NtSerializeBoot

Prototype

NTSTATUS NtSerializeBoot(VOID);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 95 01 00 00      mov eax, 0x195
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Performance-diagnostics primitive: called once by the Session Manager (smss.exe) and prefetcher infrastructure to signal that the boot phase is complete and the kernel may serialize the in-memory boot trace to disk (e.g. for `xperf -on Base+Boot` style sessions and the SuperFetch boot prefetcher). No arguments, no inputs to forge. Calling it outside the legitimate one-shot context is effectively a no-op or returns STATUS_UNSUCCESSFUL. Microsoft documentation is minimal because the routine is part of the prefetcher contract rather than a public Win32 surface.

Common malware usage

Minimal offensive value. There is no privilege-escalation primitive here, no information disclosure beyond what the prefetcher already writes to %SystemRoot%\Prefetch, and no behavioural change. Occasionally referenced as a curiosity in syscall-table tooling but not part of any documented malware family's TTPs.

Detection opportunities

Treat as a baseline curiosity. Microsoft-Windows-Kernel-Prefetch ETW provider records prefetcher state transitions; if NtSerializeBoot is invoked from anything other than smss.exe (or the prefetcher service) it is anomalous, but the practical false-positive cost of alerting is low because the legitimate caller count is one. Defenders generally do not need to track this — focus telemetry budget elsewhere.

Direct syscall examples

; Direct syscall stub for NtSerializeBoot (SSN 0x195, Win11 24H2)
NtSerializeBoot PROC
    mov  r10, rcx
    mov  eax, 195h
    syscall
    ret
NtSerializeBoot ENDP

// This is what smss.exe does once the boot phase completes. Calling it again from
// a user-mode process is a no-op in practice.
extern NTSTATUS NTAPI NtSerializeBoot(VOID);

NTSTATUS s = NtSerializeBoot();
// s == STATUS_SUCCESS only inside the one legitimate caller's lifetime.

MITRE ATT&CK mappings

• T1106Native APImitre ↗