NtCreateLowBoxToken

Other → NTSTATUS

NtCreateLowBoxToken is a Windows NT kernel system call, in the Other category, returning NTSTATUS. Its syscall number is not the same on every Windows release: across the 40 version-and-architecture pairs recorded here it takes 24 distinct values, from 0x00A2 to 0x015D.

The number is an index into the system service table of one particular build, not a stable identifier, so it is not portable between Windows versions or between x64 and x86. The table below gives the value recorded for each.

Numbers across OS versions (40)

OS VersionArchitectureNumber
Windows 10 1507 x86 0x0153 (339)
Windows 10 1507 x64 0x00A5 (165)
Windows 10 1511 x86 0x0155 (341)
Windows 10 1511 x64 0x00A6 (166)
Windows 10 1607 x86 0x0157 (343)
Windows 10 1607 x64 0x00A7 (167)
Windows 10 1703 x86 0x015A (346)
Windows 10 1703 x64 0x00AA (170)
Windows 10 1709 x64 0x00AB (171)
Windows 10 1709 x86 0x015D (349)
Windows 10 1803 x86 0x015D (349)
Windows 10 1803 x64 0x00AC (172)
Windows 10 1809 x64 0x00AC (172)
Windows 10 1809 x86 0x015C (348)
Windows 10 1903 x64 0x00AD (173)
Windows 10 1903 x86 0x015C (348)
Windows 10 1909 x86 0x015C (348)
Windows 10 1909 x64 0x00AD (173)
Windows 10 2004 x86 0x015C (348)
Windows 10 2004 x64 0x00B1 (177)
Windows 10 20H2 x64 0x00B1 (177)
Windows 10 20H2 x86 0x015C (348)
Windows 10 21H1 x64 0x00B1 (177)
Windows 10 21H1 x86 0x015C (348)
Windows 10 21H2 x64 0x00B2 (178)
Windows 10 21H2 x86 0x015C (348)
Windows 10 22H2 x86 0x015C (348)
Windows 10 22H2 x64 0x00B2 (178)
Windows 11 and Server 11 21H2 x64 0x00B5 (181)
Windows 11 and Server 11 22H2 x64 0x00B6 (182)
Windows 11 and Server 11 23H2 x64 0x00B6 (182)
Windows 11 and Server 11 24H2 x64 0x00B8 (184)
Windows 11 and Server 11 25H2 x64 0x00B8 (184)
Windows 11 and Server Server 2022 x64 0x00B4 (180)
Windows 11 and Server Server 2025 x64 0x00B8 (184)
Windows 11 and Server Server 23H2 x64 0x00B7 (183)
Windows 8 8.0 x86 0x0149 (329)
Windows 8 8.0 x64 0x00A2 (162)
Windows 8 8.1 x86 0x014D (333)
Windows 8 8.1 x64 0x00A3 (163)