← Back to driver explorer
Driver intelligenceVulnerableVerified
TBT_Force_Power_Control_Access64.sys
TBT_Force_Power_Control_Access64.sys is a Thunderbolt force power control driver from Wistron Corporation that exposes physical memory read/write via MmMapIoSpace. Wistron is a major Taiwan-based OEM/ODM. Another Wistron driver (WiRwaDrv.sys) is already tracked in LOLDrivers. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
TBT_Force_Power_Control_Access64.sysSample 1 · HVCI FALSE
- MD5
a4de3d1854ba9b8e77b2324c52887a2c- SHA1
8a7e3d57f841e2f70453de312ab3b3710c5f7255- SHA256
4c776f34c6042d943baec3c13d7154a245aae8dd95e1933211fd19352c770676- Imphash
08dd07f0f6dab7cc028ea9013f5f0884- Authentihash MD5
8244400588a570fbdcc256f5be828537- Authentihash SHA1
96e15eb936c049ac87d0df9b052ae7d81c8ba9a4- Authentihash SHA256
f1768c07fb9554099980845b42ef3e545734ed98cee7be89d546351e7dbaac44- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create TBT_Force_Power_Control_Access64 binPath=C:\windows\temp\TBT_Force_Power_Control_Access64.sys type=kernel && sc.exe start TBT_Force_Power_Control_Access64Elevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/316
- https://github.com/KeServiceDescriptorTable/vulnerable-drivers
- https://github.com/Haider303/trinity-2.0-lpe
- https://medium.com/@haider303mustafa/teaccess-sys-adv64drv-sys-phymem-sys-kaslr-bypass-to-system-token-theft-69441310b7f4
- https://github.com/magicsword-io/LOLDrivers/issues/395
Acknowledgement: @rainbowdynamix, @DbgPrint