goofy_map_image.cpp

IO_STATUS_BLOCK iosb;
UNICODE_STRING path = RTL_CONSTANT_STRING(L"\\SystemRoot\\System32\\ntdll.dll");
OBJECT_ATTRIBUTES attr = RTL_CONSTANT_OBJECT_ATTRIBUTES(&path, 0);
HANDLE file, section;

// only FILE_EXECUTE
NTSTATUS status = NtCreateFile(&file, FILE_EXECUTE, &attr, &iosb, nullptr, 0, 0, FILE_OPEN, 0, nullptr, 0);
printf("NtCreateFile %lx\n", status);

// request PAGE_EXECUTE when creating - the only permission compatible with FILE_EXECUTE.
status = NtCreateSection(&section, SECTION_MAP_READ, nullptr, nullptr, PAGE_EXECUTE, SEC_IMAGE, file);
printf("NtCreateSection %lx\n", status);

void* base = nullptr;
SIZE_T ViewSize = 0;
// map the view with PAGE_NOACCESS because that's the only compatible page protection in this combo...
status = NtMapViewOfSection(section, NtCurrentProcess(), &base, 0, 0, nullptr, &ViewSize, ViewUnmap, 0, PAGE_NOACCESS);
printf("NtMapViewOfSection %lx @ %p\n", status, base);