ZwOpenSection

The ZwOpenSection routine opens a handle for an existing section object.

NTSTATUS 
  ZwOpenSection(
    OUT PHANDLE  SectionHandle,
    IN ACCESS_MASK  DesiredAccess,
    IN POBJECT_ATTRIBUTES  ObjectAttributes
    );

Parameters

SectionHandle

Pointer to a variable that will receive the section object handle if this call is successful. The driver must close the handle with ZwClose once the handle is no longer in use.

DesiredAccess

Specifies an ACCESS_MASK value representing the requested access to the object. The set of system-defined DesiredAccess flags relevant to device and intermediate drivers are the following.

DesiredAccess Flags	Meaning
SECTION_MAP_WRITE	A mapped view can be written.
SECTION_MAP_READ	A mapped view can be read.

A caller can specify SECTION_ALL_ACCESS, which sets all of the defined flags ORed with the system-defined STANDARD_RIGHTS_REQUIRED.

ObjectAttributes

Pointer to the initialized object attributes of the section to be opened. If the caller is not running in the system process context, it must set the OBJ_KERNEL_HANDLE attribute for ObjectAttributes. For details, see InitializeObjectAttributes.

Headers

Declared in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Return Value

ZwOpenSection returns STATUS_SUCCESS on success, or the appropriate error code on failure. Possible return values include:

STATUS_SUCCESS
STATUS_ACCESS_DENIED
STATUS_INVALID_HANDLE

Comments

If the specified section does not exist or the access requested is not allowed, the operation fails.

Driver routines that run in a process context other than that of the system process must set the OBJ_KERNEL_HANDLE attribute for the ObjectAttributes parameter of ZwOpenSection. This restricts the use of the handle returned by ZwOpenSection to processes running only in kernel mode. Otherwise, the handle can be accessed by the process in whose context the driver is running. Drivers can call InitializeObjectAttributes to set the OBJ_KERNEL_HANDLE attribute as follows.

InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);

Callers of ZwOpenSection must be running at IRQL = PASSIVE_LEVEL.

See Also

ACCESS_MASK, InitializeObjectAttributes, ZwCreateSection, ZwMapViewOfSection, ZwUnmapViewOfSection