NtEnumerateDriverEntries

Prototype

NTSTATUS NtEnumerateDriverEntries(
  PVOID  Buffer,
  PULONG BufferLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 E8 00 00 00      mov eax, 0xE8
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Same two-call enumeration pattern as NtEnumerateBootEntries — call once with `Buffer = NULL` to learn the required size, then again with the allocation. Walks the linked list via `EFI_DRIVER_ENTRY_LIST.NextEntryOffset`. SeSystemEnvironmentPrivilege is required even for read. On UEFI it indirectly reads the `DriverOrder` global variable plus each referenced `Driver####`.

Common malware usage

Used both offensively and defensively. Offensively: APT recon to fingerprint the firmware before deciding which DRIVER_ENTRY hijack is viable — MosaicRegressor's installer enumerates DriverOrder to find a stable slot held by a vulnerable OEM driver before patching it. Defensively: incident-response and proactive forensics call it (or `bcdedit /enum FIRMWARE`) to dump the current driver list and compare against a clean-room baseline of the same hardware model — the easiest reliable way to spot LoJax/MosaicRegressor-class implants short of full SPI dump.

Detection opportunities

Enumeration alone is benign — defenders run it constantly. The interesting signal is **enumeration by an unexpected process**: a non-OEM, non-Microsoft, non-EDR userland process that opens a token with SeSystemEnvironmentPrivilege and reads the driver list is a strong staging indicator. Pair the call site (Event ID 4673) with the process command line via Sysmon Event ID 1. The most reliable defense remains Secure Boot with an updated DBX and Measured Boot + remote attestation extending PCR[2] on every dispatched DXE driver.

Direct syscall examples

NtEnumerateDriverEntries PROC
    mov  r10, rcx          ; PVOID Buffer
    mov  eax, 0E8h         ; Win11 24H2
    syscall
    ret
NtEnumerateDriverEntries ENDP

// Walk DriverOrder, print FriendlyName + DriverFilePath of each registered DXE entry.
extern NTSTATUS NTAPI NtEnumerateDriverEntries(PVOID, PULONG);

void dump_drivers(void) {
    ULONG size = 0;
    NtEnumerateDriverEntries(NULL, &size);
    if (!size) return;
    PBYTE buf = (PBYTE)HeapAlloc(GetProcessHeap(), 0, size);
    if (NT_SUCCESS(NtEnumerateDriverEntries(buf, &size))) {
        PBYTE p = buf;
        while (p < buf + size) {
            PEFI_DRIVER_ENTRY_LIST list = (PEFI_DRIVER_ENTRY_LIST)p;
            PEFI_DRIVER_ENTRY de = &list->DriverEntry;
            wprintf(L"id=%08X name=%s\n", de->Id,
                    (LPCWSTR)((PBYTE)de + de->FriendlyNameOffset));
            if (!list->NextEntryOffset) break;
            p += list->NextEntryOffset;
        }
    }
    HeapFree(GetProcessHeap(), 0, buf);
}

use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_enumerate_driver_entries(_buf: *mut u8, _len: *mut u32) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0xE8",   // Win11 24H2
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1542.001Pre-OS Boot: System Firmwaremitre ↗
• T1082System Information Discoverymitre ↗
• T1014Rootkitmitre ↗