[Autogenerated] here are the most common APIs to use with memory
mapped files in user mode and kernel mode.
In user mode we first have to create a file mapping object or a section
object by calling the create file mapping app This creates a section
object and could be based on the page file,
which means recyclable memory or could be based on a particular
file where we call the create file before that in order to
establish the file to become the backup,
you can also open an existing fine mapping object by name if it is in
fact provided such a name and this is very useful for sharing purposes
as we'll see in the next demonstration,
once you have a handle to the memory mapped file
with either one of these functions,
you can map views into your address space by calling map
view or file or the extended version.
In fact,
there's a few more versions that are relatively new and they provide
essentially the same functionality to be able to map portion or the
entire memory there of the file or whatever we're sharing to the
address space of the process.
You can map everything if the mapping is not that big,
but you can also map very small pieces depending what you're trying to do.
So you might be accessing a very big file,
could be gigabyte in size even more,
then you can map small pieces of it and do the work on that mapping,
then you can map and map a different window into your address space.
So you can use that scheme as many times as required in kernel mode.
The basic APIs are essentially the same,
but the term used is section rather than memory mapped file.
So we have the ZW create section,
which is the API to open or create a memory mapped file
object or a section object to be more precise,
which is of course the same thing.
And then in order to perform the mapping,
the function is the W map view of section.
There's also the invariant anti create section anti map view of section.
These are the actual native APIs or the system calls the ZW
variants are the ones used by kernel developers in order to
bypass security checks will be able to do more without having
various checks happening on them.
And this is why these ZW functions exist,
let's see they use them with APIs in action in the following demo.