{"DetectionScope":"context-only","ResearchEvidence":{"Id":"d474d8ad-14d9-4664-addd-86b4a9b7a1a5","Tags":["NeacSafe64.sys","NeacSafePort","FPSNeacSafePort","OWNeacSafePort"],"Verified":"TRUE","Author":"Michael Haag, Zhang Tingjia","Created":"2026-06-16","MitreID":"T1068","CVE":"CVE-2025-45737","Category":"vulnerable driver","Commands":{"Command":"sc.exe create NeacSafe64 binPath=C:\\windows\\temp\\NeacSafe64.sys type=kernel && sc.exe start NeacSafe64","Description":"NetEase NeacSafe64.sys is an anti-cheat minifilter driver. Public NeacController research documents arbitrary kernel writes (opcode 70) in the 2025-02-20 sample, SHA256 65447f727801e8be8a51aaaafc07618c8196553e683affb0721da441e2430bad, associated with CVE-2025-45737. Separate research on the added 2026 FragPunk, Overwatch China and NARAKA builds reports that opcode 70 has been stubbed, while unauthenticated filter-port messages still expose process termination (opcode 20), process-protection changes (opcode 33), a pool overflow (opcode 52), and a system-crash path (opcode 63). The researcher reports termination and protection stripping of PPL processes. The filter port permits one connection, so an existing client can prevent access. All these builds report version 1.0.0.0 despite differing capabilities; use sample hashes to distinguish them. The older CVE's arbitrary-write claim is not applied to the added samples.","Usecase":"Abuse vulnerable message handlers for kernel writes in the older sample, or process termination, protection changes and denial of service in the added builds.","Privileges":"kernel","OperatingSystem":"Windows 10, Windows 11"},"Resources":["https://github.com/za233/NeacController","https://github.com/hfiref0x/KDU/blob/master/Help/providers.md","https://github.com/hax0r31337/vuln-driver-neacsafe64"],"Detection":[],"Acknowledgement":{"Person":"za233, hax0r31337","Handle":"@za233, @hax0r31337"},"KnownVulnerableSamples":[{"Filename":"NeacSafe64.sys","SHA256":"65447f727801e8be8a51aaaafc07618c8196553e683affb0721da441e2430bad","MD5":"dcc288fafad0bf3b505c4b44791d423d","SHA1":"7e6dd5f1363c3070c59378ec8b23b6ec7b5671b4","Imphash":"7a377a157a35494d3fc033245b7fd077","Authentihash":{"MD5":"9caa8f73259bba3021b7384c637db9fe","SHA1":"5c41fa80052c332f7d6323c91e84e1204ba1c1c7","SHA256":"caac9e1cbeaf4c1e05298e9b0f29468b35a36badd443eb6146e59c5fe520a52e"},"RichPEHeaderHash":{"MD5":"c9465872e493ccc48ad7c44938da729f","SHA1":"24e46b810b18225f69b5e5167218720128641e7a","SHA256":"1f608b6c31312466b8d9492bdea5dc696140f55773fb7f58ba9318f4ee2ed6b0"},"Sections":{".text":{"Entropy":6.5629495622202585,"Virtual Size":"0x53249"},".rdata":{"Entropy":6.053807330462,"Virtual Size":"0x1babbc"},".data":{"Entropy":3.7505437551242786,"Virtual Size":"0xb76c"},".pdata":{"Entropy":5.724778778145897,"Virtual Size":"0x3ad4"},"PAGE":{"Entropy":6.468553037469635,"Virtual Size":"0x4a6e"},"INIT":{"Entropy":6.503904578215365,"Virtual Size":"0x473c6"},".rsrc":{"Entropy":3.1910719454433334,"Virtual Size":"0x250"},".reloc":{"Entropy":6.6847634173760975,"Virtual Size":"0x183c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-02-20 04:13:54","Description":"","Company":"网易(杭州)网络有限公司杭州","InternalName":"","OriginalFilename":"neacsafe","FileVersion":"1.0.0.0","Product":"neacsafe","ProductVersion":"1.0.0.0","Copyright":"","MachineType":"AMD64","Imports":["FLTMGR.SYS","ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["FltCloseClientPort","FltCloseCommunicationPort","FltUnregisterFilter","FltGetFileNameInformation","FltReleaseFileNameInformation","FltGetVolumeName","FltGetRequestorProcessId","FltGetDestinationFileNameInformation","FltFreeGenericWorkItem","FltAllocateGenericWorkItem","FltQueueGenericWorkItem","FltSendMessage","FltRegisterFilter","FltBuildDefaultSecurityDescriptor","FltCreateCommunicationPort","FltFreeSecurityDescriptor","FltStartFiltering","DbgPrint","ExAllocatePoolWithTag","KdDebuggerNotPresent","KeBugCheckEx","KeBugCheck","ExInitializeResourceLite","ZwWaitForSingleObject","ZwClose","ExDeleteResourceLite","IoRegisterBootDriverReinitialization","KeDelayExecutionThread","ExSystemTimeToLocalTime","RtlTimeToTimeFields","IoGetCurrentProcess","PsGetProcessImageFileName","PsGetCurrentThreadId","PsGetProcessId","RtlInitUnicodeString","MmGetSystemRoutineAddress","ZwCreateFile","PsCreateSystemThread","PsTerminateSystemThread","KeEnterCriticalRegion","ExAcquireResourceExclusiveLite","KeAcquireInStackQueuedSpinLock","KeReleaseInStackQueuedSpinLock","ZwWriteFile","ExReleaseResourceLite","KeLeaveCriticalRegion","DbgPrintEx","KeAcquireInStackQueuedSpinLockAtDpcLevel","KeReleaseInStackQueuedSpinLockFromDpcLevel","RtlFindClearBitsAndSet","RtlClearBits","ExCreateCallback","ExRegisterCallback","ExUnregisterCallback","MmSystemRangeStart","RtlCopyUnicodeString","KeNumberProcessors","KeSetSystemAffinityThread","KeRevertToUserAffinityThread","KeQueryActiveProcessorCountEx","KeInsertQueueDpc","RtlCompareMemory","MmGetPhysicalAddress","MmGetVirtualForPhysical","MmAllocateContiguousMemory","MmFreeContiguousMemory","__C_specific_handler","MmBuildMdlForNonPagedPool","MmMapLockedPagesSpecifyCache","MmUnmapLockedPages","IoFreeMdl","KeAreApcsDisabled","ExAcquireRundownProtection","ExReleaseRundownProtection","ExAcquireSpinLockSharedAtDpcLevel","ExReleaseSpinLockSharedFromDpcLevel","MmGetPhysicalMemoryRanges","PsInitialSystemProcess","KeInitializeEvent","ExQueueWorkItem","KeWaitForSingleObject","KeSetSystemGroupAffinityThread","KeRevertToUserGroupAffinityThread","RtlInitializeBitMap","MmAllocateMappingAddress","MmFreeMappingAddress","MmIsAddressValid","RtlLookupFunctionEntry","RtlImageNtHeader","RtlCaptureContext","KeCapturePersistentThreadState","ObQueryNameString","RtlPrefixUnicodeString","RtlFormatCurrentUserKeyPath","RtlAppendUnicodeStringToString","RtlFreeUnicodeString","RtlAppendUnicodeToString","CmRegisterCallback","CmUnRegisterCallback","IoDriverObjectType","ObReferenceObjectByName","MmUserProbeAddress","ProbeForRead","MmLockPagableDataSection","MmUnlockPagableImageSection","MmCreateMdl","RtlGetVersion","ExAllocatePool","ExAcquireFastMutex","ExReleaseFastMutex","ExAcquireRundownProtectionEx","ExReleaseRundownProtectionEx","ObfReferenceObject","RtlCompareUnicodeString","ProbeForWrite","KeStackAttachProcess","KeUnstackDetachProcess","PsGetProcessInheritedFromUniqueProcessId","PsGetProcessCreateTimeQuadPart","ZwOpenProcess","ZwQueryInformationProcess","PsGetProcessWow64Process","PsGetProcessDebugPort","PsGetProcessSectionBaseAddress","MmHighestUserAddress","ExGetPreviousMode","ZwQuerySystemInformation","ZwOpenFile","ZwQueryInformationFile","ZwCreateSection","ZwMapViewOfSection","ZwUnmapViewOfSection","FsRtlGetFileSize","FsRtlCreateSectionForDataScan","PsGetProcessPeb","IoQueryFileInformation","RtlInitAnsiString","RtlCopyString","PsLookupThreadByThreadId","ObOpenObjectByPointer","ZwQueryInformationThread","PsIsSystemThread","PsGetThreadProcessId","PsIsThreadTerminating","IoGetStackLimits","PsProcessType","ObReferenceObjectByHandle","ExEnumHandleTable","ZwWaitForMultipleObjects","ZwOpenSymbolicLinkObject","ZwQuerySymbolicLinkObject","IoFileObjectType","IoQueryFileDosDeviceName","IoVolumeDeviceToDosName","KeWaitForMultipleObjects","RtlSetDaclSecurityDescriptor","HalPrivateDispatchTable","ZwAllocateVirtualMemory","NtClose","PsThreadType","KeClearEvent","MmAllocatePagesForMdl","MmFreePagesFromMdl","ZwOpenThread","PsGetThreadId","PsRemoveLoadImageNotifyRoutine","PsSetCreateProcessNotifyRoutine","KeEnterGuardedRegion","ExfAcquirePushLockShared","ExfReleasePushLockShared","KeLeaveGuardedRegion","ExInitializeRundownProtection","PsSetLoadImageNotifyRoutine","PsSetCreateThreadNotifyRoutine","ExWaitForRundownProtectionRelease","ExRundownCompleted","PsRemoveCreateThreadNotifyRoutine","IoGetInitialStack","ExAcquireSpinLockShared","ExReleaseSpinLockShared","RtlClearAllBits","RtlFindSetBits","RtlFindNextForwardRunClear","KeInitializeApc","KeInsertQueueApc","RtlSetBit","ExfReleasePushLock","MmUnlockPages","MmSizeOfMdl","ExAllocatePoolWithQuotaTag","MmProbeAndLockPages","RtlAnsiStringToUnicodeString","ExRaiseStatus","ZwOpenDirectoryObject","IoDeviceObjectType","RtlWalkFrameChain","RtlVirtualUnwind","RtlEnumerateGenericTableAvl","MmAllocateNonCachedMemory","MmFreeNonCachedMemory","RtlImageDirectoryEntryToData","ZwReadFile","KeInitializeAffinityEx","KeAddProcessorAffinityEx","KeQueryActiveProcessorCount","KeQueryTimeIncrement","KeRegisterNmiCallback","KeDeregisterNmiCallback","RtlUpcaseUnicodeToMultiByteN","RtlAnsiCharToUnicodeChar","RtlUnicodeToMultiByteN","strncpy","qsort","PsGetCurrentProcessId","KeSetEvent","ExFreePoolWithTag","PsGetProcessExitStatus","ObfDereferenceObject","PsLookupProcessByProcessId","MmMapLockedPages","HalGetBusDataByOffset","KeQueryPerformanceCounter","WdfVersionUnbind","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:52","ValidTo":"2025-10-08 19:04:52","Signature":"1bfc71b1c6ae1f779c132566b0692231de393c7578f2ae3adafa2968f4c01599d9dde8827a1f2ec65c46c56cad36987c0df5b1ec1c36576126f5fb988923b3c7f3f111749105254facfc1831516dba7fa7265753447f94b11979a3e9aba7f5dbd87e3f0f034229a34c7fb10cb7a90f197ffd35432e4244ee7666d4a48de1586b61b1072d441cd345eb140b613fd0fef87ab5eef73985d940029d30870053909e8550e94cb4e63696e82a182a7632267efb6056cf7c7b05c108645ea8698bba379bfa31e6bf7e179edbc3e559bbfe1fa8bf5c6b0c783edebac68aefa287bd16c1fcf2e00839c693e40e79f7c63447712a321c2ca5ee1dd2a0e03bde2702d9320a50d20439f395257fb6c5af0c11432c52801127d4bc45c0a65c660f5769fdf250aaba99a74bef0885f21a040f11e6364ba7499c795b39ca0972ff857d4e7c9bc08f257cb8dadb28817b62de202f3639de9db076ad8ee6b71a3cea1a1a476a510a3197fce4592654389629c6108656d9132971b2e55f3d19963d966a6869712265b662dcc7c92d6e3659d429c814f3efdf05ded84fe8654a039222dbe133a7992e04f05d8d7642ceb159cc705b832ec2f507ba8604047a01ff37fd69397ad861ad766df8e4e296199d81d89f708550a04d774da5c1b50062e06a72badcdb12f94820b5b834442ada4a82ce25d0450a519cac28d8362bd182257b1b80cf930e92d0","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006daa072f958218c9e300000000006d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"4320213204f73b9d506bbcbb35111c2d","SHA1":"d3cbbc8331d4d84555a6726d48dfd9571738bd25","SHA256":"fe99f47e601d6b8ab1e89961000f680bf3b0e0629a8a59864e76f135e0c89699","SHA384":"e0a64b97e2ac3d56d42b593fccee2d0e80fc626b8161f60a36a2adef8fe94c7c06c7509816d1c2211400626fc1fc63c7"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006daa072f958218c9e300000000006d","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]},{"Filename":"NeacSafe64.sys","SHA256":"1d828fe7d97620cd92275c6d14fe9721c9b04b514f4dce084f7f6ea05b7d5acd","MD5":"1607f41c32e67edf39d0968f332aef9f","SHA1":"555c8c25dee0a3c23256f9f9b66ce274f7b15aa1","Imphash":"30a629a38af80951a4e2301ee1d5feee","Authentihash":{"MD5":"aa2591313be9f531805de3ddb4071d61","SHA1":"00b873ecb9ee4ff59a76ba1f4b99531d4eac466b","SHA256":"9a44bc8e37db8fd7bcfab61e7236418377510816da3a8a20edd84d26284c5980"},"RichPEHeaderHash":{"MD5":"d5998514fc023b758d0e4bc54446392e","SHA1":"64e3799af17d2f67b7d5f7659aad42b0fa804e45","SHA256":"45195b72fe74421b8c1d6020fa50ea7607a275fe3aeea792e86dc63355c014cf"},"Sections":{".text":{"Entropy":6.677457616623464,"Virtual Size":"0x7d449"},".rdata":{"Entropy":5.051079715148226,"Virtual Size":"0x10af0b4"},".data":{"Entropy":4.24730756525089,"Virtual Size":"0x2f56c"},".pdata":{"Entropy":5.954345329430121,"Virtual Size":"0x23b8"},"PAGE":{"Entropy":6.4483173931255005,"Virtual Size":"0x4d26"},"INIT":{"Entropy":6.578951100438162,"Virtual Size":"0x9d156"},".rsrc":{"Entropy":3.19179103969721,"Virtual Size":"0x250"},".reloc":{"Entropy":6.650608180914088,"Virtual Size":"0x1954"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-01-30 01:57:30","Description":"","Company":"网易(杭州)网络有限公司杭州","InternalName":"","OriginalFilename":"neacsafe","FileVersion":"1.0.0.0","Product":"neacsafe","ProductVersion":"1.0.0.0","Copyright":"","MachineType":"AMD64","Imports":["FLTMGR.SYS","ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","Publisher":"Microsoft Windows Hardware Compatibility Publisher","Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2014"]},{"Filename":"NeacSafe64.sys","SHA256":"f79a4ba7f5656fa9ccfe245a90e6e861e2d1aaf0f9d52240abaad0521da063be","MD5":"ebfad15f91e3e4bd7f538c96dc855924","SHA1":"5b8194c13270963c29e5fa2e0ab01cc6fba4b786","Imphash":"c4d7f42aad938be2184b7e1be80216f8","Authentihash":{"MD5":"a9c6084cc45f63c0b82f8ed9bc79542e","SHA1":"e2b9255e5554b1568a01b91e9f65389926b5e377","SHA256":"3f26c7056416b92aaaa01aaa95ee4bed44eab881a476df7b80cd5a189e0daeaf"},"RichPEHeaderHash":{"MD5":"1ba8c6d8525c77be685783b18d4f9e68","SHA1":"13f8b460ce0e8860854c3097318dc220264c3f7d","SHA256":"c3631fbc40aa3a77d0bee3c8598fe3e46cb53f9459c200231ebd1b67362e5a0f"},"Sections":{".text":{"Entropy":6.6507580754145454,"Virtual Size":"0x673c9"},".rdata":{"Entropy":5.249504566197215,"Virtual Size":"0xe3ed0c"},".data":{"Entropy":4.034258427366,"Virtual Size":"0x300dc"},".pdata":{"Entropy":5.726769928358638,"Virtual Size":"0x3e64"},"PAGE":{"Entropy":6.514000397899089,"Virtual Size":"0x48b1"},"INIT":{"Entropy":6.616653340232306,"Virtual Size":"0x9af48"},".rsrc":{"Entropy":3.1910719454433334,"Virtual Size":"0x250"},".reloc":{"Entropy":6.662733517858968,"Virtual Size":"0x1958"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-04-03 03:00:01","Description":"","Company":"网易(杭州)网络有限公司杭州","InternalName":"","OriginalFilename":"neacsafe","FileVersion":"1.0.0.0","Product":"neacsafe","ProductVersion":"1.0.0.0","Copyright":"","MachineType":"AMD64","Imports":["FLTMGR.SYS","ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","Publisher":"Microsoft Windows Hardware Compatibility Publisher","Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2014"]},{"Filename":"NeacSafe64.sys","SHA256":"b1147d9b4bed22d8b6e6dcc7366950ffb57ecc10fbfe8f4ee9615b3d3cdd2368","MD5":"7296e9a1ef2e6aaafc6915e1eb552780","SHA1":"8bc89c4564188385709a04fc941c82586febe771","Imphash":"36579a94b168b84abb2af8cc819813e2","Authentihash":{"MD5":"64de48508b489bc662ce758872ec4c9c","SHA1":"1bc1927f305fc59a800b5cc025c5e1517c7683b1","SHA256":"094c3832057096dd966add98530f24fbcef27204b981a4d0bbbdba8dfb3eb2b3"},"RichPEHeaderHash":{"MD5":"70ea073af5e7710a1e13a724d0293d90","SHA1":"270caaac0d60f4345ef6aac9c512d1e48b30f984","SHA256":"6ddbd0ff3c8ba45f8b3d119d5739795d103248219a8936a545a0631661aa0b29"},"Sections":{".text":{"Entropy":6.638922239516356,"Virtual Size":"0x66409"},".rdata":{"Entropy":5.02170455412598,"Virtual Size":"0xfbecf4"},".data":{"Entropy":4.029856674327286,"Virtual Size":"0x300dc"},".pdata":{"Entropy":5.869427842519824,"Virtual Size":"0x3e1c"},"PAGE":{"Entropy":6.512371330262517,"Virtual Size":"0x48b1"},"INIT":{"Entropy":6.626759917855309,"Virtual Size":"0x94812"},".rsrc":{"Entropy":3.191131648606731,"Virtual Size":"0x250"},".reloc":{"Entropy":6.664797338448507,"Virtual Size":"0x195c"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-05-19 07:05:01","Description":"","Company":"网易(杭州)网络有限公司杭州","InternalName":"","OriginalFilename":"neacsafe","FileVersion":"1.0.0.0","Product":"neacsafe","ProductVersion":"1.0.0.0","Copyright":"","MachineType":"AMD64","Imports":["FLTMGR.SYS","ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","Publisher":"Microsoft Windows Hardware Compatibility Publisher","Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2014"]}]}}