NtSetDriverEntryOrder

Prototype

NTSTATUS NtSetDriverEntryOrder(
  PULONG Ids,
  ULONG  Count
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 9F 01 00 00      mov eax, 0x19F
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Write counterpart to NtQueryDriverEntryOrder. Together with NtAddDriverEntry / NtModifyDriverEntry / NtDeleteDriverEntry it forms the full programmatic surface for the UEFI DriverOrder NVRAM variable. Requires SeSystemEnvironmentPrivilege. On modern UEFI hardware with Secure Boot enforcing, planting a malicious Driver#### entry that the firmware will actually execute still requires the EFI binary itself to be signed by a key in db — so this syscall is necessary but not sufficient for firmware persistence. STATUS_NOT_IMPLEMENTED on legacy BIOS / CSM-only systems.

Common malware usage

Persistence-promotion step for UEFI-aware threats: after planting a Driver#### entry (via NtAddDriverEntry) the attacker calls NtSetDriverEntryOrder to ensure their entry runs *before* the trusted OS-loader handoff, giving a malicious UEFI driver the chance to hook critical EFI boot services (LoadImage, StartImage, ExitBootServices) and survive into kernel context. BlackLotus's chain conceptually relies on this kind of ordering manipulation, though its primary persistence used a separate `revocations.efi`/MOK pathway. CosmicStrand modified firmware boot order at the chip level rather than via this syscall; the syscall path is more typical of supply-chain implants distributed through OEM update tooling.

Detection opportunities

Any successful call is high-fidelity. Microsoft-Windows-Kernel-General ETW fires firmware-write events. Compare DriverOrder before/after via baseline snapshots — Microsoft Defender for Endpoint Boot Integrity dashboards alert on changes. The privilege-enable trace (SeSystemEnvironmentPrivilege) is the cheapest defensive checkpoint. Windows 11 24H2 / Server 2025's System Guard Secure Launch detects unexpected DriverOrder changes via the measured-boot log and reports through Microsoft-Windows-Kernel-Boot.

Direct syscall examples

; Direct syscall stub for NtSetDriverEntryOrder (SSN 0x19F, Win11 24H2)
NtSetDriverEntryOrder PROC
    mov  r10, rcx
    mov  eax, 19Fh
    syscall
    ret
NtSetDriverEntryOrder ENDP

// Educational. Real bootkits still need a signed (or signature-bypass) EFI binary.
// 1. attacker added Driver1234 via NtAddDriverEntry pointing at \EFI\evil.efi
// 2. query current order, prepend 0x1234, write it back.
BOOLEAN was;
RtlAdjustPrivilege(SE_SYSTEM_ENVIRONMENT_PRIVILEGE, TRUE, FALSE, &was);

ULONG existing[32];
ULONG count = ARRAYSIZE(existing);
if (!NT_SUCCESS(NtQueryDriverEntryOrder(existing, &count))) return -1;

ULONG reordered[33] = { 0x1234 };
RtlCopyMemory(&reordered[1], existing, count * sizeof(ULONG));

NTSTATUS s = NtSetDriverEntryOrder(reordered, count + 1);

MITRE ATT&CK mappings

• T1542.001Pre-OS Boot: System Firmwaremitre ↗
• T1542.003Pre-OS Boot: Bootkitmitre ↗
• T1547Boot or Logon Autostart Executionmitre ↗