#ifndef _NT_SECTION_H_ #define _NT_SECTION_H_ #include "nt_abi.h" #include "nt_object.h" #include "nt_memory.h" typedef enum _nt_section_info_class { NT_SECTION_BASIC_INFORMATION, NT_SECTION_IMAGE_INFORMATION } nt_section_info_class; typedef enum _nt_section_inherit { NT_VIEW_SHARE = 1, NT_VIEW_UNMAP = 2 } nt_section_inherit; /* section attributes */ #define NT_SEC_BASED 0x00200000 #define NT_SEC_NO_CHANGE 0x00400000 #define NT_SEC_FILE 0x00800000 #define NT_SEC_IMAGE 0x01000000 #define NT_SEC_VLM 0x02000000 #define NT_SEC_RESERVE 0x04000000 #define NT_SEC_COMMIT 0x08000000 #define NT_SEC_NOCACHE 0x10000000 #define NT_SEC_IMAGE_NO_EXECUTE 0x11000000 #define NT_SEC_LARGE_PAGES 0x80000000 #define NT_SEC_WRITECOMBINE 0x40000000 /* section memory allocation attributes */ #define NT_SEC_AT_EXTENDABLE_FILE 0x00002000 /* view may exceed section size */ #define NT_SEC_AT_RESERVED 0x20000000 /* ignored */ #define NT_SEC_AT_ROUND_TO_PAGE 0x40000000 /* adjust address and/or size as necessary */ /* section access bits */ #define NT_SECTION_QUERY 0x00000001 #define NT_SECTION_MAP_WRITE 0x00000002 #define NT_SECTION_MAP_READ 0x00000004 #define NT_SECTION_MAP_EXECUTE 0x00000008 #define NT_SECTION_EXTEND_SIZE 0x00000010 #define NT_SECTION_MAP_EXECUTE_EXPLICIT 0x00000020 #define NT_STANDARD_RIGHTS_REQUIRED 0x000F0000 #define NT_SECTION_ALL_ACCESS NT_STANDARD_RIGHTS_REQUIRED \ | NT_SECTION_QUERY \ | NT_SECTION_MAP_WRITE \ | NT_SECTION_MAP_READ \ | NT_SECTION_MAP_EXECUTE \ | NT_SECTION_EXTEND_SIZE typedef struct _nt_section_basic_information { void * base_address; uint32_t section_attr; nt_large_integer section_size; } nt_section_basic_information, nt_sbi; typedef struct _nt_section_image_information { void * entry_point; uint32_t stack_zero_bits; size_t stack_reserve; size_t stack_commit; uint32_t subsystem; uint16_t subsystem_minor_version; uint16_t subsystem_major_version; uint32_t unknown; uint32_t characteristics; uint16_t image_number; unsigned char executable; unsigned char image_flags; uint32_t loader_flags; uint32_t image_file_size; uint32_t image_checksum; } nt_section_image_information, nt_sec_img_inf; typedef int32_t __stdcall ntapi_zw_create_section( __out void ** hsection, __in uint32_t desired_access, __in nt_object_attributes * obj_attr, __in nt_large_integer * section_size __optional, __in uint32_t section_protect, __in uint32_t section_attr, __in void * hfile); typedef int32_t __stdcall ntapi_zw_open_section( __out void ** hsection, __in uint32_t desired_access, __in nt_object_attributes * obj_attr); typedef int32_t __stdcall ntapi_zw_query_section( __in void * hsection, __in nt_section_info_class sec_info_class, __out void * sec_info, __in size_t sec_info_length, __out size_t * returned_length __optional); typedef int32_t __stdcall ntapi_zw_extend_section( __in void * hsection, __in nt_large_integer * section_size); typedef int32_t __stdcall ntapi_zw_map_view_of_section( __in void * hsection, __in void * hprocess, __in_out void ** base_address, __in uint32_t zero_bits, __in size_t commit_size, __in_out nt_large_integer * section_offset __optional, __in_out size_t * view_size, __in nt_section_inherit section_inherit_disposition, __in uint32_t allocation_type, __in uint32_t protect); typedef int32_t __stdcall ntapi_zw_unmap_view_of_section( __in void * hprocess, __in void * base_address); typedef int32_t __stdcall ntapi_zw_are_mapped_files_the_same( __in void * addr_1st, __in void * addr_2nd); /* extensions */ typedef int32_t __stdcall ntapi_tt_get_section_name( __in void * addr, __out nt_mem_sec_name * buffer, __in uint32_t buffer_size); #endif