what exactly does the NtUnmapViewOfSection method in ntdll.dll do?

Question

I came across the NtUnmapViewOfSection method, (ntdll.dll) and I don't quite understand what it does? Can you explain please. Thanks in advance.

Answer 1

The obvious answer is that it undoes what NtMapViewOfSection did.

To go a little more into the details. A section (known as a file mapping in Win32 officially) is a range of pages in a processes address space that represents the contents of a file (or "memory" in the page file case). Exactly how these pages map to parts of a file is a cooperation between the operating systems kernel and the CPU. You can read more about virtual memory and the Windows paging/caching model in the Windows Internals books.

Unmapping a section ends up removing this range of pages from the processes address space. Mapping and unmapping portions of a file must be done if the file is larger than the largest free range in a processes address space. Unmapping also decrements the reference count on the underlying section handle (file handle in Win32).