NtManagePartition

Prototype

NTSTATUS NtManagePartition(
  HANDLE                       TargetHandle,
  HANDLE                       SourceHandle,
  PARTITION_INFORMATION_CLASS  PartitionInformationClass,
  PVOID                        PartitionInformation,
  ULONG                        PartitionInformationLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1                  mov r10, rcx
B8 1B 01 00 00            mov eax, 0x11B
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03                     jne short +3
0F 05                     syscall
C3                        ret
CD 2E                     int 2Eh
C3                        ret

Undocumented notes

The Swiss-army-knife sister of `NtCreatePartition` and `NtOpenPartition`. The `PARTITION_INFORMATION_CLASS` selector decides everything: `0` (PageInformation) returns live counters comparable to `MEMORYSTATUSEX` but scoped to the partition; `3` (AddMemory) hands a physical-memory range from the parent to the target; `4` (MoveMemory) re-homes already-attached pages between two partitions and is the only class that uses both `TargetHandle` and `SourceHandle`; `9` (EmptyCompressionStore) flushes the partition's compressed-page store back to either pageable memory or pagefile. All modify classes require `SeLockMemoryPrivilege` (in addition to `MEMORY_PARTITION_MODIFY_ACCESS` on the handle).

Common malware usage

Very weak commodity-malware signal. The interesting research angle is `EmptyCompressionStore`: forcing a parent partition to flush its MemCompression-backed pages can be used as a coarse cache-timing side channel against a co-resident process, and there is academic work demonstrating this. None of that has migrated to in-the-wild ransomware or stealers. Most defenders can safely treat any non-Microsoft caller of `NtManagePartition` as worth a hard look.

Detection opportunities

Pair Sysmon Event ID 1 (process create) with kernel ETW: the `Microsoft-Windows-Kernel-Memory` provider emits granular events for partition modify operations including the information class. Hunt for any image outside `vmcompute.exe`, `vmwp.exe`, `vmms.exe`, and the few game-mode services calling `NtManagePartition` with information class `3`, `4`, `5`, `6`, or `9`. Query-only class `0` calls also surface from `taskmgr.exe` / `procexp.exe` and are not interesting on their own.

Direct syscall examples

#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI* pNtManagePartition)(
    HANDLE, HANDLE, ULONG /*info class*/, PVOID, ULONG);

typedef struct _MEMORY_PARTITION_PAGE_INFORMATION {
    SIZE_T TotalCommittedPages;
    SIZE_T TotalCommitLimit;
    SIZE_T CurrentCommittedPages;
    SIZE_T PageCombinesAttempted;
    SIZE_T PageCombinesSucceeded;
} MEMORY_PARTITION_PAGE_INFORMATION;

void query_partition_pages(HANDLE hPart) {
    MEMORY_PARTITION_PAGE_INFORMATION info = { 0 };
    pNtManagePartition f = (pNtManagePartition)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtManagePartition");
    f(hPart, NULL, 0 /* SystemMemoryPartitionPageInformation */,
      &info, sizeof(info));
}

NtManagePartition PROC
    mov  r10, rcx
    mov  eax, 11Bh
    syscall
    ret
NtManagePartition ENDP

MITRE ATT&CK mappings

• T1106Native APImitre ↗