50bbae3f-f6d8-4881-8fd7-a70002d52841

giveio.sys :inline

Description

The 32-bit giveio driver bundled with SpeedFan creates the \.\giveio device and handles IRP_MJ_CREATE by applying a zeroed 8 KiB I/O permission map to the opening process through Ke386IoSetAccessProcess and Ke386SetIoAccessMap. This grants unrestricted direct access to all x86 I/O ports without validating the caller.

  • UUID: 50bbae3f-f6d8-4881-8fd7-a70002d52841
  • Created: 2026-08-29
  • Author: impudent
  • Acknowledgement: impudent | @dsavxc

Download

This download link contains the vulnerable driver!

Block giveio.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create giveio binPath= C:\windows\temp\giveio.sys type= kernel && sc.exe start giveio
Use CasePrivilegesOperating System
Grant a user-mode process unrestricted access to hardware I/O ports.Administrator required to install; opening the device grants port access without an additional caller check32-bit Windows NT, Windows 2000, Windows XP

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/magicsword-io/LOLDrivers/issues/407
  • https://www.almico.com/speedfan.php

    • Known Vulnerable Samples

    PropertyValue
    Filenamegiveio.sys
    Creation Timestamp1996-04-03 19:33:25
    MD577ebf3e9386daa51551af429052d88d0
    SHA1bd4f3e24f531e974fbaac43381120b42e804fbaf
    SHA25694c3294bb9e14b07448734ae65b37801d3ff15bec987d182a929a017fef7b276
    Authentihash MD5196f8a68da8632173d1243354d124484
    Authentihash SHA1bdd62bb96cda70580b9a0abec86432fb1cdf7f60
    Authentihash SHA256daf4d9df4b1e64ca7c800500a7f290b9af5fdc5c63c5afadb7d6630480688ddc
    RichPEHeaderHash MD5
    RichPEHeaderHash SHA1
    RichPEHeaderHash SHA256

    Download

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • IoGetCurrentProcess
    • IoDeleteSymbolicLink
    • RtlInitUnicodeString
    • MmFreeNonCachedMemory
    • Ke386SetIoAccessMap
    • Ke386IoSetAccessProcess
    • IoDeleteDevice
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • IoCreateDevice
    • MmAllocateNonCachedMemory

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .idata
    • .reloc

    Signature

    Expand

    source

    last_updated: 2026-08-31