectionImageInformation, // q; SECTION_IMAGE_INFORMATION
    SectionRelocationInformation, // q; ULONG_PTR RelocationDelta // name:wow64:whNtQuerySection_SectionRelocationInformation // since WIN7
    SectionOriginalBaseInformation, // q; PVOID BaseAddress // since REDSTONE
    SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2
    MaxSectionInfoClass
} SECTION_INFORMATION_CLASS;

#endif
View code on GitHub

Enumeration type SECTION_INFORMATION_CLASS is used in a call to NtQuerySection function.

This type can be one of:

SectionBasicInformation

Result buffer contains structure SECTION_BASIC_INFORMATION. Buffer size should be set to 0x0C.

SectionImageInformation

Result buffer contains structure SECTION_IMAGE_INFORMATION. Buffer size should be set to 0x28. This information class is accessible only where section was created with HANDLE to open executable file (see NtCreateSection for details).

Documented by

Tomasz Nowak

SECTION_INFORMATION_CLASS - NtDoc

SectionBasicInformation

SectionImageInformation

Documented by

See also