ZwUnmapViewOfSection

The ZwUnmapViewOfSection routine unmaps a view of a section from the virtual address space of a subject process.

NTSTATUS 
  ZwUnmapViewOfSection(
    IN HANDLE  ProcessHandle,
    IN PVOID  BaseAddress
    );

Parameters

ProcessHandle

Handle to a process object that was previously passed to ZwMapViewOfSection.

BaseAddress

Pointer to the base virtual address of the view that is to be unmapped. This value can be any virtual address within the view.

Headers

Declared in wdm.h and ntddk.h. Include wdm.h or ntddk.h.

Return Value

ZwUnmapViewOfSection returns an NTSTATUS value. Possible return values include:

STATUS_SUCCESS
STATUS_INVALID_PARAMETER
STATUS_NO_ACCESS

Comments

The entire view of the section specified by the BaseAddress parameter is unmapped from the virtual address space of the specified process.

The virtual address region occupied by the view is no longer reserved and is available to map other views or private pages. If the view was also the last reference to the underlying section, then all committed pages in the section are decommitted and the section is deleted.

Callers of ZwUnmapViewOfSection must be running at IRQL = PASSIVE_LEVEL.

See Also

ZwMapViewOfSection, ZwOpenSection