AmdTools64.sys

AMD Special Tools Driver AmdTools64.sys 1.7.16.219 exposes physical-memory mapping through IOCTL 0xFFF028A4. Static analysis confirms that the handler passes a caller-supplied physical address and length to MmMapIoSpace, constructs an MDL, and maps the range into the caller's user-mode address space with MmMapLockedPagesSpecifyCache, without a physical-range authorization check. The device uses FILE_DEVICE_SECURE_OPEN and a security descriptor granting access only to LocalSystem and Builtin Administrators. This is an administrator/SYSTEM-gated physical-memory primitive, not a standard-user entry point. The PnP driver must be installed and its device interface started before the request can be used. The assessment is limited to this exact sample and does not assert an affected-version range.