NtModifyDriverEntry

Prototype

NTSTATUS NtModifyDriverEntry(
  PEFI_DRIVER_ENTRY DriverEntry
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 20 01 00 00      mov eax, 0x120
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Mirror of NtModifyBootEntry but for the UEFI `Driver####` namespace. The ID is the primary key inside the EFI_DRIVER_ENTRY; the kernel resolves it, locates the corresponding firmware variable, and rewrites it in a single atomic SetVariable call. SeSystemEnvironmentPrivilege is mandatory.

Common malware usage

Used when a legitimate OEM diagnostics or firmware-update DXE driver already exists in `DriverOrder`. Rather than registering a new (suspicious) entry, malware patches the `DriverFilePath` of the existing entry to point at an attacker-controlled `.efi` binary on the ESP, inheriting the OEM's slot in DriverOrder and its plausible FriendlyName. This is one of the techniques documented in the LoJax / MosaicRegressor analyses where APT28 leveraged the firmware's existing infrastructure rather than carving a new entry. Defenders looking only for unknown DRIVER_ENTRY *additions* miss the mutation.

Detection opportunities

Both modification and addition surface on ETW Microsoft-Windows-Kernel-Boot. The diagnostic signal here is **file-content drift**: the registered `Driver####` paths can be enumerated and hashed; a change in the on-disk hash of a previously-known DXE binary (without a corresponding signed firmware update from the OEM) is high-confidence evidence of `DriverFilePath` hijack. Eclypsium, CHIPSEC and Binarly's tooling all baseline DXE driver hashes; Microsoft Defender for Endpoint surfaces UEFI driver telemetry under "Boot driver and firmware" reports.

Direct syscall examples

NtModifyDriverEntry PROC
    mov  r10, rcx          ; PEFI_DRIVER_ENTRY (Id inside struct)
    mov  eax, 0120h        ; Win11 24H2
    syscall
    ret
NtModifyDriverEntry ENDP

// Defensive analysis: shows the shape of what LoJax-style attackers do.
NTSTATUS hijack_driver(ULONG id, const wchar_t* shim) {
    BYTE buf[1024] = {0};
    PEFI_DRIVER_ENTRY de = (PEFI_DRIVER_ENTRY)buf;
    de->Version = 1;
    de->Length  = sizeof(buf);
    de->Id      = id;                  // existing OEM diagnostic driver
    de->Attributes = LOAD_OPTION_ACTIVE;
    de->BootFilePathOffset = FIELD_OFFSET(EFI_DRIVER_ENTRY, OsOptions);
    // populate FILE_PATH(shim) into buf[BootFilePathOffset..] (omitted)
    return NtModifyDriverEntry(de);
}

use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_modify_driver_entry(_entry: *mut u8) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x120",  // Win11 24H2
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1542.001Pre-OS Boot: System Firmwaremitre ↗
• T1014Rootkitmitre ↗
• T1542.003Pre-OS Boot: Bootkitmitre ↗