| Previous | Next |
| STATUS_PORT_ALREADY_SET | STATUS_SUSPEND_COUNT_EXCEEDED |
STATUS_SECTION_NOT_IMAGE
The section is data-backed rather than an image section
Windows distinguishes ordinary data mappings from image sections created with image semantics. An image section is interpreted according to PE headers, with per-section protections, relocation behavior, and loader metadata. This status appears when code asks for image information on a page-file or ordinary file mapping.
Mapping an executable file as read-only data does not convert the resulting section into an image section. That mode is useful for inspection, but loader-oriented queries and execution assumptions require a section created through the image path.
What to inspect
- Record how the section was created, including SEC_IMAGE or related allocation attributes.
- Verify that the handle supplied to the query is the intended section and was not replaced by a data-mapping handle.
- Use file parsing APIs or a PE parser when the goal is offline inspection rather than executable loading.
- Do not infer executable page protections from an ordinary mapping of a file that happens to contain PE bytes.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: CreateFileMapping
- Microsoft: ZwCreateSection
- Microsoft: PE and COFF format
Looking for a different code? Search another status or error code.