NTSTATUS 0xC0000049 (STATUS_SECTION_NOT

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Image-specific information was requested from a section that was not created as a PE image mapping.

Previous	Next
STATUS_PORT_ALREADY_SET	STATUS_SUSPEND_COUNT_EXCEEDED

STATUS_SECTION_NOT_IMAGE

The section is data-backed rather than an image section

Windows distinguishes ordinary data mappings from image sections created with image semantics. An image section is interpreted according to PE headers, with per-section protections, relocation behavior, and loader metadata. This status appears when code asks for image information on a page-file or ordinary file mapping.

Mapping an executable file as read-only data does not convert the resulting section into an image section. That mode is useful for inspection, but loader-oriented queries and execution assumptions require a section created through the image path.

What to inspect

Record how the section was created, including SEC_IMAGE or related allocation attributes.
Verify that the handle supplied to the query is the intended section and was not replaced by a data-mapping handle.
Use file parsing APIs or a PE parser when the goal is offline inspection rather than executable loading.
Do not infer executable page protections from an ordinary mapping of a file that happens to contain PE bytes.

References

Looking for a different code? Search another status or error code.