7789e9ca-8508-486b-9d77-7497c5c61474

PSKD64.SYS :inline

Description

APSoft PCIScope's PSKD64 driver exposes memory-access operations through \.\PSKD64. IOCTL 0x220044 dispatches sub-operations 0x701E and 0x701F for caller-selected virtual or physical memory reads and writes without constraining the target address. Public testing demonstrates arbitrary kernel read/write on Windows 11, including process protection removal and security-process termination.

  • UUID: 7789e9ca-8508-486b-9d77-7497c5c61474
  • Created: 2026-08-29
  • Author: Venexy
  • Acknowledgement: Venexy, Dark Monkey | [@M4xSec, @v8k6b2jjps-prog](https://twitter.com/@M4xSec, @v8k6b2jjps-prog)

Download

This download link contains the vulnerable driver!

Block PSKD64.SYS across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create PSKD64 binPath= C:\windows\temp\PSKD64.SYS type= kernel && sc.exe start PSKD64
Use CasePrivilegesOperating System
Read or write arbitrary kernel memory to disable security controls or elevate privileges.AdministratorWindows 10, Windows 11

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://www.tssc.de/site/products/tools/pciscope
  • https://www.tssc.de/site/download/prods/pciscope.exe
  • https://github.com/magicsword-io/LOLDrivers/issues/408

    • Known Vulnerable Samples

    PropertyValue
    FilenamePSKD64.SYS
    Creation Timestamp2026-03-08 09:06:34
    MD5741daa162541343e15f0448487ca52c5
    SHA19bd89c27aa2b230feea1171798bfc0e24652444a
    SHA25634cdbf48f5a51ca9553c14f007aaa1b67c24e1334d8cb29e80f07c80c5dc07e7
    Authentihash MD52eb18722d74040a5f2713f958b1fc2b1
    Authentihash SHA15f0369a2f3f9ffc931ef1a982e5685a8ade50add
    Authentihash SHA256d53d5e1311f42580e5cbc675f6435753dd5869418ff47451a0b372f841662534
    RichPEHeaderHash MD58ae9f4d712397e916ae0c458857cec66
    RichPEHeaderHash SHA1a181cf1e611219c7cd1fda172f8ab4431c26657b
    RichPEHeaderHash SHA25678241920372366f18eb945a9b022d046b0dcd29f91a9ebfb12f41f6749ee845b
    CompanyAPSoft
    DescriptionPCI Diagnostic Driver
    ProductPCIScope
    OriginalFilenamePSKD64.SYS

    Download

    Certificates

    Expand
    Certificate 6edd4f25e7317d3981573134cfc1dca0
    FieldValue
    ToBeSigned (TBS) MD5611350a193d046e140ef1a4f952e12d3
    ToBeSigned (TBS) SHA1280bd286608fe3a3ea55209039b1d720cebb09a2
    ToBeSigned (TBS) SHA256479f4114f068a455c4f9e6ec28b2f0161681613f155ad5a87b464693e33bdb24
    SubjectC=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA ECC R2
    ValidFrom2019-03-07 19:37:45
    ValidTo2034-03-03 19:37:45
    Signature306402304a5bea809fba3692cf8c31edeca599ee3227bcc317eb878f57503005bf7595f73cf93f1952833420e11156ee393eb7ee023002b5b8d9f8781247c1c045ff15f6a066bb43e24f430e587797a4a2553424845a5619cfa655201bd9109a5300fb895e70
    SignatureAlgorithmOID1.2.840.10045.4.3.3
    IsCertificateAuthorityTrue
    SerialNumber6edd4f25e7317d3981573134cfc1dca0
    Version3
    Certificate 571ae028012f6b3e40d4cdcab8e3fe3e
    FieldValue
    ToBeSigned (TBS) MD59ce4617540fe261e78f2c937223df698
    ToBeSigned (TBS) SHA145a264b93bf8ab2ef734b4ddbbe296f2d6269709
    ToBeSigned (TBS) SHA256d919e1e5979dc5e27d3e98ebda4f8e28a834f924479ad0ba2a03aa163402c9a3
    SubjectC=DE, ST=Bavaria, L=Reichertsheim, O=APSoft e. K., serialNumber=HRA 12182, CN=APSoft e. K., BUSINESS_CATEGORY=Private Organization, JURISDICTION_OF_INCORPORATION_L=Traunstein, JURISDICTION_OF_INCORPORATION_SP=Bavaria, JURISDICTION_OF_INCORPORATION_C=DE
    ValidFrom2025-12-10 14:39:27
    ValidTo2028-12-09 14:39:27
    Signature3066023100b00f2974c6fd6a9a87fced1620c5466a3119de9cc9d69f7630098f96421c48b8036b09a870753957ff1436d3ed1b9342023100afc36374380a77714670418d03051fc6e63498ff0ad5a1b8c6ade4e1cc4d5b4e748fbe64d31a72d0c24342458cf749d6
    SignatureAlgorithmOID1.2.840.10045.4.3.3
    IsCertificateAuthorityFalse
    SerialNumber571ae028012f6b3e40d4cdcab8e3fe3e
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll

    Imported Functions

    Expand
    • MmProbeAndLockPages
    • MmUnlockPages
    • IoAllocateMdl
    • sprintf
    • ExFreePoolWithTag
    • ExQueryPoolBlockSize
    • ObfDereferenceObject
    • strchr
    • strstr
    • strncpy
    • IoDeleteDevice
    • IoCreateDevice
    • MmIsAddressValid
    • KeReleaseSpinLock
    • KeAcquireSpinLockRaiseToDpc
    • RtlInitUnicodeString
    • ZwQuerySystemInformation
    • ExAllocatePool
    • _strnicmp
    • IoGetDeviceObjectPointer
    • _stricmp
    • KeRemoveQueueDpc
    • ZwClose
    • KeReadStateTimer
    • KeCancelTimer
    • ExAllocatePoolWithTag
    • ExSystemTimeToLocalTime
    • RtlTimeToTimeFields
    • KeNumberProcessors
    • KeReleaseSpinLockFromDpcLevel
    • KeAcquireSpinLockAtDpcLevel
    • RtlQueryRegistryValues
    • RtlFreeUnicodeString
    • KeBugCheckEx
    • IoFreeMdl
    • KeDelayExecutionThread
    • KeQueryTimeIncrement
    • MmGetSystemRoutineAddress
    • PsGetVersion
    • ZwOpenKey
    • ExAcquireResourceExclusiveLite
    • IoCreateNotificationEvent
    • KeLeaveCriticalRegion
    • ZwOpenDirectoryObject
    • KeEnterCriticalRegion
    • ZwCreateFile
    • ExReleaseResourceLite
    • ObReferenceObjectByHandle
    • RtlCompareUnicodeString
    • RtlUpcaseUnicodeChar
    • PsCreateSystemThread
    • ExInterlockedInsertHeadList
    • ExInterlockedInsertTailList
    • PsTerminateSystemThread
    • KeWaitForSingleObject
    • ExInterlockedRemoveHeadList
    • KeSetEvent
    • KeInitializeEvent
    • IoFreeIrp
    • IoAllocateIrp
    • ZwQueryKey
    • RtlUnicodeToMultiByteN
    • RtlMultiByteToUnicodeN
    • strrchr
    • toupper
    • isdigit
    • IoBuildDeviceIoControlRequest
    • strncmp
    • IofCallDriver
    • IoAdapterObjectType
    • IoFileObjectType
    • IoDriverObjectType
    • ExDesktopObjectType
    • ExEventObjectType
    • ExFreePool
    • IoDeleteSymbolicLink
    • ZwQueryValueKey
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • _strupr
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • RtlUnicodeStringToAnsiString
    • RtlFreeAnsiString
    • KeInitializeDpc
    • KeSetTimerEx
    • KeInitializeTimerEx
    • KeWaitForMultipleObjects
    • IoCreateSynchronizationEvent
    • KeInitializeSemaphore
    • KeReleaseSemaphore
    • KeReadStateSemaphore
    • IoAssignResources
    • KeClearEvent
    • KeResetEvent
    • KeReadStateEvent
    • IoGetCurrentProcess
    • PsGetCurrentProcessId
    • ZwSetInformationThread
    • KeInitializeMutex
    • KeReleaseMutex
    • IoQueryDeviceDescription
    • DbgPrint
    • PoCallDriver
    • _strlwr
    • ZwEnumerateKey
    • IoWriteErrorLogEntry
    • IoAllocateErrorLogEntry
    • KeSetPriorityThread
    • ZwSetInformationFile
    • ZwQueryInformationFile
    • ZwWriteFile
    • MmMapIoSpace
    • IoDeviceObjectType
    • MmUnmapIoSpace
    • __C_specific_handler
    • HalSetBusDataByOffset
    • HalTranslateBusAddress
    • HalGetBusDataByOffset
    • KeQueryPerformanceCounter
    • KeStallExecutionProcessor

    Exported Functions

    Expand
    • _except_handler3

    Sections

    Expand
    • .text
    • DebugDat
    • .rdata
    • .data
    • .pdata
    • DebugCod
    • PAGE
    • .edata
    • INIT
    • INITDATA
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "6edd4f25e7317d3981573134cfc1dca0",
      "Signature": "306402304a5bea809fba3692cf8c31edeca599ee3227bcc317eb878f57503005bf7595f73cf93f1952833420e11156ee393eb7ee023002b5b8d9f8781247c1c045ff15f6a066bb43e24f430e587797a4a2553424845a5619cfa655201bd9109a5300fb895e70",
      "SignatureAlgorithmOID": "1.2.840.10045.4.3.3",
      "Subject": "C=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA ECC R2",
      "TBS": {
        "MD5": "611350a193d046e140ef1a4f952e12d3",
        "SHA1": "280bd286608fe3a3ea55209039b1d720cebb09a2",
        "SHA256": "479f4114f068a455c4f9e6ec28b2f0161681613f155ad5a87b464693e33bdb24",
        "SHA384": "68c2c4a03fb1c1ab754ab4e5413d224028c097a17b0380b290da95852ff61c26fd8d3177708f91f0afe21dae30ae32ab"
      },
      "ValidFrom": "2019-03-07 19:37:45",
      "ValidTo": "2034-03-03 19:37:45",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "571ae028012f6b3e40d4cdcab8e3fe3e",
      "Signature": "3066023100b00f2974c6fd6a9a87fced1620c5466a3119de9cc9d69f7630098f96421c48b8036b09a870753957ff1436d3ed1b9342023100afc36374380a77714670418d03051fc6e63498ff0ad5a1b8c6ade4e1cc4d5b4e748fbe64d31a72d0c24342458cf749d6",
      "SignatureAlgorithmOID": "1.2.840.10045.4.3.3",
      "Subject": "C=DE, ST=Bavaria, L=Reichertsheim, O=APSoft e. K., serialNumber=HRA 12182, CN=APSoft e. K., BUSINESS_CATEGORY=Private Organization, JURISDICTION_OF_INCORPORATION_L=Traunstein, JURISDICTION_OF_INCORPORATION_SP=Bavaria, JURISDICTION_OF_INCORPORATION_C=DE",
      "TBS": {
        "MD5": "9ce4617540fe261e78f2c937223df698",
        "SHA1": "45a264b93bf8ab2ef734b4ddbbe296f2d6269709",
        "SHA256": "d919e1e5979dc5e27d3e98ebda4f8e28a834f924479ad0ba2a03aa163402c9a3",
        "SHA384": "2f4db590d1f92e6bdecafebfbcdec713205d09d15f5b00d91c8ddf09bf6289f4b364285a438993915b153476e6d2db33"
      },
      "ValidFrom": "2025-12-10 14:39:27",
      "ValidTo": "2028-12-09 14:39:27",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA ECC R2",
      "SerialNumber": "571ae028012f6b3e40d4cdcab8e3fe3e",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-08-31