{"Id":"7f52f435-d217-4c13-98a4-4fdc6c8516c8","Tags":["FoxKeDriver64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-04-17","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create FoxKeDriver64 binPath=C:\\windows\\temp\\FoxKeDriver64.sys type=kernel && sc.exe start FoxKeDriver64","Description":"FoxKeDriver64.sys is a vulnerable Foxconn kernel driver that exposes a \\\\.\\Fox_FOXONE_Driver device. Public research documents IOCTL 0x2220C0 for translating a caller-supplied virtual address to a physical address, which can support local privilege escalation chains with other vulnerable drivers.","Usecase":"Translate virtual addresses to physical addresses","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/325","https://github.com/magicsword-io/LOLDrivers/issues/370","https://github.com/KeServiceDescriptorTable/vulnerable-drivers","https://github.com/Haider303/sliff-driv-exploit","https://medium.com/@haider303mustafa/applockerflter-sliffdriver-sys-full-kernel-exploit-chain-from-driver-recon-to-system-shell-b57d87738308"],"Detection":[],"Acknowledgement":{"Person":"","Handle":"@rainbowdynamix, @DbgPrint, @Haider303"},"KnownVulnerableSamples":[{"Filename":"FoxKeDriver64.sys","MD5":"0215d56bfbc9a947b095aff1c31b53ad","SHA1":"ec06cb3a837d710f60ed8800c3be650317cb25ae","SHA256":"eb81e127e7a46c80acdf8a3fc24a350381f24acb06f0fdf9fdcd34ce9b08d084","Signature":"","Date":"","Publisher":"","Company":"Foxconn (R) Corporation","Description":"Foxconn Kernel Driver(64bit)","Product":"Foxconn (R) Kernel Driver(64bit)","ProductVersion":"1.00.01.03","FileVersion":"1.00.01.03 built by: WinDDK","MachineType":"AMD64","OriginalFilename":"FoxKeDriver64.sys","Authentihash":{"MD5":"94dfc62c6570ac1195409f847c2c007c","SHA1":"592cf6cffeda7559af60a5ab8939cdaf24085197","SHA256":"0c0e58989b97e30979bb3e2800b74c546ce6576b2bc7766a4b92e7e89086766a"},"RichPEHeaderHash":{"MD5":"ca207de4ea18a5fc50b798e589784c8c","SHA1":"f123d55dfa1c11cadf339da1979a2e3a33e98162","SHA256":"04f4a00d8f68085582dad6144206c6b8414a714d6c1fa4902d09a2957ccbcc61"},"Sections":{".text":{"Entropy":6.385317343181263,"Virtual Size":"0x27a9"},".rdata":{"Entropy":4.480957017813716,"Virtual Size":"0x1fc"},".data":{"Entropy":0.36295903867410606,"Virtual Size":"0x19c"},".pdata":{"Entropy":3.5771610123595834,"Virtual Size":"0xb4"},"INIT":{"Entropy":4.9247366508248644,"Virtual Size":"0x358"},".rsrc":{"Entropy":3.349767188410247,"Virtual Size":"0x410"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2008-06-16 20:50:05","InternalName":"FoxKeDriver64.sys","Copyright":"Copyright (c) Foxconn Corporation. All rights reserved.","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["KeSetTimer","KeCancelTimer","DbgPrint","ExAllocatePoolWithTag","IoDeleteSymbolicLink","ExFreePoolWithTag","RtlAnsiStringToUnicodeString","RtlInitUnicodeString","IoDeleteDevice","KeWaitForSingleObject","KeInitializeTimer","RtlFreeUnicodeString","MmGetPhysicalAddress","IofCompleteRequest","RtlCompareMemory","IoCreateSymbolicLink","IoCreateDevice","KeBugCheckEx","MmMapIoSpace","RtlInitString","MmUnmapIoSpace","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=CN, O=HongFuTai Precision Electrons (YanTai) Co. Ltd, CN=HongFuTai Precision Electrons (YanTai) Co. Ltd, emailAddress=Heckle.gj.wang@foxconn.com","ValidFrom":"2006-10-26 09:23:47","ValidTo":"2009-10-26 09:23:47","Signature":"2cffaaeb7d8c6fda6dbd9bc5dca3b04778c1da8935deb01dd3882abbf90d0cfb3cf161218418421160a22aab181ffd5e767a225b7a2301c92ebebdedb987391c7d215cbe10fd4660558dd92579d014e6341db2ed394a6e8ebae0c22c24add83e98bb638f4749edcdcb9648e1d73a6cf75970779e969836b2a4a041b19b62735b35690d4853d77696bb0fa4c38b3ba60168b747f9cedc0a838cb98834bca135003d3849b551c3b5cd3dca14528ae769bfaa55982a941ae1c50c8b684908cc61126de24fa77fe2e268429e0528ed119617f9607eb58870595a9e9095a0bd55439b33af55ddcb70b9f692089b63d71022bb9d10b2689236b1ebfd0364000ee1bc37","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"0100000000010e83eeafba","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"aa780023868523da08efa69a411e18cf","SHA1":"04bc93ca5e21bd631d644abdd8452e8cb2eaf860","SHA256":"cef791220cf3d8fc86ab667e35712ff209cef155ef8e31782549ab2a6110a159","SHA384":"fc799dc0c51776de363a944404d52b95a201fed776c25dbaaba20e3873bf9d8b997dca49c36db57c5f6f07df73e2da5b"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Primary Object Publishing CA, CN=GlobalSign Primary Object Publishing CA","ValidFrom":"1999-01-28 12:00:00","ValidTo":"2014-01-27 11:00:00","Signature":"a0422eb876a7427186404d464d5b26b0b074f93f89a87b7cb7f1c697e08239999d43fe60823642b55b878df55df4bbffa91044a871d3c7f12241f29aa4a5ec63fae5eb654a19309d8bc7b6fddc3fe16cfdd5521407fc6d24ccb3cc81a2c052f327b96d9e063dd8a849023269c7054294d0bbe3bba908c393501bdb846dc0ba1e5298659c1376bdb3d567292f1f7baa2c51a0fd854f263c48a38127a6feee7f7899c245cf9d1f527ed7958bfde1d020c3af7e51a22f663bab2dcf2d8e8c4d7d18392128fbdcae6d6581d0e0d7184be7b5f774d784e6522aac3b68fd3b4ab80154849132bb95d28e6330a69ece2396feab2eb86a8b74dcde21a114c2fbbf53af10","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9611cd6","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"698f075151097d84c0b1f3e7bc3d6fca","SHA1":"041750993d7c9e063f02dfe74699598640911aab","SHA256":"a8622cca0913a20477be8313b8d16fcad5d83088b46b36ddac10b31e96abb5e8","SHA384":"a50291d3b15caf28d96e972cefcb88455a58ce1c802920fdcc2f4feafb1553510fd9b464d25e81635f4ad37570225a67"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","ValidFrom":"2004-01-22 09:00:00","ValidTo":"2014-01-27 10:00:00","Signature":"11d45d8af43d0d9d7e4fa70071610b56b34caa70e1b2d1dec7886d1d897c2ba946e58b1f8e4cc26695911fe34d394ae31b70b7446edc068a4d6d25e89812dcbca0dd864eae8f81130540905a542529944acaf165b4ef0679dae7cb86f004c918dcee72b320015748dfe333e12ccd9c077f9447278d888d340ca67c5c20c17d07b3736b648c26d29bd7e87965a6a891a174862a050282c1847cf279cd3c2a2b0f99291eea8c8a1ab16aeaa266380e65e1add8c6c91f888d3976ee1782c4138d97ce6341e77af5b4b66c15c33813b3930b620688dde1447f10a950248b60dc05f75ba514b27b56720b96eabffc057090659e051ca4dd07af4b57dec639673bc574","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"04000000000108d9612448","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"2fc76031fc24eec1ef3db2d246d21d6a","SHA1":"75c3a1f76b9dfa31ef6bf56325e7bd0bf6e4779d","SHA256":"9238292d441c56dc89684c253343c17de3ed9cecd7f83d1d8f793b5ebc91f7b9","SHA384":"9279c1377eb701fdd79ef85038ff151cd8902169ba55fca84b9850f003563f73a1daaf869544252a2e42f06f58d2275f"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2006-05-23 17:00:51","ValidTo":"2016-05-23 17:10:51","Signature":"13c56c5e077f3c57ff9b315f3fbd955425c679f92c31034d64694b56d95b976f7cf3f0d024657538639813701613f7a701f1c623e085866c0bf080945a75e87ce41e92b473bfc1b3a7b00bd31884cbcc09a35c9c4f3eb03a9c2d1bc404ef9737966fe5ecbaac6ab3d4e23cdf8b25e7acbc624531dda40a72e41bf8784301ccba3914de5d90aed85acf5eca46815133d5a60e5867d3d8665888169beeb11acaad91138421da9a6e20efda007428bac95ff34d5dc3da25692554ea44bcc39b29331cd63c961f8781c553d72a2733d42e197c08586ddb4e1999a9ea5ff39a9d8c513a5a5cbd2fa908359b54a7db351a521633343aa380046afdb4838cad90cf0c3a6596ec334e1826b849bbeb8192ff134d324b23c733e7b6716b15f69c80e6bcb76cbe41d5033a7133150050743b0e5df996aaed903eab134c809926bc38a5eb0236891db620be83ab10f8199ed76379d4aeb12f6136f94a4ba833c70e7241f9f1b1907eae46efde397b75a0411459041d42bc4788b8130e05fa1df0808dff70c677d84bdc460e231a72d5bfdefeaaae69583cfc5c46e4d5819a8b6e6559771a32a590a6b6649364fd0753c9a0de28ad2a6cc638d181ce98f54019e92c1743a4265fd3443053e41d02baa40a2f16dd7a60275242bbad98372897e4b8d27911e3108c48d5305d0a0c52def588ea8d1a2d67c9f4801484b7850cd16628a5c66f2461","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"610b7f6b000000000019","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"4798d55be7663a75649cda4dedc686ef","SHA1":"0f1ab2937b245d9466ea6f9bf056a5942e3989cf","SHA256":"ef14ea05bb066ee9f4188196dd69cd769b283ac4d7555db52f5e76922d3456e1","SHA384":"6e7450a139856aeda6fa6284ff89b3752a9b646e096b4d33dd7e8e727742a2111481531581c0aa2cda0338e22cfdbad3"}}],"Signer":[{"SerialNumber":"0100000000010e83eeafba","Issuer":"C=BE, O=GlobalSign nv,sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA","Version":1}]}],"LoadsDespiteHVCI":"FALSE","Imphash":"7bc9165675650e353fceda2ace6ce93d"}]}