NtCancelIoFile

Prototype

NTSTATUS NtCancelIoFile(
  HANDLE           FileHandle,
  PIO_STATUS_BLOCK IoStatusBlock
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 5D 00 00 00      mov eax, 0x5D
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

SSN `0x5D` across every Windows 10 / 11 / Server build — exceptional stability for a file-I/O syscall. The critical scope caveat: NtCancelIoFile cancels only I/O issued by *the calling thread* on the given handle. It does *not* affect I/O issued by other threads against the same handle (that is what NtCancelIoFileEx was introduced for in Vista). The Win32 `CancelIo` wraps this call directly. The kernel walks the IRP list attached to the thread's TCB and the file's FsContext, marks each `IRP->Cancel = TRUE` and calls the driver's cancel routine, which is expected to complete the IRPs with `STATUS_CANCELLED` (0xC0000120).

Common malware usage

Used in defensive **EDR hook evasion** patterns: many user-mode EDRs hook `ReadFile` / `WriteFile` / `NtReadFile` to inspect content; if the inspection routine is asynchronous (queueing a callback on I/O completion), an attacker can race-cancel the IRP before the completion routine fires, preventing the EDR from ever observing the bytes. More common in offensive use is reliability code in implants that talk over named pipes — if the peer dies, the implant fires `NtCancelIoFile` to flush blocked overlapped reads and recover the worker thread instead of hanging until the kernel TCP / pipe timeout. Some red-team tooling also calls it as part of a graceful shutdown to avoid leaving orphan IRPs that surface in `!irp` debugger output during forensic timeline review.

Detection opportunities

NtCancelIoFile is extremely common in legitimate I/O-heavy software (browsers cancelling in-flight HTTPS reads on navigation, IDEs cancelling file watchers, OneDrive cancelling sync on offline-toggle) and is therefore a poor primary signal. The interesting telemetry is the *triplet*: an outstanding async read against a sensitive handle (named-pipe \\.\pipe\protected_storage_pipe, an EDR-injected IPC handle, an HTTPS socket carrying C2) cancelled within microseconds of issue by the same thread that issued it. ETW `Microsoft-Windows-Kernel-File` plus completion-IRP correlation via WPP can show the cancelled IRP's path; combine with PsSetCreateProcessNotifyRoutineEx to attribute thread-to-process. Most EDRs do not expose a first-class cancel event.

Direct syscall examples

; Direct syscall stub for NtCancelIoFile (SSN 0x5D, all builds)
NtCancelIoFile PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 5Dh          ; SSN
    syscall
    ret
NtCancelIoFile ENDP

// Implant teardown: when the C2 peer dies, free our blocked overlapped
// read on the named pipe so the worker thread can exit instead of hanging.
#include <windows.h>

typedef struct _IO_STATUS_BLOCK {
    union { NTSTATUS Status; PVOID Pointer; };
    ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef NTSTATUS (NTAPI *pNtCancelIoFile)(HANDLE, PIO_STATUS_BLOCK);

void ShutdownPipe(HANDLE h_pipe) {
    pNtCancelIoFile NtCancelIoFile = (pNtCancelIoFile)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtCancelIoFile");
    IO_STATUS_BLOCK iosb = {0};
    NtCancelIoFile(h_pipe, &iosb);   // only kills this thread's pending IRPs
    CloseHandle(h_pipe);
}

// PoC: dispatch an async read, then cancel before the EDR's completion
// inspection runs. Same thread issues and cancels.
use windows_sys::Win32::Foundation::HANDLE;
use windows_sys::Win32::Storage::FileSystem::{ReadFile, OVERLAPPED};
use windows_sys::Win32::System::IO::CancelIo;

pub unsafe fn race_cancel(h: HANDLE, buf: &mut [u8], ov: *mut OVERLAPPED) {
    let mut dummy = 0u32;
    let _ = ReadFile(h, buf.as_mut_ptr() as _, buf.len() as u32, &mut dummy, ov);
    // Immediately yank the IRP before any completion routine fires.
    let _ = CancelIo(h);  // CancelIo == NtCancelIoFile under the hood
}

MITRE ATT&CK mappings

• T1562.001Impair Defenses: Disable or Modify Toolsmitre ↗
• T1106Native APImitre ↗