Driver intelligenceVulnerableVerified

SIVX64.sys

Ray Hinchliffe SIV (System Information Viewer) SIVX64.sys v5.85 dynamically resolves MmMapIoSpace and MmMapIoSpaceEx via MmGetSystemRoutineAddress at runtime (neither appears in the IAT), evading static import-based scanning. The driver exposes multiple privileged IOCTL primitives via \\.\SIVDRIVER including arbitrary physical memory mapped read/write (Cmd 0x14, critical), physical memory read via scatter-gather (Cmd 0x10) and bulk MDL (Cmd 0x13), MSR read/write on a whitelisted subset (Cmd 0x08/0x0C), unrestricted I/O port read/scan (Cmd 0x44/0x50), and unrestricted PCI configuration space read (Cmd 0x48). WHQL signed by Microsoft Windows Hardware Compatibility Publisher; loads despite HVCI.

UUID / 31439f28-4616-4ee1-a6b7-1cf742127909ADDED / 2026-04-06AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

SIVX64.sysSample 1 · HVCI TRUE

MD5: 81d040540015fe998a4cc4bf9a4e8598
SHA1: 5702d2ff261f0460a347e2a98752563633825842
SHA256: 33903e8fa9f0a2acaa4784d645e309b0bd780693824b6c2c5fef257238c77478
Imphash: 7007297dbcb0b94310208fdc643e67ac
Authentihash MD5: c2cb8aaa72a8c0a44e5f78e470f4640b
Authentihash SHA1: 189a176afc0d7f52eb3c5e131e51adeaba107c53
Authentihash SHA256: fee16e6386b2626f401714257afd6a2cd92bf0b00e6458240908fa5937fb2554
Machine: AMD64
Version: V5.85 (V5.85)
Publisher: Microsoft Windows Hardware Compatibility Publisher

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create SIVDRIVER binPath=C:\windows\temp\SIVX64.sys type=kernel && sc.exe start SIVDRIVER

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: weezerOSINT @weezerOSINT