NtQueryDriverEntryOrder

Prototype

NTSTATUS NtQueryDriverEntryOrder(
  PULONG Ids,
  PULONG Count
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 4F 01 00 00      mov eax, 0x14F
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Companion to the BCD `NtQueryBootEntryOrder` family but operating on UEFI **driver** entries rather than OS-loader entries. The DriverOrder NVRAM variable controls which platform drivers (Driver0000, Driver0001, ...) the firmware loads before handing control to the OS loader; querying it is the read-only inspection path. Requires SeSystemEnvironmentPrivilege. On non-UEFI/CSM systems the syscall returns STATUS_NOT_IMPLEMENTED. The `bcdedit /enum FIRMWARE` command is the user-mode surface most commonly seen exercising this path.

Common malware usage

Reconnaissance value during firmware-focused tradecraft: an attacker about to attempt UEFI persistence may enumerate DriverOrder to (a) understand which OEM/platform drivers run first, (b) identify a slot whose number is unused so a planted Driver#### entry will be picked up, or (c) confirm that an already-planted Driver#### sits ahead of the OS loader handoff. Pair with NtQuerySystemEnvironmentValueEx for full enumeration. Read-only on its own — no direct kernel-level damage.

Detection opportunities

Volume of legitimate calls is extremely low — essentially bcdedit.exe, manage-bde, and OEM firmware tools. Microsoft-Windows-Kernel-General ETW logs firmware-read access including DriverOrder. The privilege-enable transition (SeSystemEnvironmentPrivilege via NtAdjustPrivilegesToken) is the earliest defensive checkpoint. Pair process-context telemetry with the audit event to flag user-mode malware enumerating boot configuration.

Direct syscall examples

; Direct syscall stub for NtQueryDriverEntryOrder (SSN 0x14F, Win11 24H2)
NtQueryDriverEntryOrder PROC
    mov  r10, rcx
    mov  eax, 14Fh
    syscall
    ret
NtQueryDriverEntryOrder ENDP

// Privilege gate first.
BOOLEAN was;
RtlAdjustPrivilege(SE_SYSTEM_ENVIRONMENT_PRIVILEGE, TRUE, FALSE, &was);

ULONG ids[32] = {0};
ULONG count = ARRAYSIZE(ids);
NTSTATUS s = NtQueryDriverEntryOrder(ids, &count);
if (NT_SUCCESS(s)) {
    for (ULONG i = 0; i < count; ++i) {
        // ids[i] is the Driver#### identifier in load order.
        // Pair with NtQuerySystemEnvironmentValueEx(L"Driver####", EFI_GLOBAL_VARIABLE,...)
        // to dereference each entry's device-path and load-options.
    }
}

MITRE ATT&CK mappings

• T1542.001Pre-OS Boot: System Firmwaremitre ↗
• T1106Native APImitre ↗