NtEnumerateBootEntries

Prototype

NTSTATUS NtEnumerateBootEntries(
  PVOID  Buffer,
  PULONG BufferLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 E7 00 00 00      mov eax, 0xE7
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Classic two-call pattern: invoke with `Buffer = NULL` to retrieve the required size, allocate, and call again. The output is a chained linked list — each `BOOT_ENTRY_LIST.NextEntryOffset` is a byte delta from the start of the current record to the next (zero terminates). Behind the scenes the kernel walks the firmware-side list: NVRAM `BootOrder` + `Boot####` variables on UEFI, BCD hive enumeration on legacy BIOS. SeSystemEnvironmentPrivilege is required even for *read*.

Common malware usage

Enumeration is the reconnaissance step of every BCD-persistence kill chain: malware needs the existing `{bootmgr}` ID before it can call NtModifyBootEntry, and it needs the current ordering before NtSetBootEntryOrder. TrickBoot's UEFI module famously starts with a survey pass that calls the equivalent of `BcdEnumerateObjects` + `NtEnumerateBootEntries` to fingerprint the firmware (vendor, vulnerable bootmgr versions, presence of recovery entries) and report back to the C2 before deciding whether to deploy the bootkit stage.

Detection opportunities

Read-only enumeration is rarely interesting in isolation — legitimate tools (`bcdedit`, Windows Update, BitLocker setup) call it routinely. Suspicion comes from **context**: a non-installer, non-system-context process that opens a handle requesting SeSystemEnvironmentPrivilege *and* immediately enumerates BCD entries is anomalous. Hook detection: query 4673 audit events for SeSystemEnvironmentPrivilege use, then correlate with process image path. EDRs that telemeter NtSetInformationToken / NtAdjustPrivilegesToken transitions to SE_PRIVILEGE_ENABLED for SeSystemEnvironment can catch the privilege-acquisition step that precedes any write call.

Direct syscall examples

NtEnumerateBootEntries PROC
    mov  r10, rcx          ; PVOID Buffer
    mov  eax, 0E7h         ; Win11 24H2
    syscall
    ret
NtEnumerateBootEntries ENDP

// Enumerate every firmware boot entry, print FriendlyName.
extern NTSTATUS NTAPI NtEnumerateBootEntries(PVOID, PULONG);

void dump_entries(void) {
    ULONG size = 0;
    NtEnumerateBootEntries(NULL, &size);     // STATUS_BUFFER_TOO_SMALL
    if (size == 0) return;
    PBYTE buf = (PBYTE)HeapAlloc(GetProcessHeap(), 0, size);
    if (NT_SUCCESS(NtEnumerateBootEntries(buf, &size))) {
        PBYTE p = buf;
        while (p < buf + size) {
            PBOOT_ENTRY_LIST list = (PBOOT_ENTRY_LIST)p;
            PBOOT_ENTRY be = &list->BootEntry;
            wprintf(L"id=%08X name=%s\n", be->Id,
                    (LPCWSTR)((PBYTE)be + be->FriendlyNameOffset));
            if (!list->NextEntryOffset) break;
            p += list->NextEntryOffset;
        }
    }
    HeapFree(GetProcessHeap(), 0, buf);
}

MITRE ATT&CK mappings

• T1542.003Pre-OS Boot: Bootkitmitre ↗
• T1082System Information Discoverymitre ↗
• T1542Pre-OS Bootmitre ↗