0

What does this mean? I know that NtUnMapViewOfSection is a pointer to a Winapi function with 2 parameters and a long return value. And I know that this chunk is casting "GetProcAddress" with its arguments to a NtUnmapViewOfSection object. But what is the last row doing? 

typedef LONG (WINAPI * NtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress);

NtUnmapViewOfSection xNtUnmapViewOfSection;
xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"));
xNtUnmapViewOfSection(Pinfo.hProcess, PVOID(dwImageBase)); // Pinfo is PROCESS_INFORMATION and dwImageBase is a pointer to DWORD
MenNotAtWork
  • 145
  • 2
  • 8
  • Possible duplicate of [Typedef function pointer?](https://stackoverflow.com/questions/4295432/typedef-function-pointer) – Axalo Sep 16 '19 at 14:03
  • 2
    `xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"));` is a unusual way of doing a cast. If it were written as `xNtUnmapViewOfSection = (NtUnmapViewOfSection)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection");` that might be clearer that we're assigning to the function pointer (and NOT calling the function as you might naively assume). – Mike Vine Sep 16 '19 at 14:04

1 Answers1

2

what is the last row doing?

The last line is calling the function you got a pointer to with GetProcAddress() - that is, it is calling NtUnmapViewOfSection().

Remy Lebeau
  • 555,201
  • 31
  • 458
  • 770
Ted Lyngmo
  • 93,841
  • 5
  • 60
  • 108