Edit

Share via

MmForceSectionClosedEx function (ntifs.h)

  • Article

The MmForceSectionClosedEx function examines the section object pointers. If they are NULL, no further action is taken and the value TRUE is returned.

If the section object pointer is not NULL, the section reference count and the map view count are checked. If both counts are zero, the segment associated with the file is deleted and the file closed. If one of the counts is non-zero, no action is taken and the value FALSE is returned.

Syntax

BOOLEAN MmForceSectionClosedEx(
  PSECTION_OBJECT_POINTERS SectionObjectPointer,
  ULONG                    ForceCloseFlags
);

Parameters

SectionObjectPointer

Specifies a pointer to the SECTION_OBJECT_POINTERS object.

ForceCloseFlags

Contains flags that indicate if the section should be marked for closing later (as soon as possible) in the event this section cannot be closed now due to outstanding references.

Contains one of the following flags:

  • MM_FORCE_CLOSED_LATER_OK if the section should be marked for immediate closing in the event that the section cannot be closed due to outstanding references.

  • MM_FORCE_CLOSED_DATA to force data section closure.

  • MM_FORCE_CLOSED_IMAGE to force image section closure.

Return value

This function returns TRUE if the segment was deleted and the file closed or no segment was located. If more than one segment type is specified (data/image) then they must both be successfully deleted for TRUE to be returned.

This function returns FALSE if the segment was not deleted.

Requirements

Requirement Value
Minimum supported client Windows 10 (Version 1803)
Target Platform Universal
Header ntifs.h
Library NtosKrnl.exe