{"Id":"98b064c4-c9ff-4cac-a6b6-a24964b70923","Tags":["chinese_cheat_driver.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-04-17","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create chinese_cheat_driver binPath=C:\\windows\\temp\\chinese_cheat_driver.sys type=kernel && sc.exe start chinese_cheat_driver","Description":"chinese_cheat_driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode. Public exploit research documents IOCTL 0x222000 for arbitrary kernel virtual memory reads, IOCTL 0x222018 for physical memory reads, and IOCTL 0x22201C for physical memory writes, which can be chained for local privilege escalation from an administrator context to NT AUTHORITY\\SYSTEM.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/325","https://github.com/magicsword-io/LOLDrivers/issues/351","https://github.com/KeServiceDescriptorTable/vulnerable-drivers","https://github.com/Haider303/facebook-media-driver-exploit","https://medium.com/@haider303mustafa/exploiting-a-signed-vulnerable-kernel-driver-for-ring-0-privilege-escalation-678fe2054d6a"],"Detection":[],"Acknowledgement":{"Person":"","Handle":"@rainbowdynamix, @DbgPrint"},"KnownVulnerableSamples":[{"Filename":"chinese_cheat_driver.sys","MD5":"3ee985c5fd1f5784e15a4d11b3ca70a1","SHA1":"33148c93465908ddad71cf189e22091dc0058ac4","SHA256":"4f412f9aa89994cda45422d23d6d961809225de9a4f5a8bfbfb9ac0e8725917e","Signature":"","Date":"","Publisher":"","Company":"","Description":"","Product":"","ProductVersion":"","FileVersion":"","MachineType":"AMD64","OriginalFilename":"","Authentihash":{"MD5":"f6877a3e31a1d73e1856e3f4c359f244","SHA1":"7cf1b8c874055b230ad0706fcef8e4cb61ece130","SHA256":"50f22cdd309f5c3d77f39a27586cd26ccd04294879ea04da4c175a9cb7519284"},"RichPEHeaderHash":{"MD5":"e1269ee101378fb4838e04997a1115c6","SHA1":"2a2801723dbc1b99008fb3ce8737d08a6f1df7ba","SHA256":"192b9647e43222f59d11db9cb5e71cfcaf408e17ab34a857dc9a48ced94d290d"},"Sections":{".text":{"Entropy":6.256348097276721,"Virtual Size":"0x1cac"},".rdata":{"Entropy":3.997488487340562,"Virtual Size":"0x778"},".data":{"Entropy":0.14263576814887827,"Virtual Size":"0x10c0"},".pdata":{"Entropy":3.935319047724376,"Virtual Size":"0x18c"},"INIT":{"Entropy":4.7160970851082,"Virtual Size":"0x382"},".reloc":{"Entropy":3.3871247384594216,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-05-09 00:22:10","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","ExAllocatePool","ExFreePoolWithTag","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","ObfDereferenceObject","PsLookupProcessByProcessId","PsGetProcessSectionBaseAddress","ZwQuerySystemInformation","IoCreateDriver","ExAllocatePoolWithTag","MmUnmapIoSpace","MmMapIoSpaceEx","ZwClose","MmGetPhysicalMemoryRanges","MmCopyMemory","MmGetVirtualForPhysical","KeStackAttachProcess","KeUnstackDetachProcess","ObOpenObjectByPointer","ZwAllocateVirtualMemory","ZwQueryVirtualMemory","ZwQueryInformationProcess","ZwProtectVirtualMemory"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"LoadsDespiteHVCI":"TRUE","Imphash":"07386745331387b83012a6786eacb5ac"}]}