NtCreateProfile

Prototype

NTSTATUS NtCreateProfile(
  PHANDLE        ProfileHandle,
  HANDLE         Process,
  PVOID          ProfileBase,
  SIZE_T         ProfileSize,
  ULONG          BucketSize,
  PULONG         Buffer,
  ULONG          BufferSize,
  KPROFILE_SOURCE ProfileSource,
  KAFFINITY      Affinity
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1                  mov r10, rcx
B8 C2 00 00 00            mov eax, 0xC2
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03                     jne short +3
0F 05                     syscall
C3                        ret
CD 2E                     int 2Eh
C3                        ret

Undocumented notes

NtCreateProfile, together with NtStartProfile / NtStopProfile / NtSetIntervalProfile / NtQueryIntervalProfile, drives the kernel's classic sampling profiler — the same backend that powered KernRate decades ago and that today is still used by some PerfView and WPR scenarios. The profiler attaches to the high-resolution timer (or a hardware PMU source on supported CPUs) and on each tick increments the histogram bucket corresponding to the interrupted RIP, provided RIP falls inside [ProfileBase, ProfileBase + ProfileSize). The Buffer pointer is supplied by user-mode but the kernel writes into it directly from ISR context, which is why the buffer must remain resident (in practice the caller should VirtualLock it). Requires SeSystemProfilePrivilege for system-wide profiling.

Common malware usage

Genuinely weak offensive signal. The historical abuses are narrow: (1) academic side-channel work that used sampling profilers to fingerprint kernel scheduler behaviour and infer secrets from victim threads on shared cores; (2) niche timing-attack PoCs that abused `ProfileTotalIssues` to count retired instructions in foreign code paths. Neither has translated into real-world commodity malware — the SeSystemProfilePrivilege requirement and the unusual syscall footprint make it more trouble than it's worth compared to QueryPerformanceCounter for timing or PMU-MSR access for fine-grained side channels. Mostly defensive tooling territory.

Detection opportunities

Very low background usage in user-mode malware. A non-system process calling NtCreateProfile, especially with `Process == NULL` (system-wide) and `ProfileSource != ProfileTime`, is essentially never benign. Audit `SeSystemProfilePrivilege` grants the same way you audit SeDebugPrivilege. The profile object itself is visible under `\KernelObjects` and named profile handles can be enumerated via NtQueryObject. EDR coverage is poor — this is one of the rare native syscalls that almost nothing hooks because almost nothing calls it.

Direct syscall examples

// Minimal NtCreateProfile + NtStartProfile sequence — defensive perf use.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *PNTCREATEPROFILE)(PHANDLE, HANDLE, PVOID, SIZE_T, ULONG,
                                           PULONG, ULONG, ULONG, ULONG_PTR);
typedef NTSTATUS (NTAPI *PNTSTARTPROFILE)(HANDLE);

void profile_self(PVOID base, SIZE_T size) {
    ULONG bucketShift = 2;                 // 4-byte buckets
    ULONG entries     = (ULONG)(size >> bucketShift);
    ULONG *buf        = (ULONG*)VirtualAlloc(NULL, entries * sizeof(ULONG),
                                             MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    VirtualLock(buf, entries * sizeof(ULONG));

    HMODULE nt = GetModuleHandleA("ntdll.dll");
    PNTCREATEPROFILE pNtCreateProfile = (PNTCREATEPROFILE)GetProcAddress(nt, "NtCreateProfile");
    PNTSTARTPROFILE  pNtStartProfile  = (PNTSTARTPROFILE) GetProcAddress(nt, "NtStartProfile");

    HANDLE hProf = NULL;
    pNtCreateProfile(&hProf, GetCurrentProcess(), base, size, bucketShift,
                     buf, entries * sizeof(ULONG), 0 /* ProfileTime */, 0);
    pNtStartProfile(hProf);
}

NtCreateProfile PROC
    mov  r10, rcx
    mov  eax, 0C2h
    syscall
    ret
NtCreateProfile ENDP

MITRE ATT&CK mappings

• T1106Native APImitre ↗