NtMapUserPhysicalPages

Prototype

NTSTATUS NtMapUserPhysicalPages(
  PVOID       VirtualAddress,
  ULONG_PTR   NumberOfPages,
  PULONG_PTR  UserPfnArray
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1                  mov r10, rcx
B8 1D 01 00 00            mov eax, 0x11D
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03                     jne short +3
0F 05                     syscall
C3                        ret
CD 2E                     int 2Eh
C3                        ret

Undocumented notes

NtMapUserPhysicalPages binds physical pages obtained from NtAllocateUserPhysicalPages into the virtual window reserved with `VirtualAlloc(MEM_RESERVE | MEM_PHYSICAL)`. Pass NULL for UserPfnArray to unmap the entire window in one call — a property database engines exploit for fast page eviction. The remapping is essentially a TLB-only operation in the steady state: the physical PFNs are pinned, so there's no IO, no working-set adjustment, no soft fault. That latency profile (sub-microsecond on warm TLBs) is exactly what made AWE attractive for 32-bit SQL Server back when PAE was a workaround for the 2 GB limit.

Common malware usage

Two patterns. First, **page-aliasing trick**: an attacker maps the same physical page into two virtual addresses with different protections (e.g. one window RW, another RX), getting a stable write-XOR-execute split without ever calling NtProtectVirtualMemory — bypassing EDRs that hook protection changes. Second, **swap-resistant payload staging**: pages are AWE-allocated once and remapped through this syscall on each beacon callback, keeping the payload bytes off the pagefile permanently. When combined with a vulnerable driver that exposes physical-memory I/O, the same syscall can splice kernel-page contents (after building the right PFN handle) into a user-mode window for read primitives that survive across calls. Tradecraft requires SeLockMemoryPrivilege as the upstream gate.

Detection opportunities

MEM_PHYSICAL virtual windows are visible in `!vad` as a distinct subtype and via `VirtualQueryEx` (Type contains `MEM_PHYSICAL`). EDRs that don't introspect VAD details will miss the mapping, but the *upstream* NtAllocateUserPhysicalPages call (and the corresponding `SeLockMemoryPrivilege` adjustment) is a much more reliable trigger. Hunt for processes that hold both a MEM_PHYSICAL VirtualAlloc reservation and call NtMapUserPhysicalPages in a loop — that's the page-flipping pattern of a database or a payload-aliasing implant; if the binary isn't sqlservr.exe / exsetup.exe / oracle.exe, it's worth a deeper look. ETW Microsoft-Windows-Kernel-Memory doesn't surface AWE remaps directly; rely on VAD walks at memory-scan time.

Direct syscall examples

// Rotate two batches of physical pages through the same virtual window —
// classic AWE pattern used by SQL Server for buffer-pool extension.
#include <windows.h>

void awe_flip(PVOID window, ULONG_PTR pages, PULONG_PTR pfnA, PULONG_PTR pfnB) {
    for (;;) {
        MapUserPhysicalPages(window, pages, pfnA);   // bring batch A into view
        // ... work on 'window' ...
        MapUserPhysicalPages(window, pages, NULL);   // unmap (NULL pfn array)
        MapUserPhysicalPages(window, pages, pfnB);   // bring batch B into view
        // ... work on 'window' ...
        MapUserPhysicalPages(window, pages, NULL);
    }
}

// Map the same physical pages twice: one writable window, one executable.
// EDR hooks on NtProtectVirtualMemory never fire because protection never changes.
#include <windows.h>

void* alias_wx(PULONG_PTR pfn, ULONG_PTR pages) {
    SIZE_T size = pages * 4096;
    PVOID wr = VirtualAlloc(NULL, size, MEM_RESERVE | MEM_PHYSICAL, PAGE_READWRITE);
    PVOID ex = VirtualAlloc(NULL, size, MEM_RESERVE | MEM_PHYSICAL, PAGE_EXECUTE_READ);
    MapUserPhysicalPages(wr, pages, pfn);
    MapUserPhysicalPages(ex, pages, pfn);
    // Write shellcode via 'wr', execute via 'ex' — same physical memory.
    return ex;
}

NtMapUserPhysicalPages PROC
    mov  r10, rcx
    mov  eax, 11Dh
    syscall
    ret
NtMapUserPhysicalPages ENDP

MITRE ATT&CK mappings

• T1106Native APImitre ↗
• T1055Process Injectionmitre ↗
• T1027Obfuscated Files or Informationmitre ↗