Binary (Windows): prefers NT APIs

src/common/impl/binary_windows.c

@@ -21,13 +21,14 @@ const char* ffBinaryExtractStrings(const char *peFile, bool (*cb)(const char *st
     if (hFile == INVALID_HANDLE_VALUE)
         return "CreateFileA() failed";
 
-    FF_AUTO_CLOSE_FD HANDLE hMap = CreateFileMappingW(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
-    if (!hMap)
-        return "CreateFileMappingW() failed";
+    FF_AUTO_CLOSE_FD HANDLE hSection = NULL;
+    if (!NT_SUCCESS(NtCreateSection(&hSection, SECTION_MAP_READ, NULL, NULL, PAGE_READONLY, SEC_COMMIT, hFile)))
+        return "NtCreateSection() failed";
 
-    void* base = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);
-    if (!base)
-        return "MapViewOfFile() failed";
+    PVOID base = NULL;
+    SIZE_T viewSize = 0;
+    if (!NT_SUCCESS(NtMapViewOfSection(hSection, NtCurrentProcess(), &base, 0, 0, NULL, &viewSize, ViewUnmap, 0, PAGE_READONLY)))
+        return "NtMapViewOfSection() failed";
 
     PIMAGE_NT_HEADERS ntHeaders = RtlImageNtHeader(base);
     if (!ntHeaders)
@@ -61,6 +62,6 @@ const char* ffBinaryExtractStrings(const char *peFile, bool (*cb)(const char *st
         }
     }
 
-    UnmapViewOfFile(base);
+    NtUnmapViewOfSection(NtCurrentProcess(), base);
     return NULL;
 }

src/common/windows/nt.h

@@ -1330,3 +1330,36 @@ NTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddress(
     _In_opt_ ULONG ProcedureNumber,
     _Out_ PVOID *ProcedureAddress
 );
+
+typedef enum _SECTION_INHERIT {
+    ViewShare = 1,
+    ViewUnmap = 2
+} SECTION_INHERIT;
+
+NTSYSAPI NTSTATUS NTAPI NtCreateSection(
+    _Out_ PHANDLE SectionHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ PLARGE_INTEGER MaximumSize,
+    _In_ ULONG SectionPageProtection,
+    _In_ ULONG AllocationAttributes,
+    _In_opt_ HANDLE FileHandle
+);
+
+NTSYSAPI NTSTATUS NTAPI NtMapViewOfSection(
+    _In_ HANDLE SectionHandle,
+    _In_ HANDLE ProcessHandle,
+    _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress,
+    _In_ ULONG_PTR ZeroBits,
+    _In_ SIZE_T CommitSize,
+    _Inout_opt_ PLARGE_INTEGER SectionOffset,
+    _Inout_ PSIZE_T ViewSize,
+    _In_ SECTION_INHERIT InheritDisposition,
+    _In_ ULONG AllocationType,
+    _In_ ULONG PageProtection
+);
+
+NTSYSAPI NTSTATUS NTAPI NtUnmapViewOfSection(
+    _In_ HANDLE ProcessHandle,
+    _In_opt_ PVOID BaseAddress
+);