From e3d7eab4dfbc93543b9c137e9506081c0708fe2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Mon, 23 Mar 2026 09:54:04 +0800
Subject: [PATCH] Binary (Windows): prefers NT APIs

---
 src/common/impl/binary_windows.c | 15 ++++++++-------
 src/common/windows/nt.h          | 33 ++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 7 deletions(-)

diff --git a/src/common/impl/binary_windows.c b/src/common/impl/binary_windows.c
index 980c0d313..75d8cba0f 100644
--- a/src/common/impl/binary_windows.c
+++ b/src/common/impl/binary_windows.c
@@ -21,13 +21,14 @@ const char* ffBinaryExtractStrings(const char *peFile, bool (*cb)(const char *st
     if (hFile == INVALID_HANDLE_VALUE)
         return "CreateFileA() failed";
 
-    FF_AUTO_CLOSE_FD HANDLE hMap = CreateFileMappingW(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
-    if (!hMap)
-        return "CreateFileMappingW() failed";
+    FF_AUTO_CLOSE_FD HANDLE hSection = NULL;
+    if (!NT_SUCCESS(NtCreateSection(&hSection, SECTION_MAP_READ, NULL, NULL, PAGE_READONLY, SEC_COMMIT, hFile)))
+        return "NtCreateSection() failed";
 
-    void* base = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);
-    if (!base)
-        return "MapViewOfFile() failed";
+    PVOID base = NULL;
+    SIZE_T viewSize = 0;
+    if (!NT_SUCCESS(NtMapViewOfSection(hSection, NtCurrentProcess(), &base, 0, 0, NULL, &viewSize, ViewUnmap, 0, PAGE_READONLY)))
+        return "NtMapViewOfSection() failed";
 
     PIMAGE_NT_HEADERS ntHeaders = RtlImageNtHeader(base);
     if (!ntHeaders)
@@ -61,6 +62,6 @@ const char* ffBinaryExtractStrings(const char *peFile, bool (*cb)(const char *st
         }
     }
 
-    UnmapViewOfFile(base);
+    NtUnmapViewOfSection(NtCurrentProcess(), base);
     return NULL;
 }
diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h
index f7acbf61f..ac586f0b4 100644
--- a/src/common/windows/nt.h
+++ b/src/common/windows/nt.h
@@ -1330,3 +1330,36 @@ NTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddress(
     _In_opt_ ULONG ProcedureNumber,
     _Out_ PVOID *ProcedureAddress
 );
+
+typedef enum _SECTION_INHERIT {
+    ViewShare = 1,
+    ViewUnmap = 2
+} SECTION_INHERIT;
+
+NTSYSAPI NTSTATUS NTAPI NtCreateSection(
+    _Out_ PHANDLE SectionHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ PLARGE_INTEGER MaximumSize,
+    _In_ ULONG SectionPageProtection,
+    _In_ ULONG AllocationAttributes,
+    _In_opt_ HANDLE FileHandle
+);
+
+NTSYSAPI NTSTATUS NTAPI NtMapViewOfSection(
+    _In_ HANDLE SectionHandle,
+    _In_ HANDLE ProcessHandle,
+    _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress,
+    _In_ ULONG_PTR ZeroBits,
+    _In_ SIZE_T CommitSize,
+    _Inout_opt_ PLARGE_INTEGER SectionOffset,
+    _Inout_ PSIZE_T ViewSize,
+    _In_ SECTION_INHERIT InheritDisposition,
+    _In_ ULONG AllocationType,
+    _In_ ULONG PageProtection
+);
+
+NTSYSAPI NTSTATUS NTAPI NtUnmapViewOfSection(
+    _In_ HANDLE ProcessHandle,
+    _In_opt_ PVOID BaseAddress
+);