NtOpenPartition

Prototype

NTSTATUS NtOpenPartition(
  PHANDLE            PartitionHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1                  mov r10, rcx
B8 31 01 00 00            mov eax, 0x131
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03                     jne short +3
0F 05                     syscall
C3                        ret
CD 2E                     int 2Eh
C3                        ret

Undocumented notes

Companion `Open` counterpart to `NtCreatePartition`. The lookup is purely object-manager: the partition must already exist under its namespace path (commonly `\KernelObjects\…`) and the calling token must satisfy the partition's security descriptor for the requested rights. Unlike `NtCreatePartition`, opening a partition for query/inspect does not require `SeLockMemoryPrivilege` — only modify/attach paths do. The dynamic syscall lookup is straightforward via Hell's Gate because the SSN drifts predictably.

Common malware usage

Essentially zero direct abuse in commodity malware. A defender or researcher might call this to introspect Hyper-V container partitions on a host, and a sophisticated implant *theoretically* could use a pre-existing user-created partition to host its allocations and pollute working-set counters seen by the host EDR — but the gain over plain `NtAllocateVirtualMemory` is negligible relative to the privilege cost.

Detection opportunities

Pair with the `NtCreatePartition` signal: opening a named partition the operator did not create themselves is anomalous outside of vmcompute/vmwp/SystemSettings. ETW `Microsoft-Windows-Kernel-Memory` event 9 (`PartitionOpened`) carries the calling image and the partition object name. Most production environments will have an empty allowlist here.

Direct syscall examples

#include <windows.h>
#include <winternl.h>

#define MEMORY_PARTITION_QUERY_ACCESS  0x0001

typedef NTSTATUS (NTAPI* pNtOpenPartition)(
    PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);

HANDLE open_partition(LPCWSTR name) {
    UNICODE_STRING us;
    RtlInitUnicodeString(&us, name);
    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa, &us, OBJ_CASE_INSENSITIVE, NULL, NULL);

    pNtOpenPartition f = (pNtOpenPartition)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtOpenPartition");

    HANDLE h = NULL;
    f(&h, MEMORY_PARTITION_QUERY_ACCESS, &oa);
    return h;
}

NtOpenPartition PROC
    mov  r10, rcx
    mov  eax, 131h
    syscall
    ret
NtOpenPartition ENDP

MITRE ATT&CK mappings

• T1106Native APImitre ↗