NtQueryBootOptions

Prototype

NTSTATUS NtQueryBootOptions(
  PBOOT_OPTIONS BootOptions,
  PULONG        BootOptionsLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 4B 01 00 00      mov eax, 0x14B
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Returns the BOOT_OPTIONS blob captured by the OS loader and surfaced into the running kernel. The structure includes Version, Length, Timeout, CurrentBootEntryId, NextBootEntryId, and an HeaderId followed by the option-string region. Examples of strings present here: `DEBUG`, `TESTSIGNING`, `HYPERVISORLAUNCHTYPE=AUTO`, `BOOTLOG`, `WINPE`, `NOEXECUTE=OPTIN`. Requires SeSystemEnvironmentPrivilege. Mostly used by recovery / setup tooling and by some defensive products that want to detect whether the host is running in a developer-friendly boot mode.

Common malware usage

Low offensive signal. Some malware (notably anti-analysis routines in commodity loaders) call this to detect debugger-friendly boot states (`DEBUG`, `TESTSIGNING`, `BOOTLOG`) and abort or modify behaviour to evade sandbox / lab environments. That is the dominant abuse pattern — environmental keying rather than direct compromise. Reading boot options does not itself escalate privilege or persist.

Detection opportunities

Volume of legitimate calls is moderate (recovery tooling, OEM diagnostic agents, some endpoint protection products). Microsoft-Windows-Kernel-General ETW logs the access. The interesting signal is *correlation*: a binary that just elevated, enabled SeSystemEnvironmentPrivilege, and then read BootOptions immediately before deciding whether to deploy further payload is the textbook anti-analysis shape. Sandbox vendors typically respond by spoofing the returned blob to make `DEBUG`/`TESTSIGNING` invisible.

Direct syscall examples

; Direct syscall stub for NtQueryBootOptions (SSN 0x14B, Win11 24H2)
NtQueryBootOptions PROC
    mov  r10, rcx
    mov  eax, 14Bh
    syscall
    ret
NtQueryBootOptions ENDP

// Demonstrative environmental-keying check used by commodity loaders.
// In production the loader fingerprints additional artefacts before deciding.
#pragma pack(push,4)
typedef struct _BOOT_OPTIONS {
    ULONG  Version;
    ULONG  Length;
    ULONG  Timeout;
    ULONG  CurrentBootEntryId;
    ULONG  NextBootEntryId;
    WCHAR  HeaderId[1]; // variable
} BOOT_OPTIONS, *PBOOT_OPTIONS;
#pragma pack(pop)

BOOLEAN was;
RtlAdjustPrivilege(SE_SYSTEM_ENVIRONMENT_PRIVILEGE, TRUE, FALSE, &was);

UCHAR buf[1024];
ULONG len = sizeof(buf);
NTSTATUS s = NtQueryBootOptions((PBOOT_OPTIONS)buf, &len);
if (NT_SUCCESS(s)) {
    // Naive substring scan of the trailing options region.
    PCWSTR opts = (PCWSTR)(buf + sizeof(BOOT_OPTIONS));
    if (wcsstr(opts, L"DEBUG") || wcsstr(opts, L"TESTSIGNING")) {
        ExitProcess(0); // bail — looks like an analyst's machine
    }
}

MITRE ATT&CK mappings

• T1497Virtualization/Sandbox Evasionmitre ↗
• T1106Native APImitre ↗