Geoff Chappell, Software Analyst
SKETCH OF HOW RESEARCH MIGHT CONTINUE AND RESULTS BE PRESENTED
This function opens a memory partition.
NTSTATUS NtOpenPartition ( HANDLE *PartitionHandle, ULONG DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes);
The PartitionHandle argument is the address of a variable that is to receive a handle to the opened partition.
The DesiredAccess argument is an access mask of generic, standard and specific rights that are wanted to the opened partition. The specific rights MEMORY_PARTITION_QUERY_ACCESS (0x01) and MEMORY_PARTITION_MODIFY_ACCESS (0x02) are defined in WDM.H and WINNT.H.
The ObjectAttributes argument specifies a name and other properties for the opened partition.
The function returns STATUS_SUCCESS if successful, else a negative error code.
The NtOpenPartition function and its alias ZwOpenPartition are exported by name from NTDLL in version 10.0 and higher. In kernel mode, where ZwOpenPartition is a stub and NtOpenPartition is the implementation, neither is exported until the 1607 release of Windows exports the stub.
For all practical effect, the functions are available only in 64-bit Windows. As exports from the 32-bit NTDLL, they do exist, but only to return STATUS_NOT_SUPPORTED.
Neither NtOpenPartition nor its alias is documented. As ZwOpenPartition, it is declared in the ZWAPI.H file from an Enterprise edition of the Windows Driver Kit (WDK) for the 1511 release of Windows 10.