← Back to driver explorer
Driver intelligenceVulnerableVerified
phymem64.sys
Supermicro phymem drivers expose direct physical-memory operations to user mode. In the tracked 2.3.0.0 build, IOCTL 0x80002000 accepts a physical address and length, maps the range with MmMapIoSpace, builds an MDL, and maps the pages to user mode with MmMapLockedPagesSpecifyCache; 0x80002004 releases the mapping. Adjacent paths provide direct physical-memory reads and port I/O. An administrator with device access can use these primitives to inspect or modify kernel state.
Known samples 3
0 recorded TRUE · 1 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
phymem64.sysSample 1 · HVCI FALSE
- MD5
2c54859a67306e20bfdc8887b537de72- SHA1
d7f7594ff084201c0d9fa2f4ef1626635b67bce5- SHA256
1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52- Imphash
69260cce3156aa2dc0540fb78f5fe826- Authentihash MD5
aa43aa9f88e2fed984077a8852d85a4f- Authentihash SHA1
52a8cd44646973b59c244b5f7b04b33a412634a2- Authentihash SHA256
6ed3379d7ac1ad8bcfd13cd2502420569088ee7f1e04522ada48481d9a545a08- Machine
- AMD64
- Version
- 1, 0, 0, 0
- Publisher
- Super Micro Computer, Inc.
phymem64.sysSample 2 · HVCI unknown
- MD5
50493aa68b56d96cf2493f7f18006933- SHA1
8dd8033c50b75c8f33b1f860f4ea1c605fc69ebb- SHA256
4f9d38567f3a2ac47ae1d8ac5e34a8c99a42a2ca3afc5f1ace44a4cd1097e814- Imphash
6bf6c7ee793a089775db504944eb267e- Authentihash MD5
4361ef663928b5fe414946bb2a831611- Authentihash SHA1
6bae7e847d119a2012eaed98bb7b06da19ed25e6- Authentihash SHA256
d7bbb86ccc9c1f4e0c47b2d98c54e73e6915d68d560525e62817205434b01fb6- Machine
- AMD64
- Version
- 2, 3, 0, 0
- Publisher
- Super Micro Computer, Inc.
phymem64.sysSample 3 · HVCI unknown
- MD5
57a1995aa572caee922a8ea19ccd7802- SHA1
1c5e40117b0175392c0e90733f82ab626394e5f4- SHA256
e7ecb1c259bb0e2b91f3b0a5f1970f4cfe68c59730f762cb3bb068db79e3612e- Imphash
d722e65a33b35166122d0e2871f6710c- Authentihash MD5
fe8fac73718b86156996635a4d7b1f6d- Authentihash SHA1
afceb95cbc759eeb5dbafffc2a6ad8affadbfa00- Authentihash SHA256
206f6277ce57bd0e7d0a29820cb6adb733f92473789605ae41f4e79016e614de- Machine
- AMD64
- Version
- 2, 2, 0, 0
- Publisher
- Super Micro Computer, Inc.
Recorded command
sc.exe create phymem64.sys binPath=C:\windows\temp\phymem64.sys type=kernel && sc.exe start phymem64.sysRead and write physical memory · Privileges: Administrator · OS: Windows 10
Research & references
Acknowledgement: fluffycats31 @fluffycats31