NtReleaseKeyedEvent

Prototype

NTSTATUS NtReleaseKeyedEvent(
  HANDLE         KeyedEventHandle,
  PVOID          Key,
  BOOLEAN        Alertable,
  PLARGE_INTEGER Timeout
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 7D 01 00 00      mov eax, 0x17D
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The wake half of the keyed-event pair, and famously *symmetric* with `NtWaitForKeyedEvent`: a release with no matching waiter blocks the caller until a waiter shows up, rather than dropping the wake on the floor as a regular event would. This is what makes the primitive correct for `RtlEnterCriticalSection`'s out-of-pool path — releases and waits self-throttle, so a single global event services unbounded contention without losing wakes. The kernel handler is `ExpReleaseWaitForKeyedEvent` (a tiny inverse of `ExpWaitForKeyedEvent`); both consult the per-event hash table that pairs `(process, key)` tuples.

Common malware usage

Mirror of `NtWaitForKeyedEvent`. In sleep-obfuscation chains, this is the syscall that *wakes the beacon up* after the sleep mask has unprotected and decrypted itself. Some designs invoke it from an APC delivered by an `NtSetTimer2` callback, others from a ROP gadget chained off a fake context — either way the global handle on the PEB means no new named object is touched. Outside that very narrow design pattern, calls to `NtReleaseKeyedEvent` from non-Microsoft code are virtually nonexistent.

Detection opportunities

Same as `NtWaitForKeyedEvent` — there is no targeted ETW / Sysmon surface. Memory-introspection ETW (`Microsoft-Windows-Threat-Intelligence` `AllocVm` / `ProtectVm` events) catching an RW→RX flip on private pages *immediately followed by* a thread leaving `NtWaitForKeyedEvent` is a much stronger lead than tracing this syscall in isolation.

Direct syscall examples

; Direct syscall stub for NtReleaseKeyedEvent (SSN 0x17D on Win11 24H2)
NtReleaseKeyedEvent PROC
    mov  r10, rcx          ; KeyedEventHandle
    mov  eax, 17Dh         ; SSN — drifts per build
    syscall
    ret
NtReleaseKeyedEvent ENDP

// Companion to the NtWaitForKeyedEvent low-memory critical-section example.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtReleaseKeyedEvent)(
    HANDLE, PVOID, BOOLEAN, PLARGE_INTEGER);

static pNtReleaseKeyedEvent g_release;

void WakeOnLockWord(volatile void **lockSlot) {
    if (!g_release) {
        g_release = (pNtReleaseKeyedEvent)GetProcAddress(
            GetModuleHandleA("ntdll.dll"), "NtReleaseKeyedEvent");
    }
    // NULL handle ⇒ kernel substitutes peb->KeyedEventHandle.
    // If no waiter exists yet, this call blocks until one shows up — that
    // symmetry is what keeps the global event correct under contention.
    g_release(NULL, (PVOID)lockSlot, FALSE, NULL);
}

// On Win8+ this is the preferred user-mode wake primitive; underneath it
// resolves to keyed-event releases for the futex-style address path.
use windows_sys::Win32::System::Threading::WakeByAddressSingle;

unsafe fn wake_one(addr: *mut u32) {
    WakeByAddressSingle(addr as *const _ as _);
}

MITRE ATT&CK mappings

• T1027Obfuscated Files or Informationmitre ↗
• T1106Native APImitre ↗