Driver intelligenceVulnerableVerified

BS_RVSIO64.sys

BS_RVSIO64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 5281b4b4-1b96-4261-8a1f-5fa22ba44d53ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

BS_RVSIO64.sysSample 1 · HVCI TRUE

MD5: 559e3b07626f694b64576c96599d6955
SHA1: 2f4124d3d81898585d2ca5c09d5333636f64217a
SHA256: a8aae612727320db096b337a45bf3cd31b5f9702ef6c4747dd2aaa74ff6badb7
Imphash: 095c0cdb9c0421da216371c1f4e8790e
Authentihash MD5: 5424dcfdef8f8cd603d2fd73669769a8
Authentihash SHA1: 72f7bb507240f5febfd1598cf0beb54473c53b7f
Authentihash SHA256: 02f753c1688c4f398e1e1ed47384791fef6628bde58f740448f8e0751b321b85
Machine: AMD64
Version: 10.0.2305.0800
Publisher: BIOSTAR Group

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create BS_RVSIO64 binPath=C:\windows\temp\BS_RVSIO64.sys type=kernel && sc.exe start BS_RVSIO64

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint