NtMapViewOfSectionEx

Prototype

NTSTATUS NtMapViewOfSectionEx(
  HANDLE                  SectionHandle,
  HANDLE                  ProcessHandle,
  PVOID                  *BaseAddress,
  PLARGE_INTEGER          SectionOffset,
  PSIZE_T                 ViewSize,
  ULONG                   AllocationType,
  ULONG                   Win32Protect,
  PMEM_EXTENDED_PARAMETER ExtendedParameters,
  ULONG                   ParameterCount
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 1E 01 00 00      mov eax, 0x11E     ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Introduced in Windows 10 1809 (Redstone 5) as the section-mapping analogue of `NtAllocateVirtualMemoryEx`. The key addition over `NtMapViewOfSection` is the `ExtendedParameters` array, which currently accepts `MemExtendedParameterAddressRequirements` (LowestStartingAddress / HighestEndingAddress / Alignment), `MemExtendedParameterAttributeFlags` (`MEM_EXTENDED_PARAMETER_EC_CODE`, `MEM_EXTENDED_PARAMETER_IMAGE_NO_HOTPATCH`), and `MemExtendedParameterImageMachine` (Arm64EC). The address-range constraint is what makes it interesting for offensive tooling — you can request that the mapping land above the 32-bit boundary, or away from a specific known scanner heuristic range. Not present on Windows 10 1507–1709.

Common malware usage

Used by modern reflective and module-stomping loaders that want fine-grained control over the mapping address. **Phantom DLL Hollowing** (Forrest Orr, 2020) maps a clean-on-disk Microsoft-signed DLL with `SEC_IMAGE` via `NtCreateSection` + `NtMapViewOfSectionEx`, then overwrites the `.text` pages while the kernel still believes the mapping is image-backed and signed — defeating EDR module-hash checks. The `MemExtendedParameterAddressRequirements` parameter is also used by offensive code to mimic the high-address mapping behaviour of `LoadLibraryEx`, blending in with legitimate module bases. SSN unavailable on Windows 10 1507–1709, so loaders that target those builds must fall back to plain `NtMapViewOfSection`.

Detection opportunities

Almost all use of `NtMapViewOfSectionEx` for executable mappings is anomalous outside of a small set of system loaders (`ntdll!LdrpMapViewOfSection`, `wow64cpu`). EDR products that hook this routine in ntdll catch most non-system callers; direct-syscall users bypass that but still trigger ETW `Microsoft-Windows-Kernel-Process` ImageLoad events when the mapped section is an image — and *missing* an ImageLoad event for an executable mapping is itself an IOC (manual-map evasion). Hunt for image-section maps where the backing file does not subsequently appear in the loaded-modules list (`PEB_LDR_DATA`).

Direct syscall examples

// Force the mapping to land above 0x0000_0001_0000_0000 to dodge
// scanner heuristics that focus on low VAs.
MEM_EXTENDED_PARAMETER ep[1] = {0};
MEM_ADDRESS_REQUIREMENTS req = {0};
req.LowestStartingAddress  = (PVOID)0x0000000100000000ULL;
req.HighestEndingAddress   = (PVOID)0x00007FFFFFFFFFFFULL;
req.Alignment              = 0; // default 64 KiB

ep[0].Type    = MemExtendedParameterAddressRequirements;
ep[0].Pointer = &req;

PVOID base = NULL; SIZE_T viewSize = 0;
NTSTATUS s = NtMapViewOfSectionEx(
    hSection, NtCurrentProcess(),
    &base, NULL, &viewSize,
    0, PAGE_EXECUTE_READ,
    ep, 1);

; NtMapViewOfSectionEx direct stub — SSN 0x11E on Win11 24H2.
; Note: ParameterCount is the 9th argument; spilled onto the stack per
; the Win64 calling convention (shadow + 5th slot).
NtMapViewOfSectionEx PROC
    mov  r10, rcx
    mov  eax, 11Eh
    syscall
    ret
NtMapViewOfSectionEx ENDP

// Phantom DLL Hollowing (Forrest Orr, 2020) — abbreviated.
// 1) Open kernelbase.dll as a SEC_IMAGE section.
// 2) Map it with NtMapViewOfSectionEx into our process.
// 3) Overwrite the .text bytes with shellcode while the kernel still
//    believes the region is signed image-backed memory.
use ntapi::ntmmapi::NtMapViewOfSectionEx;
use winapi::shared::ntdef::{HANDLE, PVOID};
use std::{mem, ptr::null_mut};

unsafe fn map_image(section: HANDLE) -> PVOID {
    let mut base: PVOID = null_mut();
    let mut view: usize = 0;
    let s = NtMapViewOfSectionEx(
        section,
        -1isize as HANDLE, // NtCurrentProcess()
        &mut base,
        null_mut(),
        &mut view,
        0,
        0x20, // PAGE_EXECUTE_READ
        null_mut(),
        0,
    );
    assert!(s >= 0);
    base
}

MITRE ATT&CK mappings

• T1055.012Process Hollowingmitre ↗
• T1620Reflective Code Loadingmitre ↗
• T1106Native APImitre ↗