{"Id":"7789e9ca-8508-486b-9d77-7497c5c61474","Tags":["PSKD64.SYS"],"Verified":"TRUE","Author":"Venexy","Created":"2026-08-29","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create PSKD64 binPath= C:\\windows\\temp\\PSKD64.SYS type= kernel && sc.exe start PSKD64","Description":"APSoft PCIScope's PSKD64 driver exposes memory-access operations through \\\\.\\PSKD64. IOCTL 0x220044 dispatches sub-operations 0x701E and 0x701F for caller-selected virtual or physical memory reads and writes without constraining the target address. Public testing demonstrates arbitrary kernel read/write on Windows 11, including process protection removal and security-process termination.","Usecase":"Read or write arbitrary kernel memory to disable security controls or elevate privileges.","Privileges":"Administrator","OperatingSystem":"Windows 10, Windows 11"},"Resources":["https://www.tssc.de/site/products/tools/pciscope","https://www.tssc.de/site/download/prods/pciscope.exe","https://github.com/magicsword-io/LOLDrivers/issues/408"],"Detection":[],"Acknowledgement":{"Person":"Venexy, Dark Monkey","Handle":"@M4xSec, @v8k6b2jjps-prog"},"KnownVulnerableSamples":[{"Filename":"PSKD64.SYS","MD5":"741daa162541343e15f0448487ca52c5","SHA1":"9bd89c27aa2b230feea1171798bfc0e24652444a","SHA256":"34cdbf48f5a51ca9553c14f007aaa1b67c24e1334d8cb29e80f07c80c5dc07e7","Imphash":"cec72858409b9ae0decb0b0cd9111791","Authentihash":{"MD5":"2eb18722d74040a5f2713f958b1fc2b1","SHA1":"5f0369a2f3f9ffc931ef1a982e5685a8ade50add","SHA256":"d53d5e1311f42580e5cbc675f6435753dd5869418ff47451a0b372f841662534"},"RichPEHeaderHash":{"MD5":"8ae9f4d712397e916ae0c458857cec66","SHA1":"a181cf1e611219c7cd1fda172f8ab4431c26657b","SHA256":"78241920372366f18eb945a9b022d046b0dcd29f91a9ebfb12f41f6749ee845b"},"Sections":{".text":{"Entropy":6.253019517999342,"Virtual Size":"0x3db35"},"DebugDat":{"Entropy":5.1421711325738,"Virtual Size":"0x70"},".rdata":{"Entropy":4.890149006770144,"Virtual Size":"0x67ac"},".data":{"Entropy":3.502049332136162,"Virtual Size":"0xf9e8"},".pdata":{"Entropy":5.480100463541544,"Virtual Size":"0x36c0"},"DebugCod":{"Entropy":4.447928859423906,"Virtual Size":"0x11400"},"PAGE":{"Entropy":5.981720914796221,"Virtual Size":"0x4eb"},".edata":{"Entropy":4.107634193044584,"Virtual Size":"0x4e"},"INIT":{"Entropy":6.163420182524112,"Virtual Size":"0x16d2"},"INITDATA":{"Entropy":0,"Virtual Size":"0x8"},".rsrc":{"Entropy":4.373360839613024,"Virtual Size":"0x718"},".reloc":{"Entropy":4.735408620756494,"Virtual Size":"0x2af0"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-03-08 09:06:34","Description":"PCI Diagnostic Driver","Company":"APSoft","InternalName":"PSKD64.SYS","OriginalFilename":"PSKD64.SYS","FileVersion":"4.00.032","Product":"PCIScope","ProductVersion":"4.00.032","Copyright":"Copyright © APSoft, 2000 - 2026.\nAll rights reserved.\nDisassembly or decompilation prohibited.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":["_except_handler3"],"ImportedFunctions":["MmProbeAndLockPages","MmUnlockPages","IoAllocateMdl","sprintf","ExFreePoolWithTag","ExQueryPoolBlockSize","ObfDereferenceObject","strchr","strstr","strncpy","IoDeleteDevice","IoCreateDevice","MmIsAddressValid","KeReleaseSpinLock","KeAcquireSpinLockRaiseToDpc","RtlInitUnicodeString","ZwQuerySystemInformation","ExAllocatePool","_strnicmp","IoGetDeviceObjectPointer","_stricmp","KeRemoveQueueDpc","ZwClose","KeReadStateTimer","KeCancelTimer","ExAllocatePoolWithTag","ExSystemTimeToLocalTime","RtlTimeToTimeFields","KeNumberProcessors","KeReleaseSpinLockFromDpcLevel","KeAcquireSpinLockAtDpcLevel","RtlQueryRegistryValues","RtlFreeUnicodeString","KeBugCheckEx","IoFreeMdl","KeDelayExecutionThread","KeQueryTimeIncrement","MmGetSystemRoutineAddress","PsGetVersion","ZwOpenKey","ExAcquireResourceExclusiveLite","IoCreateNotificationEvent","KeLeaveCriticalRegion","ZwOpenDirectoryObject","KeEnterCriticalRegion","ZwCreateFile","ExReleaseResourceLite","ObReferenceObjectByHandle","RtlCompareUnicodeString","RtlUpcaseUnicodeChar","PsCreateSystemThread","ExInterlockedInsertHeadList","ExInterlockedInsertTailList","PsTerminateSystemThread","KeWaitForSingleObject","ExInterlockedRemoveHeadList","KeSetEvent","KeInitializeEvent","IoFreeIrp","IoAllocateIrp","ZwQueryKey","RtlUnicodeToMultiByteN","RtlMultiByteToUnicodeN","strrchr","toupper","isdigit","IoBuildDeviceIoControlRequest","strncmp","IofCallDriver","IoAdapterObjectType","IoFileObjectType","IoDriverObjectType","ExDesktopObjectType","ExEventObjectType","ExFreePool","IoDeleteSymbolicLink","ZwQueryValueKey","IofCompleteRequest","IoCreateSymbolicLink","_strupr","RtlAnsiStringToUnicodeString","RtlInitAnsiString","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","KeInitializeDpc","KeSetTimerEx","KeInitializeTimerEx","KeWaitForMultipleObjects","IoCreateSynchronizationEvent","KeInitializeSemaphore","KeReleaseSemaphore","KeReadStateSemaphore","IoAssignResources","KeClearEvent","KeResetEvent","KeReadStateEvent","IoGetCurrentProcess","PsGetCurrentProcessId","ZwSetInformationThread","KeInitializeMutex","KeReleaseMutex","IoQueryDeviceDescription","DbgPrint","PoCallDriver","_strlwr","ZwEnumerateKey","IoWriteErrorLogEntry","IoAllocateErrorLogEntry","KeSetPriorityThread","ZwSetInformationFile","ZwQueryInformationFile","ZwWriteFile","MmMapIoSpace","IoDeviceObjectType","MmUnmapIoSpace","__C_specific_handler","HalSetBusDataByOffset","HalTranslateBusAddress","HalGetBusDataByOffset","KeQueryPerformanceCounter","KeStallExecutionProcessor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA ECC R2","ValidFrom":"2019-03-07 19:37:45","ValidTo":"2034-03-03 19:37:45","Signature":"306402304a5bea809fba3692cf8c31edeca599ee3227bcc317eb878f57503005bf7595f73cf93f1952833420e11156ee393eb7ee023002b5b8d9f8781247c1c045ff15f6a066bb43e24f430e587797a4a2553424845a5619cfa655201bd9109a5300fb895e70","SignatureAlgorithmOID":"1.2.840.10045.4.3.3","IsCertificateAuthority":true,"SerialNumber":"6edd4f25e7317d3981573134cfc1dca0","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"611350a193d046e140ef1a4f952e12d3","SHA1":"280bd286608fe3a3ea55209039b1d720cebb09a2","SHA256":"479f4114f068a455c4f9e6ec28b2f0161681613f155ad5a87b464693e33bdb24","SHA384":"68c2c4a03fb1c1ab754ab4e5413d224028c097a17b0380b290da95852ff61c26fd8d3177708f91f0afe21dae30ae32ab"}},{"Subject":"C=DE, ST=Bavaria, L=Reichertsheim, O=APSoft e. K., serialNumber=HRA 12182, CN=APSoft e. K., BUSINESS_CATEGORY=Private Organization, JURISDICTION_OF_INCORPORATION_L=Traunstein, JURISDICTION_OF_INCORPORATION_SP=Bavaria, JURISDICTION_OF_INCORPORATION_C=DE","ValidFrom":"2025-12-10 14:39:27","ValidTo":"2028-12-09 14:39:27","Signature":"3066023100b00f2974c6fd6a9a87fced1620c5466a3119de9cc9d69f7630098f96421c48b8036b09a870753957ff1436d3ed1b9342023100afc36374380a77714670418d03051fc6e63498ff0ad5a1b8c6ade4e1cc4d5b4e748fbe64d31a72d0c24342458cf749d6","SignatureAlgorithmOID":"1.2.840.10045.4.3.3","IsCertificateAuthority":false,"SerialNumber":"571ae028012f6b3e40d4cdcab8e3fe3e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"9ce4617540fe261e78f2c937223df698","SHA1":"45a264b93bf8ab2ef734b4ddbbe296f2d6269709","SHA256":"d919e1e5979dc5e27d3e98ebda4f8e28a834f924479ad0ba2a03aa163402c9a3","SHA384":"2f4db590d1f92e6bdecafebfbcdec713205d09d15f5b00d91c8ddf09bf6289f4b364285a438993915b153476e6d2db33"}}],"Signer":[{"SerialNumber":"571ae028012f6b3e40d4cdcab8e3fe3e","Issuer":"C=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA ECC R2","Version":1}]}]}]}