NtCreateDebugObject

Prototype

NTSTATUS NtCreateDebugObject(
  PHANDLE            DebugObjectHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  ULONG              Flags
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 AB 00 00 00      mov eax, 0xAB
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

DebugObject is the kernel primitive that backs the Win32 debugging API: kernel32!DebugActiveProcess, WaitForDebugEvent, ContinueDebugEvent all work through one of these objects. A process can only be attached to one DebugObject at a time — that singleton property is the load-bearing detail for the entire self-debug anti-attach family of tricks. The SSN drifts with almost every feature update (0x9A → 0xAB from 1507 to 24H2), so static SSN tables are unsafe; resolve dynamically. After creation, the typical sequence is NtCreateDebugObject → NtDebugActiveProcess(target, dbgObj) → NtWaitForDebugEvent loop, optionally NtRemoveProcessDebug to detach.

Common malware usage

Self-debug anti-attach: the malware (or a child it spawned with DEBUG_PROCESS) attaches itself or its protected child to a DebugObject it owns. Because Windows allows only a single debug port per process, any later attempt by WinDbg, x64dbg, or an EDR's attach-on-crash hook to call DebugActiveProcess fails with STATUS_PORT_ALREADY_SET. Commercial protectors (Themida, VMProtect, Enigma) ship this pattern; so do many crypters, GuLoader-style loaders, and Donut-generated stagers. The cost is real: the malware now has to service debug events on its own thread, and unhandled exceptions in the debuggee surface to that loop rather than going to Watson.

Detection opportunities

DebugObject creation by a non-debugger process is unusual on workstations. ETW provider Microsoft-Windows-Kernel-Object emits object-create events; correlate with ImageFileName != known debuggers (windbg.exe, vsjitdebugger.exe, devenv.exe, ProcMon.exe). The high-fidelity signal is the pair: NtCreateDebugObject immediately followed by NtDebugActiveProcess targeting self or a freshly spawned child (especially with DEBUG_KILL_ON_CLOSE set — the loader will die if you kill the debugger thread, which is hostile by design). Defender for Endpoint surfaces DebugActiveProcess via the Threat Intelligence ETW channel.

Direct syscall examples

// Phase 1: create a DebugObject owned by us, then attach to our own PID.
// Any later DebugActiveProcess() against us will return STATUS_PORT_ALREADY_SET.
typedef NTSTATUS(NTAPI* fnNtCreateDebugObject)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, ULONG);
typedef NTSTATUS(NTAPI* fnNtDebugActiveProcess)(HANDLE, HANDLE);

HANDLE g_dbg = NULL;
void InstallSelfDebug(void) {
    HMODULE n = GetModuleHandleA("ntdll.dll");
    fnNtCreateDebugObject pCreate = (fnNtCreateDebugObject)GetProcAddress(n, "NtCreateDebugObject");
    fnNtDebugActiveProcess pAttach = (fnNtDebugActiveProcess)GetProcAddress(n, "NtDebugActiveProcess");
    OBJECT_ATTRIBUTES oa = { sizeof(oa) };
    pCreate(&g_dbg, 0x1F000F /* DEBUG_ALL_ACCESS */, &oa, 0 /* no kill-on-close */);
    pAttach((HANDLE)-1 /* self */, g_dbg);
    // Servicing the debug-event loop on a worker thread is still required so
    // the parent does not deadlock on its own exceptions.
}

; SSN 0xAB on win11-24h2 / winserver-2025. Resolve dynamically across builds.
NtCreateDebugObject PROC
    mov  r10, rcx
    mov  eax, 0ABh
    syscall
    ret
NtCreateDebugObject ENDP

// Cargo: windows-sys = "0.59"
use std::ffi::c_void;
use windows_sys::Win32::System::LibraryLoader::{GetModuleHandleA, GetProcAddress};

type NtCreateDebugObject = unsafe extern "system" fn(
    out_handle: *mut isize,
    desired_access: u32,
    object_attributes: *mut c_void,
    flags: u32,
) -> i32;

pub unsafe fn create_debug_object() -> Option<isize> {
    let ntdll = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    if ntdll.is_null() { return None; }
    let addr = GetProcAddress(ntdll, b"NtCreateDebugObject\0".as_ptr())?;
    let f: NtCreateDebugObject = std::mem::transmute(addr);
    let mut h: isize = 0;
    let mut oa = [0u8; 48];
    if f(&mut h, 0x1F000F, oa.as_mut_ptr().cast(), 0) == 0 { Some(h) } else { None }
}

MITRE ATT&CK mappings

• T1622Debugger Evasionmitre ↗
• T1106Native APImitre ↗