Driver intelligenceVulnerableVerified

giveio.sys

The 32-bit giveio driver bundled with SpeedFan creates the \\.\giveio device and handles IRP_MJ_CREATE by applying a zeroed 8 KiB I/O permission map to the opening process through Ke386IoSetAccessProcess and Ke386SetIoAccessMap. This grants unrestricted direct access to all x86 I/O ports without validating the caller.

UUID / 50bbae3f-f6d8-4881-8fd7-a70002d52841ADDED / 2026-08-29AUTHOR / impudent

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

giveio.sysSample 1 · HVCI unknown

MD5: 77ebf3e9386daa51551af429052d88d0
SHA1: bd4f3e24f531e974fbaac43381120b42e804fbaf
SHA256: 94c3294bb9e14b07448734ae65b37801d3ff15bec987d182a929a017fef7b276
Imphash: b5986408bbf7e1b5028742a5d8adac66
Authentihash MD5: 196f8a68da8632173d1243354d124484
Authentihash SHA1: bdd62bb96cda70580b9a0abec86432fb1cdf7f60
Authentihash SHA256: daf4d9df4b1e64ca7c800500a7f290b9af5fdc5c63c5afadb7d6630480688ddc
Machine: I386
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create giveio binPath= C:\windows\temp\giveio.sys type= kernel && sc.exe start giveio

Grant a user-mode process unrestricted access to hardware I/O ports. · Privileges: Administrator required to install; opening the device grants port access without an additional caller check · OS: 32-bit Windows NT, Windows 2000, Windows XP

Research & references

Acknowledgement: impudent @dsavxc