Typedef pointer to WINAPI function with 2 parameters

Question

What does this mean? I know that NtUnMapViewOfSection is a pointer to a Winapi function with 2 parameters and a long return value. And I know that this chunk is casting "GetProcAddress" with its arguments to a NtUnmapViewOfSection object. But what is the last row doing?

typedef LONG (WINAPI * NtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress);

NtUnmapViewOfSection xNtUnmapViewOfSection;
xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"));
xNtUnmapViewOfSection(Pinfo.hProcess, PVOID(dwImageBase)); // Pinfo is PROCESS_INFORMATION and dwImageBase is a pointer to DWORD

xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection")); is a unusual way of doing a cast. If it were written as xNtUnmapViewOfSection = (NtUnmapViewOfSection)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"); that might be clearer that we're assigning to the function pointer (and NOT calling the function as you might naively assume). — Mike Vine
– Mike Vine, Commented Sep 16, 2019 at 14:04

Remy Lebeau · Accepted Answer · 2019-09-16 16:29:19Z

2

what is the last row doing?

The last line is calling the function you got a pointer to with GetProcAddress() - that is, it is calling NtUnmapViewOfSection().

edited Sep 16, 2019 at 16:29

Remy Lebeau

609k36 gold badges516 silver badges875 bronze badges

answered Sep 16, 2019 at 14:00

Ted Lyngmo

124k7 gold badges93 silver badges155 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Typedef pointer to WINAPI function with 2 parameters

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related