NtQueryInformationProcess

Prototype

NTSTATUS NtQueryInformationProcess(
  HANDLE           ProcessHandle,
  PROCESSINFOCLASS ProcessInformationClass,
  PVOID            ProcessInformation,
  ULONG            ProcessInformationLength,
  PULONG           ReturnLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 19 00 00 00      mov eax, 0x19
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtQueryInformationProcess is one of the most overloaded syscalls in Windows: more than 100 PROCESSINFOCLASS values are defined across modern builds, ranging from harmless (ProcessTimes=4, ProcessHandleCount=20) to deeply security-relevant (ProcessDebugPort=7, ProcessDebugObjectHandle=30, ProcessDebugFlags=31, ProcessMitigationPolicy=52, ProcessProtectionInformation=61, ProcessImageFileName=27). The SSN itself is rock-stable at 0x19 since Windows 10 1507 — Microsoft has carefully held this slot because so much in-tree and third-party code calls it. The class number space, however, churns frequently; values added in 24H2 are not present in 1809 and will return STATUS_INVALID_INFO_CLASS on older kernels.

Common malware usage

The single most-called anti-debug primitive on Windows. ProcessDebugPort (7) returns a non-zero handle when a usermode debugger is attached — used by IsDebuggerPresent's NTDLL-based replacements and most commercial protectors (VMProtect, Themida, Enigma). ProcessDebugObjectHandle (30) returns the DebugObject directly — required because experienced analysts NULL out the legacy DebugPort. ProcessDebugFlags (31) returns the inverse of NoDebugInherit; reading 0 means a debugger has been attached at some point. Combined: a pattern of three back-to-back NtQueryInformationProcess calls with classes 7, 30, 31 against NtCurrentProcess() is an almost certain anti-debug fingerprint. Loaders also use ProcessBasicInformation (0) to obtain PEB and walk loaded modules without touching the obvious LdrEnumerateLoadedModules; ProcessImageFileName (27) is used for sandbox/emulator name checks.

Detection opportunities

Volume is huge — this syscall fires constantly in normal operation, so raw counts are useless. Differentiation comes from (a) the class used, (b) the target handle (self vs. remote), and (c) call sequencing. ETW Microsoft-Windows-Kernel-Audit-API-Calls does *not* surface class — you need a user-mode shim (ntdll inline hook, ETW provider per-class) or a kernel callback. Detection rule of thumb: any process that calls classes 7, 30, 31 in close succession against itself is performing anti-debug. EDRs that care about this generally instrument the dispatch via instrumentation callbacks (PsSetLoadImageNotifyRoutine + NtSetInformationProcess(ProcessInstrumentationCallback)) or via TI-ETW EtwTiLogReadWriteVm-style hooks on adjacent operations.

Direct syscall examples

// The canonical anti-debug fingerprint: classes 7, 30, 31 against self.
HANDLE hProc = NtCurrentProcess();
DWORD_PTR debugPort = 0;
HANDLE    debugObj  = NULL;
ULONG     debugFlags = 0;
ULONG ret;

NtQueryInformationProcess(hProc, ProcessDebugPort,         &debugPort, sizeof(debugPort), &ret);
NtQueryInformationProcess(hProc, ProcessDebugObjectHandle, &debugObj,  sizeof(debugObj),  &ret);
NtQueryInformationProcess(hProc, ProcessDebugFlags,        &debugFlags, sizeof(debugFlags), &ret);

if (debugPort != 0 || debugObj != NULL || debugFlags == 0) {
    // Debugger present (or has been). Bail.
    NtTerminateProcess(hProc, 0);
}

PROCESS_BASIC_INFORMATION pbi = { 0 };
ULONG ret;
NtQueryInformationProcess(NtCurrentProcess(),
                          ProcessBasicInformation,
                          &pbi, sizeof(pbi), &ret);
PPEB peb = pbi.PebBaseAddress;
// Now walk peb->Ldr->InMemoryOrderModuleList to enumerate modules
// without calling LdrEnumerateLoadedModules / EnumProcessModules.

; SSN 0x19 — stable Win10 1507 .. Win11 24H2.
NtQueryInformationProcess PROC
    mov  r10, rcx
    mov  eax, 19h
    syscall
    ret
NtQueryInformationProcess ENDP

MITRE ATT&CK mappings

• T1622Debugger Evasionmitre ↗
• T1057Process Discoverymitre ↗
• T1106Native APImitre ↗