NtOpenTransaction

Prototype

NTSTATUS NtOpenTransaction(
  PHANDLE            TransactionHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  LPGUID             Uow,
  HANDLE             TmHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 3B 01 00 00      mov eax, 0x13B     ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Counterpart to `NtCreateTransaction`. The transaction can be opened either by name (when the creator placed it in `\BaseNamedObjects` or another directory) or by UoW GUID — every KTM transaction has a globally-unique unit-of-work GUID enrolled with the Transaction Manager. Once opened, the handle can be used to enlist further resource managers, query state via `NtQueryInformationTransaction`, or to commit/rollback if access was requested.

Common malware usage

Less central than `NtCreateTransaction` for Process Doppelgänging, but useful in multi-stage chains where one component creates the transaction (e.g. a service-context loader) and another stage opens it by UoW GUID to perform the rollback after the section has been created in a different process. Also appears in inter-process Doppelgänging variants where the dropper hands the UoW GUID to a child via IPC, lets the child reopen the transaction, and only then triggers rollback — this splits the suspicious sequence across two PIDs and defeats simple per-process detections.

Detection opportunities

Same telemetry surface as `NtCreateTransaction` — `Microsoft-Windows-Kernel-File` and `Microsoft-Windows-TxF` ETW providers. Specifically watch for unrelated processes opening the *same* UoW GUID within a short window: legitimate transactional apps (SQL Server, NTFS journaling) almost never span the create-open-rollback sequence across unrelated PIDs. Listing `\BaseNamedObjects` with WinObj will reveal named transactions, but most attacker-created transactions are unnamed and rely on UoW GUIDs.

Direct syscall examples

// Open an existing transaction by its unit-of-work GUID.
GUID uow = { /* received via IPC from the creator */ };
HANDLE hTx = NULL;
OBJECT_ATTRIBUTES oa = { sizeof(oa) };

NTSTATUS s = NtOpenTransaction(
    &hTx,
    TRANSACTION_COMMIT | TRANSACTION_ROLLBACK,
    &oa,
    &uow,
    NULL);

if (NT_SUCCESS(s)) {
    // Take ownership of the transaction — commit or rollback as needed.
    NtRollbackTransaction(hTx, TRUE);
    NtClose(hTx);
}

; NtOpenTransaction direct stub — SSN 0x13B on Win11 24H2
NtOpenTransaction PROC
    mov  r10, rcx
    mov  eax, 13Bh
    syscall
    ret
NtOpenTransaction ENDP

use ntapi::ntxcapi::NtOpenTransaction;
use winapi::shared::guiddef::GUID;
use winapi::shared::ntdef::{HANDLE, OBJECT_ATTRIBUTES};
use std::{mem, ptr::null_mut};

unsafe fn open_by_uow(mut uow: GUID) -> HANDLE {
    let mut h: HANDLE = null_mut();
    let mut oa: OBJECT_ATTRIBUTES = mem::zeroed();
    oa.Length = mem::size_of::<OBJECT_ATTRIBUTES>() as u32;
    let s = NtOpenTransaction(&mut h, 0x0008 | 0x0010, &mut oa, &mut uow, null_mut());
    assert!(s >= 0);
    h
}

MITRE ATT&CK mappings

• T1055.013Process Doppelgängingmitre ↗
• T1106Native APImitre ↗