NtCompressKey

Prototype

NTSTATUS NtCompressKey(
  HANDLE Key
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 A3 00 00 00      mov eax, 0xA3
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

`NtCompressKey` is a maintenance primitive that rewrites the on-disk hive file containing the supplied key to reclaim space left by deleted cells. It is the kernel side of what `regedit` does when it offers to compact a hive on import. The implementation in `ntoskrnl.exe` (`CmpCompressKey` → `CmpDoCompressKey`) walks the cell map, builds a new contiguous hive file, fsyncs it, and atomically swaps it in. No public Win32 wrapper exists — consumers must `GetProcAddress("NtCompressKey")` from `ntdll.dll`.

Common malware usage

Effectively no offensive signal. The syscall does not read, write or expose hive contents in any way that helps an attacker, and it requires a writable handle to an already-loaded hive — anyone with that already has full read/write to the data. Occasionally seen in red-team tooling as part of *cleanup* — after an attacker has loaded an offline hive, harvested data, and dropped temporary keys, a final `NtCompressKey` shrinks the file back to a normal size so post-incident timeline reviewers don't notice an oversized hive. That is at most an anti-forensics curiosity.

Detection opportunities

Not worth detecting on its own — false-positive volume from legitimate registry-maintenance tools (`regedit /a`, third-party hive-compactors, some OEM imaging utilities) is essentially the entire signal. If you must, the ETW `Microsoft-Windows-Kernel-Registry` provider emits a HiveCompression event and `Microsoft-Windows-Kernel-File` will show the temporary `.compress` / `.tmp` hive file being written next to the original. Sysmon does not surface this directly.

Direct syscall examples

; Direct syscall stub for NtCompressKey (SSN 0xA3 on Win11 24H2)
NtCompressKey PROC
    mov  r10, rcx          ; Key
    mov  eax, 0A3h         ; SSN — drifts per build
    syscall
    ret
NtCompressKey ENDP

// No public Win32 wrapper — resolve from ntdll directly.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtCompressKey)(HANDLE);

NTSTATUS CompactHive(HKEY hMountedHiveRoot) {
    pNtCompressKey fn = (pNtCompressKey)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtCompressKey");
    return fn ? fn((HANDLE)hMountedHiveRoot) : STATUS_NOT_IMPLEMENTED;
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗