Driver intelligenceVulnerableVerified

RtsTpx.sys

RtsTpx.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 610617d5-2566-4f55-b636-29a4ea576654ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

RtsTpx.sysSample 1 · HVCI TRUE

MD5: 57d874a13a40c58ade544c273543ecfb
SHA1: b709573815f7b5e016400b2c301dce562d02699b
SHA256: b19ec8330b026100f705c05b793030ca109e15cbec4ada13b452acf259cc29d5
Imphash: 3dd15860eaae991718ae239bc20417c7
Authentihash MD5: 1ffe20f2d8f8ebf9b64da5b56049c775
Authentihash SHA1: c6b7a182371c889ee73ce0670fc500c8e21d400c
Authentihash SHA256: ebed044bd804567524c093d6e690189f616490be27edc2311cc330293ee9822e
Machine: AMD64
Version: 10.0.22000.12024
Publisher: Realtek Semiconductor Corp.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create RtsTpx binPath=C:\windows\temp\RtsTpx.sys type=kernel && sc.exe start RtsTpx

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint