NtRaiseHardError

Prototype

NTSTATUS NtRaiseHardError(
  NTSTATUS                 ErrorStatus,
  ULONG                    NumberOfParameters,
  ULONG                    UnicodeStringParameterMask,
  PULONG_PTR               Parameters,
  HARDERROR_RESPONSE_OPTION ResponseOption,
  PHARDERROR_RESPONSE      Response
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 75 01 00 00      mov eax, 0x175
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtRaiseHardError has two completely different personalities depending on parameter combinations. The benign path posts a hard-error LPC message to CSRSS, which paints the familiar 'A device attached to the system is not functioning' dialog. The famous BSOD path: pass any STATUS_SEVERITY_FATAL status (high two bits = 11), ResponseOption = OptionShutdownSystem (6), and hold SeShutdownPrivilege enabled — the kernel jumps straight into ExpRaiseHardError → KeBugCheckEx with bugcheck code 0xF4 (CRITICAL_OBJECT_TERMINATION) or 0xC1 (SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION) depending on the specific status. Wininit.exe and Csrss.exe legitimately use the same call to take the system down when a critical process dies; malware piggybacks on the same machinery.

Common malware usage

The textbook 'crash the box from userland' primitive. Ransomware uses NtRaiseHardError as a stage-3 anti-forensics step: after encryption is complete and shadow copies wiped, force a BSOD to disrupt any in-memory forensics, EDR live-response sessions, or recovery attempts. Some destructive wipers (HermeticWiper, CaddyWiper) call it as the final action so the next boot lands in WinRE with no usable user volume. Defense-evasion families also use the non-FATAL form to spawn convincing 'critical update' dialogs in social-engineering chains. The privilege gate is mild — any process running as Administrator with default-enabled SeShutdownPrivilege can BSOD the host.

Detection opportunities

Set the audit-policy bit for 'Process Creation' on wininit.exe and csrss.exe, and additionally use Microsoft-Windows-Threat-Intelligence ETW (EtwTiLogRaiseHardError where exposed). On the survivable path, Event Log channel Application records hard errors as Event ID 1023 (DrWatson) and the System channel records BugCheck (Event ID 1001) on the reboot after a hard-error-induced bugcheck. The most useful prevention is removing SeShutdownPrivilege from non-privileged service accounts — most application service accounts do not need it, and removing it neutralises the userland-BSOD threat entirely.

Direct syscall examples

// Requires SeShutdownPrivilege enabled in the token.
// Result: instant 0xF4 CRITICAL_OBJECT_TERMINATION bugcheck.
BOOLEAN wasEnabled;
RtlAdjustPrivilege(SE_SHUTDOWN_PRIVILEGE, TRUE, FALSE, &wasEnabled);

ULONG response;
NtRaiseHardError(
    STATUS_ASSERTION_FAILURE,    // 0xC0000420 - severity FATAL
    0, 0, NULL,
    OptionShutdownSystem,        // 6 -> kernel routes to KeBugCheckEx
    &response);
// Never returns.

// Non-FATAL severity -> CSRSS displays a hard-error dialog with template text.
UNICODE_STRING msg;
RtlInitUnicodeString(&msg, L"Critical Windows component compromised. Restart now.");
ULONG_PTR params[1] = { (ULONG_PTR)&msg };
ULONG response;
NtRaiseHardError(
    STATUS_FATAL_APP_EXIT,
    1,
    1,                   // bit 0 = first param is a UNICODE_STRING*
    params,
    OptionOk,
    &response);

NtRaiseHardError PROC
    mov  r10, rcx
    mov  eax, 175h         ; Win11 24H2 SSN
    syscall
    ret
NtRaiseHardError ENDP

MITRE ATT&CK mappings

• T1485Data Destructionmitre ↗
• T1529System Shutdown/Rebootmitre ↗
• T1106Native APImitre ↗