Driver intelligenceVulnerableVerified

MyPortIO_x64.sys

MyPortIO_x64.sys and MyPortIO_x86.sys are Nuvoton Technology kernel drivers bundled with ASRock Polychrome RGB. Public issue #380 and the MyPortIO-Exploit writeup document unauthenticated IOCTL handlers that expose physical memory read/write and I/O port access primitives from user mode.

UUID / 7d9fee48-82d8-4582-be9a-a46682054e3eADDED / 2026-06-22AUTHOR / Michael Haag

Known samples 2

0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.

MyPortIO_x64.sysSample 1 · HVCI unknown

MD5: 5a55272db2de6f37b30a0515b0c08383
SHA1: f6bbd1917bcb4df7550bb42c50cd7ceef2ea1837
SHA256: 18bf6cf0224a41058ba3944ff0df9e12fa256c7c353d6fa6132a464cd5db5709
Imphash: 706a0591c3a83c9a119c940315eccb27
Authentihash MD5: 4f0814b7cdd539a5db392cd86749a141
Authentihash SHA1: c24d4a9da33673c9a6c2c6ae60c941494bc1b384
Authentihash SHA256: f07de42c0f0523698dd70119a327e47ac91e520af8cce16587bf6508456c8767
Machine: AMD64
Version: 3,0,2009,325
Publisher: Nuvoton Technology Corp.

Download vulnerable sample ↗View on VirusTotal ↗

MyPortIO_x86.sysSample 2 · HVCI unknown

MD5: cda61b27e94b5ec1f1cde870e59eeabb
SHA1: 26f21762a88b9b6688b151770c4ea6c4723765e6
SHA256: 30d5e07d9e88722a5e0eec17d0437b859f782d1c15fc80b5381f3e3eb4221bc7
Imphash: 0a0842132bc8991a638c7f0a0567f777
Authentihash MD5: 89245a4c0a30299887888108bcfc49e0
Authentihash SHA1: d234fc0ae8369e3e86f22d274f002d441e36b0a7
Authentihash SHA256: afcafa6f79a93b4dc770b9fd937435575882350d2d8e7916f659384fa9e429b0
Machine: I386
Version: 3,0,2009,325
Publisher: Nuvoton Technology Corp.

Download vulnerable sample ↗View on VirusTotal ↗

Recorded command

sc.exe create MyPortIO_x64 binPath=C:\windows\temp\MyPortIO_x64.sys type=kernel && sc.exe start MyPortIO_x64

Access physical memory and I/O port primitives through a vulnerable hardware utility driver. · Privileges: kernel · OS: Windows 10, Windows 11

Research & references

Acknowledgement: Dark Monkey @v8k6b2jjps-prog