{"Id":"643b121c-f883-5699-a032-f07c1e9eecfd","Tags":["AToolsKrnl64.sys"],"Verified":"TRUE","Author":"Xusheng Li","Created":"2026-09-23","MitreID":"T1562.001","Category":"vulnerable driver","Commands":{"Command":"","Description":"Antiy ATool AToolsKrnl64.sys from the reported 2.0.26.819 package exposes process termination through IOCTL 0x99000050. Its caller check validates an Antiy-signed executable on disk and caches the accepted process, but does not verify the integrity of the running client. A modified genuine client can therefore pass this check and request termination of caller-selected processes. Static analysis of this sample confirms a world-readable device and a kernel-mode target-open path that does not require the caller to already hold termination rights. The termination path rejects targets with a nonzero driver-defined protection/state byte. The public demonstration terminates only a self-created ordinary child; protected-process and EDR termination are not established.","Usecase":"Abuse a trusted client to obtain kernel process-termination authority.","Privileges":"Driver must already be loaded and its device accessible; caller must be able to launch and modify a genuine Antiy-signed client. Loading the driver if absent requires administrator privileges.","OperatingSystem":"Windows"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/442","https://gist.github.com/xusheng6/5b9503d94c67b867d495a2f35f0a6de1","https://xusheng.dev/posts/byotc/main/","https://vs.antiy.cn/tool/atool.html"],"Acknowledgement":{"Person":"Xusheng Li","Handle":"@xusheng6"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"AToolsKrnl64.sys","SHA256":"f85af685660a28e3cd18e2c9ef6b1fbb440ae0c5934e625e8a055e1f158c3e56","MD5":"f0a5d14e0a8acea507ef9a694661e544","SHA1":"8f18c4c157b4078669364c081068fc2bb271c12b","Imphash":"79724a023a31b15116d696a24877176a","Authentihash":{"MD5":"fcf3fe21b796b21967ac2f9c292c22d1","SHA1":"c5acaa2a55817ea99875a159c761530c8aa16a0d","SHA256":"613d60ec08d1383b38d0c6c01b870712864865a70f13677dee7cc1270caacab1"},"RichPEHeaderHash":{"MD5":"e9dddfd8d121d573f49a3b7671b5e628","SHA1":"106c8863551c91d7d9b6e13c7ce1832e319718ff","SHA256":"d6357bdc0c8495eff2a858377f90d63d8fd71183e2178b269182d1916f7f2ecd"},"Sections":{".text":{"Entropy":6.3854323363628955,"Virtual Size":"0x1dda7"},".rdata":{"Entropy":3.8829825311921,"Virtual Size":"0x2257c"},".data":{"Entropy":2.2015826354433847,"Virtual Size":"0x32800"},".pdata":{"Entropy":5.564971293770796,"Virtual Size":"0x2fe8"},"PAGE":{"Entropy":6.452914533151298,"Virtual Size":"0x2b96c"},"INIT":{"Entropy":6.243281199792358,"Virtual Size":"0x2caa"},".rsrc":{"Entropy":3.2857850583807346,"Virtual Size":"0x370"},".reloc":{"Entropy":5.387661208022334,"Virtual Size":"0x98e8"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-08-19 02:11:50","Description":"Kernel Call Services","Company":"Antiy Labs","InternalName":"Atools2","OriginalFilename":"Atools2.sys","FileVersion":"2.0.26.819","Product":"ATOOLS","ProductVersion":"2.0.0.1","Copyright":"Copyright (C) 2017-2026, Antiy Labs, All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","ksecdd.sys","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["MmIsAddressValid","ZwWriteFile","PsRemoveCreateThreadNotifyRoutine","PsSetCreateProcessNotifyRoutine","IoFreeMdl","IoDriverObjectType","IoUnregisterShutdownNotification","_purecall","MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","wcsstr","_vsnprintf","KeCancelTimer","wcschr","swprintf","ZwCreateFile","KeSetTimerEx","KeNumberProcessors","KeInitializeEvent","_stricmp","ExFreePoolWithTag","_wcsicmp","PsGetProcessPeb","strncat","ExAllocatePoolWithTag","vsprintf","ZwCreateEvent","ZwCreateKey","strncmp","RtlAnsiStringToUnicodeString","ExInitializeNPagedLookasideList","_snwprintf","ZwQuerySymbolicLinkObject","_wcsnicmp","ZwMapViewOfSection","RtlInitUnicodeString","KeSetEvent","wcsncpy","ProbeForWrite","ZwQueryDefaultUILanguage","ExpInterlockedPushEntrySList","RtlQueryRegistryValues","RtlInitAnsiString","ZwQueryObject","RtlUnicodeStringToAnsiString","_snprintf","ZwSetValueKey","ZwQuerySystemInformation","KeReleaseSpinLock","ExpInterlockedPopEntrySList","ZwOpenSymbolicLinkObject","ZwOpenDirectoryObject","RtlImageDirectoryEntryToData","MmUserProbeAddress","KeDelayExecutionThread","RtlFreeUnicodeString","strncpy","ZwWaitForSingleObject","wcsrchr","PsCreateSystemThread","ExSystemTimeToLocalTime","ZwQueryValueKey","ZwUnmapViewOfSection","PsTerminateSystemThread","rand","_vsnwprintf","srand","ExQueryDepthSList","KeWaitForSingleObject","ZwQueryDirectoryObject","ZwDuplicateObject","RtlTimeToTimeFields","RtlFreeAnsiString","ZwDeviceIoControlFile","ZwQueryInformationProcess","PsGetCurrentProcessId","ZwCreateSection","ZwOpenFile","wcsncmp","ZwQueryInformationFile","RtlFormatCurrentUserKeyPath","DbgPrint","ExDeleteNPagedLookasideList","ZwOpenKey","KeAcquireSpinLockRaiseToDpc","ZwRestoreKey","ExQueueWorkItem","PsGetProcessSectionBaseAddress","IoThreadToProcess","PsGetProcessWin32Process","PsProcessType","ZwClose","IoDeleteSymbolicLink","IoRegisterPlugPlayNotification","ExReleaseFastMutex","IoRegisterShutdownNotification","IoGetBaseFileSystemDeviceObject","ObOpenObjectByName","ExAcquireFastMutex","PsGetProcessImageFileName","PsLookupProcessByProcessId","RtlValidSecurityDescriptor","KeInitializeApc","IoGetRelatedDeviceObject","IoDeleteDevice","KeInsertQueueApc","MmGetSystemRoutineAddress","IoCreateFile","ZwQuerySecurityObject","PsGetProcessCreateTimeQuadPart","PsSetCreateThreadNotifyRoutine","RtlGetVersion","PsGetThreadTeb","MmHighestUserAddress","ZwDeleteValueKey","LpcPortObjectType","LsaFreeReturnBuffer","KeUnstackDetachProcess","ZwSaveKey","ZwOpenProcessTokenEx","ObQueryNameString","IoFileObjectType","MmMapLockedPagesSpecifyCache","IoGetDeviceObjectPointer","KeQueryPrcbAddress","KdDebuggerEnabled","ZwQueryDirectoryFile","ZwFreeVirtualMemory","InitSafeBootMode","ZwSetInformationProcess","KeQueryTimeIncrement","ZwEnumerateValueKey","ExWindowStationObjectType","PsGetThreadWin32Thread","KeBugCheck","IoUnregisterPlugPlayNotification","IofCompleteRequest","PsGetProcessExitProcessCalled","ExAllocatePoolWithQuota","PsGetProcessInheritedFromUniqueProcessId","RtlLengthSecurityDescriptor","ObReferenceObjectByHandle","ZwSetSecurityObject","IoFreeIrp","PsInitialSystemProcess","PsThreadType","RtlCompareUnicodeString","IoAllocateIrp","IoGetDeviceInterfaces","ZwOpenProcess","NtOpenProcessToken","ObfReferenceObject","IoCreateSymbolicLink","PsGetCurrentThreadId","KeAddSystemServiceTable","ObfDereferenceObject","ObReferenceObjectByName","IoDeviceObjectType","ZwQueryInformationToken","KeWaitForMultipleObjects","ZwQueryInformationThread","PsGetCurrentProcessSessionId","ZwDeleteKey","ObOpenObjectByPointer","PsGetProcessId","KeStackAttachProcess","ZwAlertThread","MmSectionObjectType","PsLookupThreadByThreadId","PsGetProcessWow64Process","ZwEnumerateKey","IofCallDriver","ZwAllocateVirtualMemory","KeBugCheckEx","NtBuildNumber","sprintf","IoCreateDevice","SeCaptureSecurityDescriptor","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","IoIsWdmVersionAvailable","SeExports","RtlLengthSid","RtlAddAccessAllowedAce","RtlGetSaclSecurityDescriptor","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","IoGetCurrentProcess","PsRemoveLoadImageNotifyRoutine","ExGetPreviousMode","PsSetLoadImageNotifyRoutine","MmSystemRangeStart","__C_specific_handler","KeStallExecutionProcessor","GetSecurityUserInfo","FltEnumerateFilters"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=CN, ST=Beijing, O=Antiy Labs, CN=Antiy Labs","ValidFrom":"2020-01-10 00:00:00","ValidTo":"2023-03-20 12:00:00","Signature":"3be6367cfd54688f1922edba1a6e0d3c346958430c78090476134c2e1142d1d11d28dec36d9254053d5aec140093082233b9388cee72bf6f366f8a0f9852e39a791496d9ff4c6e63b2191444414464045c5d1ea6f61b60082583ced90a764511e906462dad30312899319d68cf60c0379deb4f821ad44d1c889098709bc0d0ad252f5d28610f1457e332d4b587b002b21298f866d77e616d0f3e3a3ef1db9d0f163f5af33630cd511768899922fed4740173dcee943ad4dcab6af4d65b917d0dc629c48a27b0d62c9217559bf065c16cd5e0eb954f474f74830a770fc631654f4efff8021f50f9c10d3557eabf6120d4c239a9a840bb84a486ee8d632965156f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0cb0fe4cb4a08e8f1dcc4382cdc67331","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"d1d68e1e6b6af1ee26989c4f8ad01ab9","SHA1":"10d4450b221c5acffa0a31322aae29528369da1e","SHA256":"3c5180aa5cabd134b61e6c4b62cd5f11a4281cd8a7621098483b23eb58bf764d","SHA384":"7e59201bc0d5313b71940d2e70c274b842e183eef171b704f0f25ef3607d649a574e4785a9eb2343b525c8f4b52347d2"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA","ValidFrom":"2011-04-15 19:41:37","ValidTo":"2021-04-15 19:51:37","Signature":"5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611cb28a000000000026","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"983a0c315a50542362f2bd6a5d71c8d0","SHA1":"8047f476001f5cb16a661d2a3fd0c3576168f5e2","SHA256":"5f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83","SHA384":"5f014b60511ddab3247ef0b3c03fe82c622237ba76015e2911d1adc50dc632d56ebd1ee532f3c2b6cbfe68d80a2c91dc"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4","ValidFrom":"2022-08-01 00:00:00","ValidTo":"2031-11-09 23:59:59","Signature":"70a0bf435c55e7385fa0a3741b3db616d7f7bf5707bd9aaca1872cec855ea91abb22f8871a695422eda488776dbd1a14f4134a7a2f2db738eff4ff80b9f8a1f7f272de24bc5203c84ed02adefa2d56cff9f4f7ac307a9a8bb25ed4cfd143449b4321eb9672a148b499cb9d4fa7060313772744d4e77fe859a8f0bf2f0ba6e9f2343cecf703c787a8d24c401935466a6954b0b8a1568eeca4d53de8b1dcfd1cd8f4775a5c548c6fefa1503dfc760968849f6fcadb208d35601c0203cb20b0ac58a00e4063c59822c1b259f5556bcf27ab6c76ce6f232df47e716a236b22ff12b8542d277ed83ad9f0b68796fd5bd15cac18c34d9f73b701a99f57aa5e28e2b994","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"0e9b188ef9d02de7efdb50e20840185a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"21a266bd49f2778b24d13d95641ea6ac","SHA1":"21319f341fdf06bf6a104427afa8b7823b1ea7f3","SHA256":"e933dc68ee65abd1f9b1aa6738eff60a6895d3d8cc4accf0c69069aa3decd757","SHA384":"11533efd6b326a4e065a936de300fe0586a479f93d569d2403bd62c7ad35f1b2199daee3adb510f429c4fc97b4b024e3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"7b721d64ff88c83ac1b7e9e7a9c487bbdb9492d7905933fa2b87dea85b80253f138f9b831b7c43c4e68cdf393ec315ecb0da3b21257b24c1725db84791811346fa9c3f6a5138deb425cbf0abdfc528015479104624d1380f26a161904dbabd28e63ff1c4aa9bf6da35534fc9f23dd36cdc23edaaa04d6709f33a803d3cfb364c90e776a4ddf23abf56352fa24c65e8e0d4dad1c7c8916a2d234f373b199418d4d59c103cd5b11c19ff8fc86b9b9ef8ae9c999678d1cd9c51155b4226725a8d0a4a239240e886de22c2933ad49b68a6df297f06b93c0ebd9fc4869c82474271328609997209794b9d7169f541ff7f397764f1848dbe8b1eb27d68a3a590b10cff","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0fa8490615d700a0be2176fdc5ec6dbd","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"a9a31555bbc92b6033975c5428fb3679","SHA1":"47f4b9898631773231b32844ec0d49990ac4eb1e","SHA256":"c826846e4b1d73edb7561ab1b41c949354e237a91e82fe1be5b7e2e1701f52d1","SHA384":"86f49574f368a561914a52d7ae043ec6784ef8c718960700f834e123594605d25d39f1ad45f1eb5052c9567f3edd0e16"}},{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1","ValidFrom":"2025-05-07 00:00:00","ValidTo":"2038-01-14 23:59:59","Signature":"17cefb16801cfe073d11767130bdbe0bc8b534a67fcdd087c5881a307f4fc39b5c0673f0e8ee854c6369a15d95e30cd2506bc8f4d0336a8424f7b7eb3c1b488fe64bcdda7ec9776138fe21085013b8d4fe45e38f2b498279f486fad5ea1a9619ddeb2c052deaf272f653033e34cbc4b8177fdaf99d6310c2bf0cc9bf6b115282847c9fa7379ee641f417c1c004182bd1476a8ab67b6e8c1ef558f6008303f258b2aee919da203fc1d1b6b61f72d48b00d1017c7535eabdc9d39a97de421df9939cce08f99236ad541f8d7400d564a38dfe09d9aee32f358636a357f83174490cc7534a538b8741c29f67102f0402aa315baab5eebd33d27a038ecebe045a3ecfb6ca481c195d344d8af62ebdedcbda888a36a7ad44776a7cc4c25bf36628b27d33e32db9c546c8ec620dfd3a557c722a43a2aefea8d363a85cde1b1732b4be534cb2f865aa0176a6e13a16776510d4a613ef49198c4e18b4bf0f6f3834735ba0319c9965dfc17472e246eee101613a6d3126e17611900e9397829214b164e377ac6947aa1a41ffc325b837b3a2822cf02567ae91cc883db02f8d269b9dfefe3eed15ac58288a8bd10e2cb1df311d99c89ffec610b1f721dbc6d9794cf6aed63ff53080e930fc742dc9137ad892b84b50bcbb0dcf741ba7bc065aa6c888e5829dbe56ab12f7fc100fbc85ca5233d2c7266cabc5a16da336b6ccd690f64fb9b75c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0dc7ac5705ff21992e4043220c3a4986","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"990a87f0e1e5b323586a53ec0b83e185","SHA1":"5a25a994c8bfec9d87bb51c8e95601a8d90128b3","SHA256":"4317b0691fe76888cd815564d3acca8131a07916b3b1699d6b86ef8fe462ecbc","SHA384":"1782127b3adf3dc43a13e9e0f8236d9e044d82d27442fc315cc7b0cacc26eadb2263f9405a5a4ca388010d9684d52ce6"}},{"Subject":"C=US, O=DigiCert, Inc., CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1","ValidFrom":"2025-06-04 00:00:00","ValidTo":"2036-09-03 23:59:59","Signature":"652aadf11c2704b9ae6041ecd108449e63407221f8e4f6224fdb358ba50ab56f85111a7c1605d1190fd801abd7cd68d9858fa121f3f6264437f14fb0b493c15416a361fadb2181be0ee8b82383c2bc7a50b8fa8582aa753f30bf6515f8a6f3ff722666527b617c010fd474a14eb63ed83139aa3cef66cec920882dd060850fd92dc742f1c6d450eef9652a5b875a22a4e85c513f250fc400181f6572d6534ce24cde91df281004731405a0796ddacf6c5e8c458b34de1e286c4327c58397f1505129ed6e367cd055378b9e2da71e45ff42abd79cd6fe6240c5931506b4c4da88b47dc23c54c6eda1102669ab253577421b5fa5aaf3f815bad0e88c120579196a01cb84553d1c2ac6fecc9344b2e101eceeff72ebd341ab2733d01670841f5639f3aefc22099f39104f0b524a918684b7639d0e1e0698ed3fe5c1de9402b6fe04e540920da83afa25fc326075d277e574f17d4950fbc1e082df25d98bfbae86a770920571ba2305cc6545c186d0b221a7a1af45e40680c818c506d5d52dc2ad6a99cc1b7547dc4980a7f8ec277155177f9dd525434e68c58cb6cd159516317b99caf80b7e0c8f7a1c09571c02f94a57d8c49ecb6b9e22ef531c55644feba6d6fb21113696c90a3c82606da3f9b769c68ff50b2e2e3dc53701654f1ab6e7e4f84305fdc5ae882ecf3864fbe6a68beaf742bc796c86d8dd3573822148ec6ab7cd67","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0a80ef184b8df10582d1c476a7957468","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"13f832dcc4b08c81688914620a2c5fb8","SHA1":"db28225c0e4167ab46fbec07fcef80218c99f3b8","SHA256":"3f8efb078071d23c7ba61a6d8f327ef488e480dab977195d0086f36fbd62bc06","SHA384":"ce18006ef73af21572722aba82740af47af00b39a02a4d394d2c4e8442a91c40536585f28469ecf2b1a21f66751e1fcc"}}],"Signer":[{"SerialNumber":"0cb0fe4cb4a08e8f1dcc4382cdc67331","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Code Signing CA,1","Version":1}]}],"Signature":["Antiy Labs"],"Publisher":"Antiy Labs"}]}