NtSetBootEntryOrder

Prototype

NTSTATUS NtSetBootEntryOrder(
  PULONG Ids,
  ULONG  Count
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 96 01 00 00      mov eax, 0x196
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The write companion to NtQueryBootEntryOrder. On UEFI the kernel ultimately calls `EFI_SET_VARIABLE` against the global `BootOrder` variable (vendor GUID `{8BE4DF61-93CA-11d2-AA0D-00E098032B8C}`) with `EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS`. SeSystemEnvironmentPrivilege is mandatory and the call fails STATUS_INVALID_PARAMETER if any supplied ID does not currently exist.

Common malware usage

The capstone of BCD-based bootkit installation: once a rogue `Boot####` has been registered via NtAddBootEntry, this is the call that **wins** the next reboot for the attacker by promoting that ID to position 0. Without this step, the attacker's entry is dormant — UEFI tries the existing Windows Boot Manager first and never reaches it. The reorder is what makes the implant active. BlackLotus, ESPecter, and the TrickBoot module each end their install path with this primitive.

Detection opportunities

**Highest-fidelity BCD signal in the family.** Any modification to `BootOrder` that promotes a non-Microsoft, non-OEM-recovery entry to slot 0 is essentially diagnostic of a bootkit attempt. Monitor: ETW Microsoft-Windows-Kernel-Boot order-change events, Sysmon registry events on BCD writes, and the EFI `BootOrder` variable through a periodic CHIPSEC or Eclypsium scan. Defenders should also enroll endpoints in **Measured Boot + remote attestation** — PCR[4] (boot manager image hash) and PCR[7] (Secure Boot policy + signature DB hash) measurements diverge from the expected baseline on the very first compromised boot, before the user is even logged in.

Direct syscall examples

NtSetBootEntryOrder PROC
    mov  r10, rcx          ; PULONG Ids
    mov  eax, 0196h        ; Win11 24H2
    syscall
    ret
NtSetBootEntryOrder ENDP

// PoC: read order, move our_id to the front, write back.
extern NTSTATUS NTAPI NtQueryBootEntryOrder(PULONG, PULONG);
extern NTSTATUS NTAPI NtSetBootEntryOrder(PULONG, ULONG);

NTSTATUS promote(ULONG our_id) {
    ULONG count = 0;
    NtQueryBootEntryOrder(NULL, &count);
    PULONG ids = (PULONG)HeapAlloc(GetProcessHeap(), 0, count * sizeof(ULONG));
    NtQueryBootEntryOrder(ids, &count);
    // find our_id, swap to front
    for (ULONG i = 0; i < count; ++i) {
        if (ids[i] == our_id) {
            memmove(&ids[1], &ids[0], i * sizeof(ULONG));
            ids[0] = our_id;
            break;
        }
    }
    NTSTATUS s = NtSetBootEntryOrder(ids, count);
    HeapFree(GetProcessHeap(), 0, ids);
    return s;
}

use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_set_boot_entry_order(_ids: *const u32, _count: u32) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x196",  // Win11 24H2
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1542.003Pre-OS Boot: Bootkitmitre ↗
• T1542Pre-OS Bootmitre ↗
• T1106Native APImitre ↗