Type a page name and press Enter. You'll jump to the page if it exists, or you can create it if it doesn't.
To create a page in a module other than ntdll, prefix the name with the module name and a period.
[DllImport("ntdll.dll")]
def NtCreateSection(ref SectionHandle as IntPtr, DesiredAccess as UInt32, ObjectAttributes as IntPtr, ref MaximumSize as LARGE_INTEGER, SectionPageProtection as UInt32, AllocationAttributes as UInt32, FileHandle as IntPtr) as UInt32:
pass
User-Defined Types:
[StructLayout(LayoutKind.Explicit, Size:8)]
struct LARGE_INTEGER:
[FieldOffset(0)]QuadPart as UInt64
[FieldOffset(0)]LowPart as UInt32
[FieldOffset(4)]HighPart as UInt32
Alternative Managed API:
Do you know one? Please contribute it!
Notes:
None.
Tips & Tricks:
Please add some!
C# Code:
//Below is the sample code for creating Section with RWX permissions.
IntPtr SectionHandle = IntPtr.Zero;
uint MaximumSize = 2048;
private static uint SEC_COMMIT = 0x08000000;
private static uint SECTION_MAP_WRITE = 0x0002;
private static uint SECTION_MAP_READ = 0x0004;
private static uint SECTION_MAP_EXECUTE = 0x0008;
private static uint SECTION_ALL_ACCESS = SECTION_MAP_WRITE | SECTION_MAP_READ | SECTION_MAP_EXECUTE;
uint res = NtCreateSection(ref SectionHandle, SECTION_ALL_ACCESS, IntPtr.Zero, ref MaximumSize, EXECUTE_READ_WRITE, SEC_COMMIT,IntPtr.Zero);
// res = 0 indicates a successful creation of section
//Below is the sample code for creating Section with RWX permissions.
An IntPtr is a pointer to a memory location (unmanaged) that adapts to the platform it is running on (64-bit, etc.) UNLIKE a standard int/Integer. You should always use this type for unmanaged calls that require it, even though an int will appear to work on your development machine.
1/13/2008 4:00:13 AM - Damon Carr-72.43.165.29
An IntPtr is a pointer to a memory location (unmanaged) that adapts to the platform it is running on (64-bit, etc.) UNLIKE a standard int/Integer. You should always use this type for unmanaged calls that require it, even though an int will appear to work on your development machine.
1/13/2008 4:00:13 AM - Damon Carr-72.43.165.29
An IntPtr is a pointer to a memory location (unmanaged) that adapts to the platform it is running on (64-bit, etc.) UNLIKE a standard int/Integer. You should always use this type for unmanaged calls that require it, even though an int will appear to work on your development machine.
1/13/2008 4:00:13 AM - Damon Carr-72.43.165.29
Please edit this page!
Do you have...
helpful tips or sample code to share for using this API in managed code?
corrections to the existing content?
variations of the signature you want to share?
additional languages you want to include?
Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).
Revisions