pwdrvio.sys

MiniTool Partition Wizard's pwdrvio.sys exposes raw physical-disk read and write operations through the PartitionWizardDiskAccesser device namespace. The reviewed sample accepts a numeric device-name suffix, resolves the corresponding physical disk, and forwards caller-controlled read/write requests to the disk stack. Its device is created without FILE_DEVICE_SECURE_OPEN and its create handler does not authorize the caller opening that namespace path. Static analysis therefore supports the reported standard-user access to raw disk contents once the driver is loaded, which can bypass file-system access controls and enable privilege escalation. This is physical-disk access, not arbitrary physical-memory mapping; standard-user reachability was not reproduced locally.