BiosToolCommonDriver.sys
BiosToolCommonDriver.sys is an AMD RPMC (Replay Protected Monotonic Counter) field fusing utility driver that exposes 18 IOCTLs including arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O, PCI configuration space read/write, MSR read/write (wrmsr/rdmsr), SPI flash read, CPUID execution, virtual-to-physical address translation via MmGetPhysicalAddress, and contiguous memory allocation. WHQL Microsoft-signed and also AMD Sectigo dual-signed. Ships inside Razer Blade 16 BIOS update packages and ASUS firmware config bundles. PDB path confirms AMD internal build origin.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
BiosToolCommonDriver.sysSample 1 · HVCI FALSE
- MD5
622cca8e67e9056955e0aeb55716a68f- SHA1
d4c584732fa9abd7d7eb83e169686764c500f2e0- SHA256
177227f68cc28ee7726381b95f7d2215da35be3750157ebcb7e113201059026c- Imphash
e3c915c62d33052b715b0a50dfa2d89d- Authentihash MD5
be3cf8458143f2e2f47481043a18e6f5- Authentihash SHA1
129f2f059513ae62d0f63e3644cbfa7b671b938b- Authentihash SHA256
14deaf22605904971fe757778cec9e46a0fd59a1895491760740404843929481- Machine
- AMD64
- Version
- 1.1.3.0
- Publisher
- Advanced Micro Devices
Recorded command
sc.exe create BiosToolCommonDriver binPath=C:\windows\temp\BiosToolCommonDriver.sys type=kernel && sc.exe start BiosToolCommonDriverElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Patrick Saif @weezerOSINT