← Back to driver explorer
Driver intelligenceVulnerableVerified
energydriver.sys
EnergyDriver.sys is a kernel driver from Intel Corporation shipped with Intel Power Gadget 3.6 (deprecated December 2023). The driver exposes 5 IOCTLs including arbitrary wrmsr (any MSR index, any 64-bit value, no whitelist), arbitrary rdmsr (single CPU or all CPUs), and arbitrary physical memory read via MmMapIoSpace. wrmsr allows IA32_LSTAR hijack for direct syscall redirection. No privilege check, no MSR whitelist, default DACL. WHQL and Intel EV dual-signed.
Known samples 2
1 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
energydriver.sysSample 1 · HVCI TRUE
- MD5
bbab3fcf45d59edf5f19cf70c5ef9562- SHA1
693afa90fd9479541835a0720b373a3411473d62- SHA256
6665b05e6fd430b729326a0b125cfcb70c387dbee46ef3f768f7dbdf0e0a6bab- Imphash
ef789722d45b4a5c8446ffc92ebf0fa1- Authentihash MD5
cb9026c96aa5a6b39c323db128097cce- Authentihash SHA1
f3b7b15b0e8af0975540eb8087550a746e44a1a1- Authentihash SHA256
ebe03e9a6e5db969762a1723f40294260f6196cb1224faf37993c9c8365007d5- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
EnergyDriver.sysSample 2 · HVCI FALSE
- MD5
c8c357be337ef4c99019aa8fe0a09a61- SHA1
87885dc9f3b2bb9ffce65944be63b4019471b0d1- SHA256
382cb4c37fdcb2e2ca9cbb4a5de39fa4e230d1d2e1b6f38e1c8249002525f1c7- Imphash
ef789722d45b4a5c8446ffc92ebf0fa1- Authentihash MD5
ec65210451f379a0e8ed618ef46aa8b4- Authentihash SHA1
efe7ba87399b4210c76fe515e61c277cfee029a5- Authentihash SHA256
2b20a6459b6ad99e111e861c8b18727c76ce0425f8d34ef777ad1acc32702e58- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create energydriver binPath=C:\windows\temp\energydriver.sys type=kernel && sc.exe start energydriverElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: @rainbowdynamix, @DbgPrint