NtQueryBootEntryOrder

Prototype

NTSTATUS NtQueryBootEntryOrder(
  PULONG Ids,
  PULONG Count
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 4A 01 00 00      mov eax, 0x14A
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

On UEFI this is fundamentally a wrapper over the firmware-defined `BootOrder` NVRAM variable (EFI Global Variable, GUID `{8BE4DF61-93CA-11d2-AA0D-00E098032B8C}`). The array is the *sequence* in which the firmware will try each `Boot####` variable. The first call typically uses a NULL `Ids` buffer to learn the size, the second collects the data. SeSystemEnvironmentPrivilege is required.

Common malware usage

A prerequisite to NtSetBootEntryOrder: bootkit installers read the current order, splice their freshly registered ID into position 0 (or wherever they need it relative to existing entries), and write it back. They also use the query to verify persistence survived a reboot — if `Ids[0]` is not the attacker's GUID anymore, the implant knows a defender or BIOS update has restored the order and re-runs the install. This loop is documented in BlackLotus' persistence module.

Detection opportunities

Same caveats as NtEnumerateBootEntries — read-only and frequently legitimate. The high-fidelity tell is the *pair*: query + set with a delta that promotes a non-Microsoft-signed loader to the head of the order. Compare the result of this syscall to a clean baseline; even better, integrate the EFI `BootOrder` variable into your asset inventory (Eclypsium, CHIPSEC, or Intune device health attestation) and alert on changes.

Direct syscall examples

NtQueryBootEntryOrder PROC
    mov  r10, rcx          ; PULONG Ids
    mov  eax, 014Ah        ; Win11 24H2
    syscall
    ret
NtQueryBootEntryOrder ENDP

extern NTSTATUS NTAPI NtQueryBootEntryOrder(PULONG, PULONG);

void show_order(void) {
    ULONG count = 0;
    NtQueryBootEntryOrder(NULL, &count);          // STATUS_BUFFER_TOO_SMALL, fills count
    if (!count) return;
    PULONG ids = (PULONG)HeapAlloc(GetProcessHeap(), 0, count * sizeof(ULONG));
    if (NT_SUCCESS(NtQueryBootEntryOrder(ids, &count))) {
        for (ULONG i = 0; i < count; ++i) wprintf(L"%u -> id=%08X\n", i, ids[i]);
    }
    HeapFree(GetProcessHeap(), 0, ids);
}

use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_query_boot_entry_order(_ids: *mut u32, _count: *mut u32) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x14A",  // Win11 24H2
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1542.003Pre-OS Boot: Bootkitmitre ↗
• T1082System Information Discoverymitre ↗
• T1542Pre-OS Bootmitre ↗