The ZwUnmapViewOfSection routine unmaps a view of a section from the virtual address space of a subject process.

NTSTATUS 
  ZwUnmapViewOfSection(
    IN HANDLE  ProcessHandle,
    IN PVOID  BaseAddress
    );

Parameters

ProcessHandle

Handle to a process object that was previously passed to ZwMapViewOfSection.

BaseAddress

Pointer to the base virtual address of the view to unmap. This value can be any virtual address within the view.

Return Value

ZwUnmapViewOfSection returns an NTSTATUS value. Possible return values include:

STATUS_SUCCESS

The routine successfully performed the requested operation.

STATUS_ACCESS_DENIED

The caller does not have access rights to the process object or to the base virtual address of the view.

Comments

This routine unmaps the entire view of the section that contains BaseAddress from the virtual address space of the specified process—even if BaseAddress does not point to the beginning of the view.

On return from ZwUnmapViewOfSection, the virtual-address region occupied by the view is no longer reserved and is available to map other views or private pages. If the view was also the last reference to the underlying section, all committed pages in the section are decommitted, and the section is deleted.

Note  If the call to this function occurs in user mode, you should use the name "NtUnmapViewOfSection" instead of "ZwUnmapViewOfSection".

Requirements

IRQL: PASSIVE_LEVEL

Headers: Declared in Wdm.h. Include Wdm.h, Ntddk.h, or Ntifs.h.

See Also

ZwMapViewOfSection, ZwOpenSection