Driver intelligenceVulnerableVerified

AdvCare.sys

AdvCare.sys is a legacy hardware health monitor driver from Advantech Co., Ltd. for industrial PCs and embedded boards. The driver exposes arbitrary MSR read/write (wrmsr/rdmsr with no validation), arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O across all 65536 ports, and PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally with zero caller validation -- no admin check, no token check, no integrity check. Any unprivileged local user can open the device and invoke every primitive. The driver is also available in the KeServiceDescriptorTable/vulnerable-drivers repository on GitHub.

UUID / 658a906e-82d3-4c78-a63b-ddddeeb3f452ADDED / 2026-04-13AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

AdvCare.sysSample 1 · HVCI FALSE

MD5: 25b14ddbce32c0fd3ce53ac82145e257
SHA1: b08ca7e4a4aeb8a1f8049c1aa61255afe87987cd
SHA256: 697d3e6d215d1ed6dc2465334502db92e0ca77ad0b8392c945ac9e0f36509666
Imphash: 7c5012267ba1ab0751dd14c55b19c00b
Authentihash MD5: f972992e50e7c7c0dfff0cc588d32c63
Authentihash SHA1: fde7a5f9fb44c260433b3118215d334cf280d8ad
Authentihash SHA256: 591a22e88fbbfcae9d1a77cb62cb34e4f7a1b6d3263520dbf1157570af141b25
Machine: AMD64
Version: 2.00
Publisher: Advantech Co., Ltd.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create AdvCare binPath=C:\windows\temp\AdvCare.sys type=kernel && sc.exe start AdvCare

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: Patrick Saif @weezerOSINT