NtRequestWaitReplyPort

Prototype

NTSTATUS NtRequestWaitReplyPort(
  HANDLE         PortHandle,
  PPORT_MESSAGE  Request,
  PPORT_MESSAGE  Reply
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 22 00 00 00      mov eax, 0x22
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtRequestWaitReplyPort is the synchronous request/response primitive of the legacy **LPC** subsystem — conceptually equivalent to `NtAlpcSendWaitReceivePort` with `ALPC_MSGFLG_SYNC_REQUEST`. It sends one PORT_MESSAGE and blocks the calling thread until the server replies through `NtReplyPort` or `NtReplyWaitReceivePort`. The SSN `0x22` has been frozen since Windows 10 1507, reflecting LPC's status as a legacy table-prefix component. Inline payload is capped at PORT_MAXIMUM_MESSAGE_LENGTH (256 bytes); larger transfers require a shared PORT_VIEW exchanged at connect time.

Common malware usage

On contemporary Windows the practical use of NtRequestWaitReplyPort by malware is largely *historical*: pre-Vista user-mode rootkits and early IPC-aware droppers used it as a stealthy in-host C2 between a loader and an injected payload because no Win32 wrapper existed and the traffic never touched the network stack. Modern attackers overwhelmingly prefer ALPC, named pipes, or shared sections — so any observation of raw LPC request/reply traffic is itself anomalous and worth investigating.

Detection opportunities

There is no dedicated ETW provider for legacy LPC equivalent to `Microsoft-Windows-Kernel-ALPC`. Kernel-mode EDRs can hook the syscall directly; user-mode EDRs hook `ntdll!NtRequestWaitReplyPort`. Because the legitimate-caller baseline on Windows 10/11 is essentially zero (almost nothing in the OS still uses raw LPC for RPC), *any* hit from an unsigned or sandboxed process is high-signal. SystemInformer's per-process port view shows LPC handles distinctly from ALPC handles.

Direct syscall examples

; Direct syscall stub for NtRequestWaitReplyPort (SSN 0x22, stable Win10 1507+)
NtRequestWaitReplyPort PROC
    mov  r10, rcx          ; PortHandle
    mov  eax, 22h          ; SSN
    syscall
    ret
NtRequestWaitReplyPort ENDP

// Send a request and wait for the reply on a connected LPC port.
#include <windows.h>
#include <winternl.h>

#define PORT_MAXIMUM_MESSAGE_LENGTH 256

typedef NTSTATUS (NTAPI *pNtRequestWaitReplyPort)(
    HANDLE, PVOID /*PPORT_MESSAGE*/, PVOID /*PPORT_MESSAGE*/);

NTSTATUS LpcCall(HANDLE hPort, void *reqBuf, void *replyBuf) {
    pNtRequestWaitReplyPort fn = (pNtRequestWaitReplyPort)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtRequestWaitReplyPort");
    return fn(hPort, reqBuf, replyBuf);
}

// Cargo: ntapi = "0.4"
use ntapi::ntlpcapi::NtRequestWaitReplyPort;
use winapi::shared::ntdef::{HANDLE, NTSTATUS};

unsafe fn lpc_call(port: HANDLE, req: *mut u8, reply: *mut u8) -> NTSTATUS {
    NtRequestWaitReplyPort(port, req as *mut _, reply as *mut _)
}

MITRE ATT&CK mappings

• T1559Inter-Process Communicationmitre ↗
• T1106Native APImitre ↗