NtRequestPort

Prototype

NTSTATUS NtRequestPort(
  HANDLE         PortHandle,
  PPORT_MESSAGE  RequestMessage
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 86 01 00 00      mov eax, 0x186
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtRequestPort is the asynchronous, no-reply variant of NtRequestWaitReplyPort on the legacy **LPC** path. The kernel copies the inline PORT_MESSAGE into the receiver's port queue and returns immediately — the caller never blocks for a server response. It is typically used for one-way notifications (e.g. CSRSS event posting on pre-Vista builds). Inline payload is capped at PORT_MAXIMUM_MESSAGE_LENGTH (256 bytes); larger payloads require a previously-negotiated PORT_VIEW shared section.

Common malware usage

On modern Windows, malware use of NtRequestPort is *negligible*. Historically a few pre-Vista user-mode rootkits employed it as a one-way fan-out signal (e.g. notify a co-resident component to flip state) precisely because no Win32 wrapper exists and userspace tooling rarely surfaces LPC traffic. Today an attacker who wants this semantic uses NtAlpcSendWaitReceivePort with `ALPC_MSGFLG_RELEASE_MESSAGE`, a writable mailslot, or a named-pipe write. Any raw LPC request from an unsigned process is in itself anomalous and worth chasing.

Detection opportunities

There is no dedicated ETW provider for legacy LPC equivalent to `Microsoft-Windows-Kernel-ALPC`. Kernel-mode EDRs can hook the syscall directly; user-mode EDRs hook `ntdll!NtRequestPort`. The legitimate-caller baseline on Windows 10/11 is essentially zero (almost nothing inbox still uses raw LPC), so *any* hit from an unsigned or sandboxed process is high signal. WinObj reveals live port objects but not in-flight messages.

Direct syscall examples

; Direct syscall stub for NtRequestPort (SSN 0x186 on Win11 24H2)
NtRequestPort PROC
    mov  r10, rcx          ; PortHandle
    mov  eax, 186h         ; SSN — verify per-build
    syscall
    ret
NtRequestPort ENDP

// Send a one-way LPC message on a connected port.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtRequestPort)(HANDLE, PVOID /*PPORT_MESSAGE*/);

NTSTATUS LpcNotify(HANDLE hPort, void *msgBuf) {
    pNtRequestPort fn = (pNtRequestPort)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtRequestPort");
    return fn(hPort, msgBuf);  // returns once the kernel queues the message
}

MITRE ATT&CK mappings

• T1559Inter-Process Communicationmitre ↗
• T1106Native APImitre ↗