← Back to driver explorer
Driver intelligenceVulnerableVerified
GGProtect64.sys
GGProtect64.sys is a Microsoft-signed anticheat kernel driver for GG租号 that exposes a \\.\GGProtect64 device. Public research documents a bypassable caller-registration flow through IOCTL 0x223C14 and a privileged process termination path through IOCTL 0x223C04, allowing a local process to terminate or suspend protected processes from kernel mode.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
GGProtect64.sysSample 1 · HVCI TRUE
- MD5
b6a0d03122bd968b40ce97c145b491c7- SHA1
aaf935918bd7693a85225597439d69a8a1d186a1- SHA256
0aa69aee93c6be9bc82680a7df99c114591038ae02e6666fc6e42acb09643111- Imphash
8efa61c33d2811723dd8f0f9ad90eb82- Authentihash MD5
8ef6b422780982b1f60e6dc77fed3a3c- Authentihash SHA1
5aa6339c5717d1a5a5bcccbe65d3b1295b75db44- Authentihash SHA256
54fd07a69bd4c9a81d814eb3b195f1fd8531e15300c2796cbdb6344c6cec3c88- Machine
- AMD64
- Version
- 2.2.6.6
- Publisher
- 湖南南澳网络科技有限公司
Recorded command
sc.exe create GGProtect64 binPath=C:\windows\temp\GGProtect64.sys type=kernel && sc.exe start GGProtect64Terminate or suspend protected processes · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/325
- https://github.com/magicsword-io/LOLDrivers/issues/368
- https://github.com/KeServiceDescriptorTable/vulnerable-drivers
- https://github.com/Haider303/GGProtect-exploit
- https://medium.com/@haider303mustafa/bypassing-weak-driver-authentication-to-kill-ppl-protected-processes-ggprotect64-sys-analysis-d8f44c5837b4
Acknowledgement: @rainbowdynamix, @DbgPrint, @Haider303