{"Id":"a254e684-f6eb-40c4-a50a-7b76feb6cc02","Tags":["directio64.sys","utiA2D4.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":["CVE-2025-52347"],"Category":"vulnerable driver","Commands":{"Command":"","Description":"PassMark DirectIo64.sys builds through b1008 expose permissively accessible IOCTLs for physical memory, MSRs, PCI configuration space, x86 I/O ports, and kernel or physical-memory dumps. These primitives can support local SYSTEM elevation, kernel tampering, credential exposure, or denial of service. PassMark hardened the driver in b1012.","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c","https://github.com/floppywiggler/directio64-disclosure"],"Detection":[{"type":"","value":""}],"Acknowledgement":{"Handle":"floppywiggler","Person":"Emil Sorbroden"},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"0c357509adc3c4e42390c50a6a79575d","SHA1":"fca1ee04be5d7752a1ad717a6aac9c143c5c8bcd","SHA256":"e219276a4068b1eea5ce08f83a322845dce4eca89e05c71a0c2417065ce48813"},"Company":"","Copyright":"","CreationTimestamp":"2020-07-08 07:23:10","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["RtlInitUnicodeString","RtlQueryRegistryValues","MmGetSystemRoutineAddress","RtlWriteRegistryValue","RtlAppendUnicodeStringToString","RtlAppendUnicodeToString","DbgPrintEx","RtlGetVersion","KeInitializeEvent","KeWaitForSingleObject","ExAllocatePoolWithTag","ExAllocatePoolWithQuotaTag","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","IoAllocateErrorLogEntry","IoAllocateMdl","IoBuildDeviceIoControlRequest","IoBuildSynchronousFsdRequest","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoGetAttachedDeviceReference","IoGetDeviceObjectPointer","RtlIntegerToUnicodeString","IoGetDeviceProperty","ObReferenceObjectByHandle","ObReferenceObjectByPointer","ObfDereferenceObject","ZwCreateFile","ZwWriteFile","ZwClose","ZwOpenSection","ZwMapViewOfSection","ZwUnmapViewOfSection","ZwOpenKey","ZwQueryValueKey","MmGetPhysicalMemoryRanges","PsGetProcessId","KeStackAttachProcess","KeUnstackDetachProcess","IoEnumerateDeviceObjectList","ObQueryNameString","_vsnwprintf","ObReferenceObjectByName","__C_specific_handler","IoFileObjectType","PsProcessType","PsInitialSystemProcess","NtBuildNumber","IoDriverObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","KdSystemDebugControl","KdDebuggerEnabled","KeQueryActiveProcessors","KeBugCheckEx","IoWriteErrorLogEntry","wcsrchr","KeStallExecutionProcessor"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"","MD5":"afbb28a756e233d32e224a664763f79c","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"d450b7a57cccd5a3db68a7e806a19964","SHA1":"470f1d22cd3e654fab37a79b0333dd7303fdcb6a","SHA256":"b8aec1219a4d5f9701a7efa8c8211eacb4fc3b65cf29f9361c8c9d578b26f712"},"SHA1":"e44297a2b750ec1958bef265e2f1ae6fa4323b28","SHA256":"d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5","Sections":{".text":{"Entropy":6.071965718233516,"Virtual Size":"0x3c5a"},".rdata":{"Entropy":4.1509658726216285,"Virtual Size":"0x83c"},".data":{"Entropy":3.1174924611847556,"Virtual Size":"0x18"},".pdata":{"Entropy":3.930519001098817,"Virtual Size":"0x1a4"},"PAGE":{"Entropy":5.139743175424712,"Virtual Size":"0xb8"},"INIT":{"Entropy":5.280434802516445,"Virtual Size":"0x8e8"},".reloc":{"Entropy":2.7678941476196224,"Virtual Size":"0x18"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"??=AU, ??=Private Organization, serialNumber=099 321 392, C=AU, ST=New South Wales, L=Surry Hills, O=PassMark Software Pty Ltd, CN=PassMark Software Pty Ltd","ValidFrom":"2018-10-18 00:00:00","ValidTo":"2021-02-28 12:00:00","Signature":"5c01ed6a6f6c302d1b2ff3c17bae241ce2fcd501196d753b285ea9d44ba291565fc97503fa50ba4b0abba54066e1b04ac66018e8eb06c8104515df0b903f432e04c1d486336929a4d637fe7e06197a75ad7199bfae0a3a66ea6e55cf1ba9b68e33ef35f5b46cef71f5c8b6230d459c2e843a09b01ebe5020852ac9948357f09a66ad78bc60d795fce62fb63288f5550bc6446acbe7fdad31f8dd76045d7ed50bb79dc6ee9333ad8c12b64e2e544f922dfea0586b0d1cb80c37f96fc68b20f95b104f11ef5fe49349829afe35ceecfd22c96b5f89263701f95364d4f0816bcd0bee9e40aa1b956cd4659181e05d0872f4838b3208138b67d9c03faad605f1b924","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0d671c2c3c13676231329afa97b1ec2b","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"fd290a4891edd36420e082391a96d9b0","SHA1":"fe33d6386cb017f4d39d5b1e21861bbc387aae7a","SHA256":"57e2af9bbd6fed434ad5df9b194936fc6d3a1b71658bdd31c2d289f8a0f5c2e0","SHA384":"feff93a9900bd0c3ac0d46892b5c06dc002eb55bc2daa6c4d62d20491c9f5141771c7563166751af02b2308059449e52"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","ValidFrom":"2012-04-18 12:00:00","ValidTo":"2027-04-18 12:00:00","Signature":"19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"03f1b4e15f3a82f1149678b3d7d8475c","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"83f5de89f641d0fbf60248e10a7b9534","SHA1":"382a73a059a08698d6eb98c87e1b36fc750933a4","SHA256":"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf","SHA384":"4a25018683cabfb8ec2cad136334f37f33c89aa8540326322991d997c8adfb7faf06ab602ebd46630fe75fe3d2edc6b1"}}],"Signer":[{"SerialNumber":"0d671c2c3c13676231329afa97b1ec2b","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)","Version":1}]}],"Imphash":"cef6a450f196b28e634aa3c0655d8eda","LoadsDespiteHVCI":"FALSE"},{"Filename":"DirectIo64.sys","MD5":"db6d09b6ea72411f715f3effe1b42ca7","SHA1":"8e71859907ea3c2198a0b32a9b6c7b69feb8879a","SHA256":"b147a26dad59d9109710798b033ec3504a799f02e4356a358d6e32fdf7841b4a","Imphash":"e8957f92fb9f2c1b4e23f2ae68c84a43","Authentihash":{"MD5":"3d44547dd930c1f0451574129dc05f39","SHA1":"b5674bde7cb1c49a23d6c937b80a1b1478e24bc2","SHA256":"ed4e21364c3b077d5f5b53ff53db009ca735ad2b66b21559d25ef2c6689dfd1b"},"RichPEHeaderHash":{"MD5":"d845897ea399fa2048545f479aaf5eb5","SHA1":"44e7881e54893cf9122792e718f19216864b0218","SHA256":"4e9d63bd0805bfa5d878545d6456634be96466e1653c06bca576540b2d095c2f"},"Sections":{".text":{"Entropy":6.321782688271367,"Virtual Size":"0x4e5a"},".rdata":{"Entropy":4.078497548099905,"Virtual Size":"0x9e8"},".data":{"Entropy":0.9170036374986784,"Virtual Size":"0x88"},".pdata":{"Entropy":3.9540732697774166,"Virtual Size":"0x1f8"},"PAGE":{"Entropy":5.154715390110382,"Virtual Size":"0xb8"},"INIT":{"Entropy":5.270741772071132,"Virtual Size":"0x8fc"},".reloc":{"Entropy":3.586048612313037,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-04-14 22:17:54","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["MmGetSystemRoutineAddress","RtlWriteRegistryValue","RtlAppendUnicodeStringToString","RtlAppendUnicodeToString","DbgPrintEx","RtlGetVersion","KeInitializeEvent","KeWaitForSingleObject","ExAllocatePool2","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","MmMapIoSpace","MmUnmapIoSpace","IoAllocateErrorLogEntry","IoAllocateMdl","IoBuildDeviceIoControlRequest","IoBuildSynchronousFsdRequest","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IoGetAttachedDeviceReference","IoGetDeviceObjectPointer","IoWriteErrorLogEntry","IoGetDeviceProperty","RtlQueryRegistryValues","ObReferenceObjectByPointer","ObfDereferenceObject","ZwCreateFile","ZwWriteFile","ZwClose","ZwOpenSection","ZwMapViewOfSection","ZwUnmapViewOfSection","ZwOpenKey","ZwQueryValueKey","MmGetPhysicalMemoryRanges","PsGetProcessId","KeStackAttachProcess","KeUnstackDetachProcess","IoEnumerateDeviceObjectList","ObQueryNameString","_vsnwprintf","ObReferenceObjectByName","__C_specific_handler","IoFileObjectType","PsProcessType","PsInitialSystemProcess","NtBuildNumber","IoDriverObjectType","KeEnterCriticalRegion","KeLeaveCriticalRegion","KdSystemDebugControl","KdDebuggerEnabled","KeQueryActiveProcessors","KeBugCheckEx","RtlInitUnicodeString","RtlIntegerToUnicodeString","ObReferenceObjectByHandle","wcsrchr","KeStallExecutionProcessor","HalGetBusDataByOffset","HalSetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=GB, O=Sectigo Limited, CN=Sectigo Public Code Signing Root R46","ValidFrom":"2021-05-25 00:00:00","ValidTo":"2028-12-31 23:59:59","Signature":"12bfa1ef8b749a9844b86946b5ab240a0ca48a67b83a81bf458a7d5207a88d1f4e218539a36b5e2d2086bf10b8ae793b53cdb4fbd844be06d95c6367d44016874486722ad63215f51283c2f9e15d114067f6422772c523e202381a4c20e2db01f7cd464f26a27c66c05136b6890254c7fc58fb6c00eefe98a62e95a10c53291f6fd819a64f9ef7ac09ea5d82c68baf80a7bd8148528431da32ec15e4a64c3d6c3973d40b853920e0851a68e1a74838a9d1362577c18d1916c5884c667d2f63ce98e869dfac3ca85d9dc91c5baed8f32f74cfb87ef6d7839d1196629aae4513da7fdc47fbdfc3529fe60655e99d8cf23a6251bcec240f29d4588084e4457b5ad8","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"48fc93b46055948d36a7c98a89d69416","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"207045ce7b7ab131e78e459b13825902","SHA1":"bcf7530a1ab309fb1926cb720f9fd58cff1cb88f","SHA256":"0f31a4237992e1ea623baf4c29480afb6d913e10f1fb1d56bb56f5b03fbff13b","SHA384":"a229d2722bc6091d73b1d979b81088c977cb028a6f7cbf264bb81d5cc8f099f87d7c296e48bf09d7ebe275f5498661a4"}},{"Subject":"C=GB, O=Sectigo Limited, CN=Sectigo Public Code Signing CA EV R36","ValidFrom":"2021-03-22 00:00:00","ValidTo":"2036-03-21 23:59:59","Signature":"5f36acfbf9f6725a14b7f00b1dded8fd9701d2fd01ee992d86e8f6b7f039ffd6814a5aa7424a0a2d159de694fdc5694ab2d74bf116124cf6be9066658b2d74d4ab08f76a110308777cbe69e1b0db9f248903d6de5ca4e0b2d6b4cfe338d5b96dcc27d6ce6411e8107276d3f9e0e92c89e949d3b39796060ae1f60ac8419a915d81d8367798ca804197a8f8913f639faacd54544b80eaf51766d39471fd9efd4731e3e91a861dd3be20d23fb1525fb293bd8c950998728f9501f49843a54afb1426aa9d36bf72b0fcdcbd840deced34a85e952b3816630575d9f6312e156be294b22ad27435b5989aa3fef82b2fb6174b276c5ae6b9765eda86ddab64d66aea8318881b3182f588b39425c0212f086902e34cbb4c2a1130eb817906e141952ad420f60b93e47c760c9d1d266b5f8401f62a99cdafdec7f0e418a24e9b2f2a0c66a6927526bed94035136faea6371a7ae8ad1c5163072a56066ced7e18f6e3ec6473a66d08368baf0f99ae756b172bc24d6ac351464156e98fc28dff13719bdaed9ed39fabe545a612c5145a524197a3060008c5e61cea27823c3bdbe646c4ef2d003513cd367d9de5aa270805cccec0360e4b194fd0639a6dbfc529533122db75507786d0f2f86aee6b061b3e85232b97c87e7a99410cdd587f0ea8c3123d3a359be09d2c8c17815444a87a1d989d967f5958a65465ff51420bf847ebcff8e5bf","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"33d708a891405319e2a5bbd339b9ad6e","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b81404c775a2621debdb7825b87b8316","SHA1":"47ae94067c3c59b13605192288705db7b52f3685","SHA256":"9893b35b3dcefe53d8d24b887569dfe21f9aef27bd57b61c06fcf7438b89c33a","SHA384":"f55821c081b58e86eaa202923e715e1524c422c7be0469b13a9e7a319e50d70cb5b67e864273029a79250f9dc3203cbd"}},{"Subject":"serialNumber=49 099 321 392, JURISDICTION_OF_INCORPORATION_C=AU, BUSINESS_CATEGORY=Private Organization, C=AU, ST=New South Wales, O=PassMark Software Pty Ltd, CN=PassMark Software Pty Ltd","ValidFrom":"2024-01-18 00:00:00","ValidTo":"2027-01-17 23:59:59","Signature":"91b5f5ae708c4b61c5eb3b9010b2300f03d496eb38c55f040aa9c2b22c85e66154e3ca5dbb92e0ec189152962d85651207dd07dd548679778a6accb77ae422f1e8286ab60dd64f411f9f56d824127362018bab81e04139693e4931bf5615eeac4618e6f250f8df3bfe39f8e057fbdfabda4de937d8e38c4962f877c23edc279e21d8de70176c8af42f73eec79e68ba511829b5921d38db0286f188a106bd7f1f772a2a32f41e8b807e96099eab4ebe71e17ba4e9d3a5a92a6f6f0e0449394a9c9df7c001bdc1abf85b929a6698e84953b08c090fb8fff0931a95fc4b1ccac0aa8a210a718023e3c89fff46137a0ed215fe1cc4e0a7f2e62e425a2bec3254c3fbdaac3361dff600899daa665256442178b2da2bbdb78265b10663327160d942ffd7032a78050e1169324a00ae3c41b9d42c94747dc9091ef80d6d60613c7b3d9826ea01993b5a34c2107973ddb5fb996354746aa818ec38bac76096d21acb3b93cd1b4173c8af6841b424d158a89d1ed8151efa57ef9e9a55b7d4db22133b4ef5","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"00988b27911af5c9ac0ebc4e3f1240dacd","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"1cc8472a5a559acbaa138e76fb4c5a34","SHA1":"6efcab183c4940254949d80de54dd0552959c0c6","SHA256":"5e6768de69fd59e5aad00ecc900ad3922a803c29f272826af58965cc4483fe9b","SHA384":"54593b6d27a25050514007addceddab78658de1d94ef02f3085f0091ea813abdad3c60404feae59dd4231313f39f0a16"}}],"Signer":[{"SerialNumber":"00988b27911af5c9ac0ebc4e3f1240dacd","Issuer":"C=GB, O=Sectigo Limited, CN=Sectigo Public Code Signing CA EV R36","Version":1}]}]}]}