NtOpenSection

Prototype

NTSTATUS NtOpenSection(
  PHANDLE            SectionHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 37 00 00 00      mov eax, 0x37      ; stable across all builds
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Returns a handle to a pre-existing section object resolved through the NT object manager namespace — typically `\BaseNamedObjects\<name>` for Win32 callers or `\KnownDlls\<dll>` for OS-loaded image sections. The SSN has been constant at `0x37` from Windows 10 1507 through Windows 11 24H2, making it a reliable candidate for hardcoded direct syscalls. `OpenFileMapping` is the Win32 thin wrapper that builds the name `\Sessions\<id>\BaseNamedObjects\<name>` and calls this syscall.

Common malware usage

Two distinct abuse patterns. (1) **KnownDlls poisoning prerequisite**: implants open `\KnownDlls\<target>.dll` with `SECTION_MAP_WRITE` (typically only possible if the implant runs at high integrity or replaces the section beforehand) and overwrite the executable bytes of a system DLL still mapped image-cow into every process — a classic write-once / infect-all primitive used in the original KnownDlls hijack research. (2) **Privileged-service IPC abuse**: some Windows services expose named sections in `\BaseNamedObjects\` for legitimate IPC; offensive tooling opens those sections to either eavesdrop on the protocol or smuggle data across integrity boundaries. The SSN's perfect stability makes `NtOpenSection` a popular hardcoded direct-syscall in red-team loaders.

Detection opportunities

Sysmon Event 7 (ImageLoad) and Event 10 (ProcessAccess) do not directly cover section opens. ETW `Microsoft-Windows-Kernel-General` event ID 6 (ImageLoad) fires on subsequent map. For high-fidelity detection, kernel callbacks on `ObRegisterCallbacks` for `*PsSectionType` can audit handle opens, and EDR vendors increasingly hook `NtOpenSection` to flag opens of `\KnownDlls\*` with write access. From userland, `NtQuerySystemInformation(SystemHandleInformation)` enumerates every section handle currently held — a periodic snapshot will reveal unusual cross-process section handles.

Direct syscall examples

// Open \BaseNamedObjects\MySharedSection for read access.
UNICODE_STRING name;
RtlInitUnicodeString(&name, L"\\BaseNamedObjects\\MySharedSection");

OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);

HANDLE hSection = NULL;
NTSTATUS s = NtOpenSection(&hSection, SECTION_MAP_READ | SECTION_QUERY, &oa);
if (!NT_SUCCESS(s)) return s;

PVOID view = NULL;
SIZE_T viewSize = 0;
NtMapViewOfSection(hSection, NtCurrentProcess(),
                   &view, 0, 0, NULL, &viewSize,
                   ViewShare, 0, PAGE_READONLY);

; NtOpenSection direct stub — SSN 0x37 on every Win10/Win11 build
NtOpenSection PROC
    mov  r10, rcx
    mov  eax, 37h
    syscall
    ret
NtOpenSection ENDP

// Read-only open of \KnownDlls\kernel32.dll — useful for unhooking ntdll
// by comparing a fresh image against the loaded one.
use ntapi::ntmmapi::NtOpenSection;
use ntapi::ntobapi::OBJ_CASE_INSENSITIVE;
use winapi::shared::ntdef::{HANDLE, OBJECT_ATTRIBUTES, UNICODE_STRING};
use std::{mem, ptr::null_mut};

unsafe fn open_known_dll(name: &str) -> HANDLE {
    let wide: Vec<u16> = format!("\\KnownDlls\\{}", name).encode_utf16().collect();
    let mut us = UNICODE_STRING {
        Length: (wide.len() * 2) as u16,
        MaximumLength: (wide.len() * 2) as u16,
        Buffer: wide.as_ptr() as *mut u16,
    };
    let mut oa: OBJECT_ATTRIBUTES = mem::zeroed();
    oa.Length = mem::size_of::<OBJECT_ATTRIBUTES>() as u32;
    oa.ObjectName = &mut us;
    oa.Attributes = OBJ_CASE_INSENSITIVE;
    let mut h: HANDLE = null_mut();
    let s = NtOpenSection(&mut h, 0x0004 /* SECTION_MAP_READ */, &mut oa);
    assert!(s >= 0);
    h
}

MITRE ATT&CK mappings

• T1574.001DLL Search Order Hijackingmitre ↗
• T1106Native APImitre ↗