NtRollbackTransaction

Prototype

NTSTATUS NtRollbackTransaction(
  HANDLE  TransactionHandle,
  BOOLEAN Wait
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 8F 01 00 00      mov eax, 0x18F     ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Aborts the transaction at the KTM level. Every NTFS change performed under the transaction is reverted to its pre-transaction state by replaying the CLFS undo log. Crucially, **sections already created from a transacted file remain valid** — the kernel does not invalidate `SectionObject->ControlArea->FilePointer` mappings just because the underlying file was rolled back. This decoupling is the entire foundation of Process Doppelgänging.

Common malware usage

The closing move of canonical **Process Doppelgänging** (T1055.013). After the malicious payload has been written to a transacted file *and* a section has been created from it, the rollback discards the on-disk evidence. The on-disk file either disappears entirely or reverts to its pre-transaction content (often a copy of a clean Microsoft-signed binary), while the in-memory section — still backed by the malicious bytes — is used to spawn a process. From the kernel's process-creation perspective, the image file name still points at the clean reverted file: this defeats hash-based AV that scans the binary on disk and most signature-based product-image lookups. SynAck (2018), Osiris/Kronos banker variants and the original enSilo PoC all end the chain with this call.

Detection opportunities

ETW `Microsoft-Windows-Kernel-File` exposes transaction rollback events; correlating rollback events with section creations against the same `FileObject` is the highest-fidelity Doppelgänging hunt. Microsoft Defender for Endpoint added a behavioural detection for the create-write-section-rollback pattern after 2018. Independent detection vectors: compare `PEB->ProcessParameters->ImagePathName` content hash against the on-disk file at process-creation time; flag any mismatch. Kernel-mode callbacks on `PsSetCreateProcessNotifyRoutineEx` receive `CREATE_PROCESS_NOTIFY_INFO->FileObject`, which still points at the transacted (now rolled-back) file — the file's `FileObject->SectionObjectPointer->ImageSectionObject` may already be detached, which is itself anomalous.

Direct syscall examples

// Final step of Process Doppelgänging — section is already created.
// After this call, the on-disk file is restored, but hSection still maps payload.

NTSTATUS s = NtRollbackTransaction(hTransaction, /*Wait=*/ TRUE);
if (!NT_SUCCESS(s)) return s;

NtClose(hTransactedFile);
NtClose(hTransaction);

// Spawn process from the orphaned section.
HANDLE hProcess = NULL;
NtCreateProcessEx(
    &hProcess,
    PROCESS_ALL_ACCESS,
    NULL,
    NtCurrentProcess(),
    PROCESS_CREATE_FLAGS_INHERIT_HANDLES,
    hSection,
    NULL, NULL, FALSE);

; NtRollbackTransaction direct stub — SSN 0x18F on Win11 24H2
NtRollbackTransaction PROC
    mov  r10, rcx
    mov  eax, 18Fh
    syscall
    ret
NtRollbackTransaction ENDP

use ntapi::ntxcapi::NtRollbackTransaction;
use winapi::shared::ntdef::HANDLE;

unsafe fn rollback(tx: HANDLE) {
    let status = NtRollbackTransaction(tx, 1 /* TRUE */);
    assert!(status >= 0, "rollback failed: 0x{:X}", status);
}

MITRE ATT&CK mappings

• T1055.013Process Doppelgängingmitre ↗
• T1027Obfuscated Files or Informationmitre ↗
• T1106Native APImitre ↗