NtCancelSynchronousIoFile

Prototype

NTSTATUS NtCancelSynchronousIoFile(
  HANDLE           ThreadHandle,
  PIO_STATUS_BLOCK IoRequestToCancel,
  PIO_STATUS_BLOCK IoStatusBlock
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 95 00 00 00      mov eax, 0x95
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The cousin to NtCancelIoFileEx that targets *synchronous* I/O — calls like `ReadFile` against a handle that was opened without `FILE_FLAG_OVERLAPPED`, where the caller thread is sitting inside the kernel waiting for the IRP to complete and cannot itself service a cancel. The Win32 wrapper `CancelSynchronousIo` takes only the thread handle; the IO_STATUS_BLOCK targeting variant is reachable only through the native API. The SSN drifts modestly (`0x91` 1803–1909, `0x93` 2004–23H2, `0x95` 24H2 / Server 2025). Calling on a thread that isn't currently in a synchronous I/O wait returns `STATUS_NOT_FOUND` (0xC0000225) — benign.

Common malware usage

Less commonly weaponised than NtCancelIoFileEx but with a distinctive use case: **unblocking an EDR scanner thread**. Some user-mode EDRs run a worker that synchronously reads its IPC pipe (`\\.\pipe\<vendor>`) waiting for command messages. If an attacker can obtain a THREAD_TERMINATE-equivalent handle to that worker and the EDR's protection is already neutered, `NtCancelSynchronousIoFile` returns the worker to user mode with `STATUS_CANCELLED` — potentially knocking the sensor into a degraded state without killing the process (which would trip self-protection). Also used by red-team tooling to forcibly unstick a thread it injected into the target that ended up blocked on a long synchronous I/O (e.g. a NetUserGetInfo against a slow DC) so the injection can be unwound cleanly without orphaning the thread.

Detection opportunities

Genuinely rare in benign software. The flagship legitimate use is Explorer's pinned-network-drive disconnect path (Explorer fires NtCancelSynchronousIoFile to unstick the I/O thread blocking on a dead SMB share). Outside that narrow context, calls are suspicious. The high-fidelity signal is *cross-process*: thread A in process X calls NtCancelSynchronousIoFile with a handle to thread B in process Y, where Y is a service or EDR component. ETW `Microsoft-Windows-Kernel-Process` plus the cross-process handle-open events from `Microsoft-Windows-Kernel-Audit-API-Calls` correlate the open + cancel pair. Tightening ACLs on EDR service threads (so non-SYSTEM can't acquire THREAD_TERMINATE) defeats the bypass before the syscall is reachable.

Direct syscall examples

; Direct syscall stub for NtCancelSynchronousIoFile
NtCancelSynchronousIoFile PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 95h          ; SSN (Win11 24H2 / Server 2025)
    syscall
    ret
NtCancelSynchronousIoFile ENDP

// Free a thread we injected into a target process that ended up blocked
// in a synchronous I/O wait, so the injection can be cleanly unwound.
#include <windows.h>

typedef struct _IO_STATUS_BLOCK {
    union { NTSTATUS Status; PVOID Pointer; };
    ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef NTSTATUS (NTAPI *pNtCancelSynchronousIoFile)(
    HANDLE ThreadHandle, PIO_STATUS_BLOCK IoRequestToCancel,
    PIO_STATUS_BLOCK IoStatusBlock);

NTSTATUS Unstick(HANDLE h_thread) {
    pNtCancelSynchronousIoFile NtCancelSynchronousIoFile =
        (pNtCancelSynchronousIoFile)GetProcAddress(
            GetModuleHandleA("ntdll.dll"), "NtCancelSynchronousIoFile");
    IO_STATUS_BLOCK out = {0};
    return NtCancelSynchronousIoFile(h_thread, NULL, &out);
}

// Defensive use: cancel a synchronous IO blocking a worker thread we own.
use windows_sys::Win32::Foundation::HANDLE;
use windows_sys::Win32::System::IO::CancelSynchronousIo;

pub unsafe fn cancel_blocked(h_thread: HANDLE) -> bool {
    // CancelSynchronousIo(h) wraps NtCancelSynchronousIoFile with IRP=NULL.
    CancelSynchronousIo(h_thread) != 0
}

MITRE ATT&CK mappings

• T1562.001Impair Defenses: Disable or Modify Toolsmitre ↗
• T1106Native APImitre ↗