Geoff Chappell, Software Analyst
The SYSTEM_SESSION_MAPPED_VIEW_INFORMATION structure provides input to the ZwQuerySystemInformation or NtQuerySystemInformation function when given the information class SystemSessionMappedViewInformation (0x44). An array of the structures is produced as output.
As input, only the SessionId member is meaningful. It specifies the session for which information is to be retrieved, or can be -1 for all sessions.
The SYSTEM_SESSION_MAPPED_VIEW_INFORMATION structure is not documented.
The SYSTEM_SESSION_MAPPED_VIEW_INFORMATION is 0x14 or 0x20 bytes in 32-bit and 64-bit Windows, respectively.
Offset (x86) | Offset (x64) | Definition | Remarks |
---|---|---|---|
0x00 | 0x00 |
ULONG_PTR NextEntryOffset; |
output |
0x04 | 0x08 |
ULONG SessionId; |
both |
0x08 | 0x0C |
ULONG ViewFailures; |
output |
0x0C | 0x10 |
ULONG_PTR NumberOfBytesAvailable; |
output |
0x10 | 0x18 |
ULONG_PTR NumberOfBytesAvailableContiguous; |
output |
In each structure in the output array, the NextEntryOffset is the offset from the start of the output buffer to the next structure, or is zero in the last structure.