3 ms·

Yeah, but the link talks about `ZwMapViewOfSection`. From that page: > For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native Sys

by skrellm 23d ago

Yeah, but the link talks about `ZwMapViewOfSection`. From that page: > For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. How "differently" exactly? That's undocumented. And lots of other small (but very important) details are undocumented as well.

not_a9 22d ago
> PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg ZwMapViewOfSection 2072 80F 001612B0 ZwMapViewOfSection 2073 810 00163160 ZwMapViewOfSectionEx > PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg NtMapViewOfSection 425 1A0 001612B0 NtMapViewOfSection 426 1A1 00163160 NtMapViewOfSectionEx > How "differently" exactly? That's undocumented. https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/using-nt-and-zw-versions-of-the-native-system-services-routines https://learn.microsoft.com/en-us/windows-hardware/drivers/k...