NtQuerySystemEnvironmentValue

Prototype

NTSTATUS NtQuerySystemEnvironmentValue(
  PUNICODE_STRING VariableName,
  PWCHAR          VariableValue,
  USHORT          ValueLength,
  PUSHORT         ReturnLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 6C 01 00 00      mov eax, 0x16C
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Legacy interface inherited from the original NT/x86 BIOS era for reading non-volatile system environment values. The name resolves through HAL-private NV-RAM stores; on modern UEFI machines this call is mostly vestigial — kernel paths funnel real firmware reads to NtQuerySystemEnvironmentValueEx instead. Requires SeSystemEnvironmentPrivilege. The 16-bit USHORT length cap is an obvious historical artefact and is one reason new code must use the Ex variant.

Common malware usage

Very low offensive signal in 2025. Most modern firmware-aware tradecraft (LoJax, MosaicRegressor, ESPecter) targets the UEFI variable surface via the *Ex* counterparts because that's where Secure Boot keys, BootOrder, and OS-loader handoff state actually live. Occasional appearances in older red-team toolkits surveying BIOS state on legacy machines.

Detection opportunities

ETW Microsoft-Windows-Kernel-General provider emits firmware-access events; pair with SeSystemEnvironmentPrivilege grants on the calling token. Calls from non-firmware-management binaries (anything outside bcdedit.exe, mountvol.exe, fwupdate utilities, vendor management tools) are inherently suspicious. EDRs rarely hook this directly because the legitimate volume is near zero — making any call a high-fidelity signal.

Direct syscall examples

; Direct syscall stub for NtQuerySystemEnvironmentValue (SSN 0x16C, Win11 24H2)
NtQuerySystemEnvironmentValue PROC
    mov  r10, rcx
    mov  eax, 16Ch
    syscall
    ret
NtQuerySystemEnvironmentValue ENDP

// Win32 calls back into NtQuerySystemEnvironmentValue under the hood.
// Requires SeSystemEnvironmentPrivilege — enable it first or the call returns ERROR_PRIVILEGE_NOT_HELD.
WCHAR buf[256] = {0};
DWORD len = GetFirmwareEnvironmentVariableW(
    L"BootOrder",
    L"{00000000-0000-0000-0000-000000000000}", // legacy non-UEFI: ignored
    buf,
    sizeof(buf));
if (len == 0) {
    // On modern UEFI systems GetFirmwareEnvironmentVariableW dispatches to the Ex variant.
    // Failure here on a UEFI machine is expected for legacy names.
}

MITRE ATT&CK mappings

• T1542.001Pre-OS Boot: System Firmwaremitre ↗
• T1106Native APImitre ↗