NtWorkerFactoryWorkerReady

Prototype

NTSTATUS NtWorkerFactoryWorkerReady(
  HANDLE  WorkerFactoryHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 01 00 00 00      mov eax, 0x1
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The most stable syscall number in the entire table — `0x1` from Windows 7 onward. It is called exclusively by `ntdll!TppWorkerThread` (the canonical StartRoutine for any worker factory) and tells the kernel: 'this worker has finished its previous dispatch, decrement my pending count, I'm going back to NtWaitForWorkViaWorkerFactory'. The bookkeeping it performs is what lets the kernel decide whether to spawn more workers, retire idle ones, or keep the count flat.

Common malware usage

Almost never called directly by malware — it is part of the internal threadpool bookkeeping and only makes sense in the context of a real `TppWorkerThread` loop. The exception is PoolParty variants where the shellcode itself emulates the worker handshake to keep the threadpool's bookkeeping consistent (and therefore the parent process responsive) after hijacking a worker. Skipping the ready/wait/release cycle causes the kernel's `PendingWorkerCount` to drift, which in turn can starve the rest of the victim's threadpool — observable as a hung application.

Detection opportunities

Effectively undetectable in isolation — every Windows process with a CRT, .NET runtime, or COM apartment issues thousands of these per second. Detection only becomes possible when it is *missing*: a worker factory whose ready count never increments while its completion port is being drained indicates that something is bypassing the handshake (a PoolParty shellcode that forgot to emulate the loop, or a debugger holding a worker). This is a heuristic, not a primary signal.

Direct syscall examples

// Approximate reverse of the user-mode loop driven by NtCreateWorkerFactory.
// Do NOT call directly — this is what TppWorkerThread does on every worker.
VOID WINAPI TppWorkerThreadLike(PVOID context) {
    HANDLE hWf = ((PTHREADPOOL_INTERNAL)context)->WorkerFactoryHandle;
    for (;;) {
        FILE_IO_COMPLETION_INFORMATION info;
        NTSTATUS s = NtWaitForWorkViaWorkerFactory(hWf, &info);
        if (!NT_SUCCESS(s)) break;
        // Dispatch the callback that info.KeyContext encodes.
        DispatchCallback(&info);
        // Tell the kernel we're done and ready for the next item.
        NtWorkerFactoryWorkerReady(hWf);
    }
}

; Stable across every Windows 10/11 build.
NtWorkerFactoryWorkerReady PROC
    mov  r10, rcx
    mov  eax, 1
    syscall
    ret
NtWorkerFactoryWorkerReady ENDP

MITRE ATT&CK mappings

• T1106Native APImitre ↗