sysdiag.sys

Huorong sysdiag.sys 6.0.0.3 contains an IOCTL 0x2200b8 path that resolves a supplied process identifier and calls ZwTerminateProcess. The reported Bring Your Own Trusted Caller (BYOTC) chain uses administrator-level control of a genuine Huorong client to reach the product-restricted interface; trusting the client image does not establish the integrity of code executing inside it. Static analysis of this exact sample confirms the dispatcher and termination helper, while the client-classification bypass and ordinary-child termination result are externally reported. The driver must be loaded and the product-specific caller conditions met. This record does not establish access from a standard user, termination of protected processes, or applicability to other versions.