{"Id":"50eec1d1-87ea-405d-a7c0-d789c29630a7","Tags":["pwdrvio.sys"],"Verified":"TRUE","Author":"AmeerTheInteger, Michael Haag","Created":"2026-09-18","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"","Description":"MiniTool Partition Wizard's pwdrvio.sys exposes raw physical-disk read and write operations through the PartitionWizardDiskAccesser device namespace. The reviewed sample accepts a numeric device-name suffix, resolves the corresponding physical disk, and forwards caller-controlled read/write requests to the disk stack. Its device is created without FILE_DEVICE_SECURE_OPEN and its create handler does not authorize the caller opening that namespace path. Static analysis therefore supports the reported standard-user access to raw disk contents once the driver is loaded, which can bypass file-system access controls and enable privilege escalation. This is physical-disk access, not arbitrary physical-memory mapping; standard-user reachability was not reproduced locally.","Usecase":"Bypass file-system access controls through raw disk read/write access.","Privileges":"Local user once the driver is loaded; administrator required to install the driver.","OperatingSystem":"Windows"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/426","https://github.com/AmeerTheInteger/Windows-kernel-LPE-pwdrivio.sys","https://github.com/canomer/CVE-2026-36981-Kernel-EoP-PoC","https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/controlling-device-namespace-access"],"Acknowledgement":{"Person":"AmeerTheInteger (megab0t), canomer","Handle":"@AmeerTheInteger, @canomer"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"pwdrvio.sys","SHA256":"0489b3dec6a33e50d8a48a8dad3f5b923a81f7300e4a71358d90d2879bac9aa2","MD5":"c32ecb99ad25e9a04f01c8665df29ef8","SHA1":"c39334f452618af5087f3326758e7f77034f18cf","Imphash":"59e66ef22638bfa3854ecf84095d8092","Authentihash":{"MD5":"bbe68bc3bfe979cd33f33d996c5044be","SHA1":"ad9ab05f4062b44cb6de4092f4ddea7b72ffa7a7","SHA256":"354103278f131bb95e96b2d1499f33835bb474bb958ec094c0958022be6f1cdb"},"RichPEHeaderHash":{"MD5":"1511f51ce8d5ea75063f900d6f0a4e1f","SHA1":"7af33765888426362b05bd30cc863099046acd52","SHA256":"0c7616f9b7a6d4e7a0b9861e69708b6d8fb4fecd6ae051b056849690dfa63507"},"Sections":{".text":{"Entropy":6.278113410395565,"Virtual Size":"0x1be0"},".rdata":{"Entropy":4.567559166167582,"Virtual Size":"0x33c"},".data":{"Entropy":0.664590228026529,"Virtual Size":"0x188"},".pdata":{"Entropy":3.7635813560177778,"Virtual Size":"0x12c"},"INIT":{"Entropy":4.985618979214897,"Virtual Size":"0x3f8"},".reloc":{"Entropy":0.6941585103280635,"Virtual Size":"0x3c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2009-06-16 01:43:45","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ExAllocatePoolWithTag","IoGetLowerDeviceObject","IoBuildDeviceIoControlRequest","IoDeleteSymbolicLink","ExFreePoolWithTag","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","KeInitializeEvent","IoFreeMdl","MmMapLockedPagesSpecifyCache","IoGetDeviceObjectPointer","IoBuildAsynchronousFsdRequest","IofCompleteRequest","KeWaitForSingleObject","IoFreeIrp","IoGetAttachedDeviceReference","RtlCompareUnicodeString","MmUnlockPages","ObfReferenceObject","IoCreateSymbolicLink","ObfDereferenceObject","RtlUnicodeStringToInteger","IoCreateDevice","DbgPrint","IofCallDriver","KeBugCheckEx","RtlAnsiCharToUnicodeChar"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Timestamping CA , G2","ValidFrom":"2011-04-13 10:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"4e5e56901e46b4d94931f3bb1739281bc216ddfd41dc0905049b6fb2a29ad6992e40990055b5ea3fa52076d38634d417cc553ac782eeefa8babcd8069f1550dfcd167b523a02d7191afdaff0785ce04bc518df3a241edaacb8a95804020730dbb0125efe31bef00448f4f070f83a5e5683cf3dfb0dbcf4c5ed979db9d4dba52784e3389b8ba735864420a43b6da46a0ba183fd28ebdaef28f6cc885dfb0a3b00abe021ebe22f356c0f8e344597eba2f79933357ecb9a8abb454de73f9fc2d98afa65b26ec77e65ffe892e12c31a2f7b02736488f266f3bee4d761f79c3e57f9635bc2d0ecc01b08e7fff518080a792d4b34446648c874f166307314b63b0dff3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012f4ee152d7","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"e140543fe3256027cfa79fc3c19c1776","SHA1":"c655f94eb1ecc93de319fc0c9a2dc6c5ec063728","SHA256":"3ca71e85908ff67368e4dc00253f5691b9e6d50c966e7784143d75fb92aa3448","SHA384":"d9d366f9328f2b55ee19a32cc5fd5148b81d764282fe5dc196c872ae249caa51d2c212ef39f33945dfe0cda81925e326"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2","ValidFrom":"2011-04-13 10:00:00","ValidTo":"2019-04-13 10:00:00","Signature":"225cc5dd3df40b70d8e3f5e7c58e0901bbb196365c5a07adc7a8444951257aae0da4193b929ccfb94226bb3b6c97e7c7ce116d6891da8d6df1534d54388c61f3c8827669be81320b31c36cc99e200a582ff048fe7e4807aad743589473540431a9780d3b8cb070c13d7ed7bd2f2ac3e2f58f0c90dc6ba5c8be685e5d6df878d2be49951e15780891fb34c8be84adbce0c6dd18dbf3caf07bc2143c18b803ba953e211e3f60697a7f6a039e8d4af9f0282c30845eec267242b16dcb64c3128cd6844b67417cb103177809e3ada8b6962da47e80034f88f7c16b5a4615cd2c198bd8709ce52d49886072a8a4195270435edad64603b0680e24ef4af60b2524ef24","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0400000000012f4ee1355c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"f6a9e8eb8784f3f694b4e353c08a0ff5","SHA1":"589a7d4df869395601ba7538a65afae8c4616385","SHA256":"cbdc9a0ad785d0c2013211746b42234e18bdc7d54a7a260647badc1c9e712ed4","SHA384":"dcec542f242317863d0b3d23947e17d6982e381003831777b07ed75b46fb18bd0392a89c9beb6862981cd05f3f2fb77b"}},{"Subject":"C=SG, O=GMO GlobalSign Pte Ltd, CN=GlobalSign TSA for MS Authenticode , G1","ValidFrom":"2013-08-23 00:00:00","ValidTo":"2024-09-23 00:00:00","Signature":"0231142e5857644185e8af12753c881cc35eec2ce9a13cf5baaa531db9d12963dc436786d439dadec6c9ffbe4585f4a4d7c151ea18ee40585ee67bcca241291338c8ea21169cce90a62efba6cad994df401df902182bbef65d4f9fff9a48dbc50509ca80cea0f9dc4bc323e6038fb4b4af5b71296191181a6b7af2fd0dd1cd7d5e98ebba705ee5f4ea43de353dc514818adb3e105ebb72faa1a093ab031cc1653c91138b045d2bc4b9161bcc55c50ce8abe743c9b28328a5531347ab3964b91cea3430b176009521f1d43da8fda00032d76e983ca69c3b0b83becbb8bb2a268c59b8b9aeaf26ace234a2dc210d810b3813f745a3e3dbc4aca16d1bb7e5615cd7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"1121405c1f0ed258882be54d8686ba11ea45","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"b95cbc184d388718612d5933f7b36770","SHA1":"ff124c5d160710720108616ffee99bbe090ed363","SHA256":"13027620255363f07bbf85ae7d0dc06c07d8b0f4368b12f983ee3f4fce605733","SHA384":"f42ed00f615f2822dcd3d33794477428afb52ddab932ebcde3586f92a27e18f9faba6b3334ca4e59e0cb24bdbf8395a6"}},{"Subject":"C=CA, ST=British Columbia, L=SURREY, O=MiniTool Solution Ltd, CN=MiniTool Solution Ltd, emailAddress=support@minitool.ca","ValidFrom":"2012-05-21 17:18:09","ValidTo":"2015-05-22 17:18:09","Signature":"2bb2ed004f0b5839e72ddbcf0ffd48ea699b7bc39a281f7f6901762d6b1637d1ba5ce349c83b65bcd49dd3f2db93cdcffd563a1e8c721ad4f30fbbc719f9beb7ac4302a08fbf3aba6ce6d5eb6d50241c36441f7cc641e2079c00d8941c4fa4eb04927d17ae57f4f234c274a4a74fb0366621360c05d5994eb8a802a6084938c4e5f89603d9cbde4f5f61c6183e974613016fcf1c7b2f1013c277c4f5551eb6e1bd45c0afd4582f6beebc3c5362f754b8b8e77a84296286980f766d471e46ed4c5bda16447667b96f4aa2e87c11c9b1646a3ca97e2d9c65420e6fe3d0b7f0722acf7144913015e91d6bb874b57faf7eaa0502e1fbf9923d37335685d5ff294eb5","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"1121cb5d7302c7544c0407cb59ffde7fb180","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"48bbbd3390fc5cc0431b5dc0f6b74df9","SHA1":"7071261ee77e58b3f1c98646174fe269a8c0a6ff","SHA256":"4c4da925fbb2a7498cefd270c92e4c137d687ba69fda7f9431837ef4e6fec15f","SHA384":"8e6aea858af4910e3813a17bbe146aaec4944cd9e4b167e564b92af4e676844bddc9da611592b1710cc4f8c2a01b8264"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"1121cb5d7302c7544c0407cb59ffde7fb180","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G2","Version":1}]}],"Signature":["MiniTool Solution Ltd"]}]}