{"Id":"b1f406cd-117a-45bb-97db-3f9ecb44f70d","Tags":["sxav64-v1.5.1.sys","sxav.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-08-28","MitreID":"T1562.001","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create Sxav binPath= C:\\windows\\temp\\sxav64-v1.5.1.sys type= kernel start= system","Description":"The signed SXClient sxav.sys security driver processes an SXBOOTDB boot configuration whose integrity is protected only by an unkeyed MD5 digest. Public research demonstrates that an administrator can generate a valid configuration containing arbitrary absolute paths, point the service to it, and have the kernel driver delete those files during the next boot. The primitive can be abused to remove security-product files that are otherwise locked while Windows is running.","Usecase":"Delete protected antivirus or EDR files during system boot using an attacker-generated boot configuration.","Privileges":"kernel","OperatingSystem":"Windows 10, Windows 11"},"Resources":["https://github.com/wwwab123/Sxav_ZwDeleteFile_BYOVD"],"Detection":[],"Acknowledgement":{"Person":"wwwab","Handle":"@wwwab123"},"KnownVulnerableSamples":[{"Filename":"sxav64-v1.5.1.sys","SHA256":"4d47e7f1c87d758d9e3f17d0d53634c454ee1785478a8c7de7f3c83ecd3d3896","MD5":"29a53ceac3376e0928a898779adb4c5a","SHA1":"77488e805d266aa1968842b4698565bb4fd8c36c","Imphash":"044f125cfa7e2697826082f8d5501ccf","Authentihash":{"MD5":"82a5166a8b7710ea462b6b6b686ec5d6","SHA1":"6f5b769888b5989990478d34d16b120adf50e27c","SHA256":"9c246d9c611383dc1b32fda185322629aedc8527bd831ebfe41f5f92b1332070"},"RichPEHeaderHash":{"MD5":"7d12388578802e8f1f5eb4af8c23f5d0","SHA1":"ef8f667e744c231ffcd0efaa9d024451357e13ba","SHA256":"36cd35cb00b81a2ebd9cb7d5d84c5dc0e06a30c0f0662d990fb3fb442ed95117"},"Sections":{".text":{"Entropy":6.404075280062686,"Virtual Size":"0xafad"},".rdata":{"Entropy":4.7686252088929235,"Virtual Size":"0x1a90"},".data":{"Entropy":2.5508895067895754,"Virtual Size":"0xe40"},".pdata":{"Entropy":4.472811878008731,"Virtual Size":"0x570"},"INIT":{"Entropy":5.227893705577557,"Virtual Size":"0xe5a"},".rsrc":{"Entropy":3.631466010424983,"Virtual Size":"0x340"},".reloc":{"Entropy":4.837029625833363,"Virtual Size":"0x118"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-06-30 02:45:56","Description":"瞬犀安全防病毒软件","Company":"河南寒露电子科技有限公司","InternalName":"sxav.sys","OriginalFilename":"sxav.sys","FileVersion":"3.0.0.2","Product":"瞬犀安全","ProductVersion":"3.0.0.2","Copyright":"Copyright (C) 河南寒露电子科技有限公司. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll","FLTMGR.SYS"],"ExportedFunctions":"","ImportedFunctions":["ZwFlushBuffersFile","ExAcquireFastMutex","ExReleaseFastMutex","MmUnlockPages","IofCompleteRequest","IoFreeMdl","ProbeForRead","__C_specific_handler","ZwSetInformationFile","RtlWriteRegistryValue","RtlCreateRegistryKey","ExGetPreviousMode","MmAllocateContiguousMemory","MmFreeContiguousMemory","IoBuildDeviceIoControlRequest","IofCallDriver","IoGetTopLevelIrp","IoAllocateWorkItem","IoFreeWorkItem","IoQueueWorkItem","ObfDereferenceObject","PsGetCurrentProcessId","IoVolumeDeviceToDosName","_vsnwprintf","MmMapLockedPagesSpecifyCache","IoCsqInsertIrp","IoCsqRemoveNextIrp","KeAreApcsDisabled","ZwDeleteFile","MmProbeAndLockPages","IoAllocateMdl","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoGetCurrentProcess","IoRegisterShutdownNotification","IoUnregisterShutdownNotification","IoCsqInitialize","ZwOpenFile","PsSetCreateProcessNotifyRoutineEx","KeStackAttachProcess","KeUnstackDetachProcess","PsLookupProcessByProcessId","IoQueryFileDosDeviceName","PsReferenceProcessFilePointer","InitSafeBootMode","RtlFreeUnicodeString","RtlStringFromGUID","ExUuidCreate","ZwDeviceIoControlFile","RtlInitializeGenericTable","RtlInsertElementGenericTable","RtlDeleteElementGenericTable","RtlLookupElementGenericTable","RtlEnumerateGenericTable","KeBugCheckEx","ZwReadFile","ZwWriteFile","ZwClose","ZwQueryInformationFile","ZwCreateFile","IoGetBootDiskInformation","RtlQueryRegistryValues","RtlInitUnicodeString","_wcsnicmp","_wcsicmp","ZwWaitForSingleObject","PsTerminateSystemThread","PsCreateSystemThread","ExDeleteResourceLite","ExReleaseResourceLite","ExAcquireResourceExclusiveLite","ExInitializeResourceLite","ExFreePoolWithTag","ExAllocatePoolWithTag","KeWaitForSingleObject","KeLeaveCriticalRegion","KeEnterCriticalRegion","KeDelayExecutionThread","KeSetEvent","KeInitializeEvent","ProbeForWrite","DbgPrintEx","KeQueryPerformanceCounter","FltFreeSecurityDescriptor","FltBuildDefaultSecurityDescriptor","FltSendMessage","FltCloseCommunicationPort","FltCreateCommunicationPort","FltGetDiskDeviceObject","FltReleaseContext","FltGetStreamContext","FltGetVolumeContext","FltDeleteStreamContext","FltSetStreamContext","FltSetVolumeContext","FltAllocateContext","FltReadFile","FltIsDirectory","FltGetDestinationFileNameInformation","FltParseFileNameInformation","FltReleaseFileNameInformation","FltGetFileNameInformation","FltStartFiltering","FltUnregisterFilter","FltRegisterFilter","FltSetCallbackDataDirty","FltGetRequestorProcessId"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2026-05-13 18:17:34","ValidTo":"2027-05-11 18:17:34","Signature":"93cc2199d0389421a76807d521fdadd3ebc78db57beeabbfe80fef4ceca91861d30b11e74b6cc50b2d3082224b1c0d03c25153db795b52597215c29e7a85d8642fd16b1271d0c6766643583909ca9d6bc0f65ab21a3f82eb72a9f21ed72d229d960aa4b9995784837073fe28463c4d7ed553734eea8664c79f76d81dd2777d747d172182f62260b778ec9b0efacfbff430be868acff311f1f0700d547a3ccc37ecce1776332c3b679ac4c2e4ec2183144084886165856aff226ba6bff25b31757362be5a8687435c4c70e61d3fd33551a2315197238d76174943e4c2bfe2ac9198ee8116072aeb79a2f90f463d5e35f367c41604a2984d8e9da549c6f472be1aac6659574afa3cc12a5d4768faf08a945952b9b23dcff0e8d131c07366d18a95b04b12f454fb2dbea85f616e050e487c909a4d1cda95172dcc304306b699768375d0f3e1caf5f03db1975f6b7aa6e77588176027fb2d0b9b56b93249d19cca92528a4eedd85054f2b6f4f266f7b81b50510f4b58c3b2e733cb6999567fdf6b8c41e7667c899b4098b3b9cb18dde8e0a4a0a41aa83c27ca107f4440c6650ce21ea4ced7d43c72ab560240a0d0a2c68a24194c847eeaeb4c9b49bd5a69510b24c95c369604b0a3e241ef95389066b6cf139340d91b46b798615eb051d1adad8f9a2cad2cab64db5b9177ecc9aa0737c87f20084bd38e626195c13005cb185fb357","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000849686aedfb4b66376000000000084","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"9fe699b3ab2f27e4f2aa6fcaca729d23","SHA1":"be806effbdd84c713d2286ad1d79e5601c0a9b07","SHA256":"04894d613d22d6af2d76b7f319073c187bee05eee27fd167a050076fb2009d45","SHA384":"fa1eb815b52f12434ab15fef34ae98bf077130fb31f022b93f999863606c7d1acc77ee05b6df2e7808487562bccbae8b"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"33000000849686aedfb4b66376000000000084","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]}]}