{"Id":"a0006589-a811-4341-9be0-4512eae9febb","Tags":["kgameprotect.sys"],"Verified":"TRUE","Author":"Shiroko","Created":"2026-09-11","MitreID":"T1562.001","Category":"vulnerable driver","Commands":{"Command":"","Description":"kgameprotect.sys exposes FILE_ANY_ACCESS IOCTL 0x222048 through \\\\.\\kgameprotect. The handler accepts a caller-selected PID and opens that process from KernelMode with PROCESS_TERMINATE before calling ZwTerminateProcess. It performs no caller, registered-client, or target-PID authorization on this IOCTL branch. The reviewed sample is version 2.7.1.7 and also registers a file-system minifilter, so correct minifilter installation is required. Static review confirms the process-termination path, but does not establish that unprivileged users can open the device or that protected processes can be terminated on every Windows configuration.","Usecase":"Terminate selected non-PPL processes to cause denial of service or impair security controls.","Privileges":"Administrator to load; potentially unprivileged to trigger if the applied device DACL permits opening the control device.","OperatingSystem":"Windows 10, Windows 11 (x64)"},"Resources":["https://github.com/magicsword-io/LOLDrivers/pull/428","https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/defining-i-o-control-codes","https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-iocreatedevice"],"Acknowledgement":{"Person":"Shiroko","Handle":"@ShirokoLEET"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"kgameprotect.sys","MD5":"cb1f1880aafd7d9bbdd70c54e56c9dd0","SHA1":"86f3b8e26e80db804086f095dd6bee79980d810c","SHA256":"6c1d596d18213e24f0c88d58ea7f3ca24114eded806b6198a8abc701251126ee","Imphash":"4de3dfcde82ad8ff50165c62d0501064","Authentihash":{"MD5":"1bbaf5dc91831f9138f4ad266a5841d9","SHA1":"9f7d0ad9493857ea85e2074688df4244399e6ca6","SHA256":"abe670579d00b0dbc2c1fc477d8d6e41f3af642e48d60dcf558a171a819137e6"},"CreationTimestamp":"2026-08-05 08:09:11","FileVersion":"2.7.1.7","ProductVersion":"2.7.1.7","MachineType":"AMD64","Imports":["FLTMGR.SYS","ntoskrnl.exe","HAL.dll"],"PDBPath":"E:\\yj_projects\\source\\driver\\kgameprotect\\x64\\Release\\kgameprotect.pdb","RichPEHeaderHash":{"MD5":"10376546a9e0a09ab2034be953550d49","SHA1":"4bf3467373b989c03affd8c57c9ee4247b386398","SHA256":"643b0992e5f0f210689676e8dbcb32d00e1ab6e8567af1e0ad894bb8a1c2da17"},"Sections":{".text":{"Entropy":6.400618523831932,"Virtual Size":"0x8dff"},".rdata":{"Entropy":4.252926296824099,"Virtual Size":"0x12f0"},".data":{"Entropy":0.415364464397433,"Virtual Size":"0x5e0"},".pdata":{"Entropy":4.351474855253208,"Virtual Size":"0x444"},"INIT":{"Entropy":5.165816743787488,"Virtual Size":"0xce0"},".rsrc":{"Entropy":2.933848804381235,"Virtual Size":"0x1a0"},".reloc":{"Entropy":3.867492461184756,"Virtual Size":"0x30"}},"MagicHeader":"50 45 0 0","Description":"","Company":"","InternalName":"","OriginalFilename":"","Product":"","Copyright":"","ExportedFunctions":"","ImportedFunctions":["FltRegisterFilter","FltUnregisterFilter","FltStartFiltering","FltGetFileNameInformation","FltReleaseFileNameInformation","FltParseFileNameInformation","FltCreateFile","FltGetRequestorProcess","KeGetCurrentIrql","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","ExAllocatePool2","ExFreePoolWithTag","ZwQueryInformationFile","ZwReadFile","ZwClose","MmIsAddressValid","PsGetProcessId","RtlUnicodeStringToCountedOemString","RtlDowncaseUnicodeString","RtlFreeOemString","PsGetProcessImageFileName","RtlInitUnicodeString","RtlUnicodeStringToAnsiString","RtlFreeAnsiString","DbgPrint","KeInitializeSpinLock","KeBugCheckEx","KdDisableDebugger","MmMapLockedPagesSpecifyCache","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","KdDebuggerNotPresent","wcsncpy","_wcsnicmp","MmGetSystemRoutineAddress","RtlCompareUnicodeString","RtlEqualUnicodeString","RtlCopyUnicodeString","RtlAppendUnicodeToString","KeInitializeDpc","KeDelayExecutionThread","KeEnterCriticalRegion","KeLeaveCriticalRegion","KeInitializeTimer","KeCancelTimer","KeSetTimerEx","ExQueryDepthSList","ExpInterlockedPopEntrySList","ExpInterlockedPushEntrySList","RtlFreeUnicodeString","ExInitializeResourceLite","ExAcquireResourceSharedLite","ExAcquireResourceExclusiveLite","ExReleaseResourceLite","ExDeleteResourceLite","MmProbeAndLockPages","MmUnlockPages","PsCreateSystemThread","IoAllocateMdl","IoFreeMdl","ObReferenceObjectByHandle","ObfDereferenceObject","ZwOpenKey","ZwQueryValueKey","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","RtlCompareString","PsGetProcessExitStatus","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwOpenDirectoryObject","_vsnwprintf","ZwQueryInformationProcess","__C_specific_handler","PsThreadType","wcsstr","InitializeSListHead","PsTerminateSystemThread","IoGetCurrentProcess","ObfReferenceObject","ObRegisterCallbacks","ObUnRegisterCallbacks","PsSetCreateProcessNotifyRoutineEx","PsSetCreateThreadNotifyRoutine","PsRemoveCreateThreadNotifyRoutine","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","PsGetCurrentProcessId","PsLookupThreadByThreadId","IoThreadToProcess","PsProcessType","ZwTerminateProcess","SeLocateProcessImageName","KeSetEvent","ExEventObjectType","strrchr","HalReturnToFirmware"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2026-05-13 18:17:34","ValidTo":"2027-05-11 18:17:34","Signature":"93cc2199d0389421a76807d521fdadd3ebc78db57beeabbfe80fef4ceca91861d30b11e74b6cc50b2d3082224b1c0d03c25153db795b52597215c29e7a85d8642fd16b1271d0c6766643583909ca9d6bc0f65ab21a3f82eb72a9f21ed72d229d960aa4b9995784837073fe28463c4d7ed553734eea8664c79f76d81dd2777d747d172182f62260b778ec9b0efacfbff430be868acff311f1f0700d547a3ccc37ecce1776332c3b679ac4c2e4ec2183144084886165856aff226ba6bff25b31757362be5a8687435c4c70e61d3fd33551a2315197238d76174943e4c2bfe2ac9198ee8116072aeb79a2f90f463d5e35f367c41604a2984d8e9da549c6f472be1aac6659574afa3cc12a5d4768faf08a945952b9b23dcff0e8d131c07366d18a95b04b12f454fb2dbea85f616e050e487c909a4d1cda95172dcc304306b699768375d0f3e1caf5f03db1975f6b7aa6e77588176027fb2d0b9b56b93249d19cca92528a4eedd85054f2b6f4f266f7b81b50510f4b58c3b2e733cb6999567fdf6b8c41e7667c899b4098b3b9cb18dde8e0a4a0a41aa83c27ca107f4440c6650ce21ea4ced7d43c72ab560240a0d0a2c68a24194c847eeaeb4c9b49bd5a69510b24c95c369604b0a3e241ef95389066b6cf139340d91b46b798615eb051d1adad8f9a2cad2cab64db5b9177ecc9aa0737c87f20084bd38e626195c13005cb185fb357","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000849686aedfb4b66376000000000084","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"9fe699b3ab2f27e4f2aa6fcaca729d23","SHA1":"be806effbdd84c713d2286ad1d79e5601c0a9b07","SHA256":"04894d613d22d6af2d76b7f319073c187bee05eee27fd167a050076fb2009d45","SHA384":"fa1eb815b52f12434ab15fef34ae98bf077130fb31f022b93f999863606c7d1acc77ee05b6df2e7808487562bccbae8b"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"33000000849686aedfb4b66376000000000084","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Signature":["Microsoft Windows Hardware Compatibility Publisher"]}]}