← Back to driver explorer
Driver intelligenceVulnerableVerified
FoxKeDriver64.sys
FoxKeDriver64.sys is a vulnerable Foxconn kernel driver that exposes a \\.\Fox_FOXONE_Driver device. Public research documents IOCTL 0x2220C0 for translating a caller-supplied virtual address to a physical address, which can support local privilege escalation chains with other vulnerable drivers.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
FoxKeDriver64.sysSample 1 · HVCI FALSE
- MD5
0215d56bfbc9a947b095aff1c31b53ad- SHA1
ec06cb3a837d710f60ed8800c3be650317cb25ae- SHA256
eb81e127e7a46c80acdf8a3fc24a350381f24acb06f0fdf9fdcd34ce9b08d084- Imphash
7bc9165675650e353fceda2ace6ce93d- Authentihash MD5
94dfc62c6570ac1195409f847c2c007c- Authentihash SHA1
592cf6cffeda7559af60a5ab8939cdaf24085197- Authentihash SHA256
0c0e58989b97e30979bb3e2800b74c546ce6576b2bc7766a4b92e7e89086766a- Machine
- AMD64
- Version
- 1.00.01.03 built by: WinDDK
- Publisher
- Foxconn (R) Corporation
Recorded command
sc.exe create FoxKeDriver64 binPath=C:\windows\temp\FoxKeDriver64.sys type=kernel && sc.exe start FoxKeDriver64Translate virtual addresses to physical addresses · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/325
- https://github.com/magicsword-io/LOLDrivers/issues/370
- https://github.com/KeServiceDescriptorTable/vulnerable-drivers
- https://github.com/Haider303/sliff-driv-exploit
- https://medium.com/@haider303mustafa/applockerflter-sliffdriver-sys-full-kernel-exploit-chain-from-driver-recon-to-system-shell-b57d87738308
Acknowledgement: @rainbowdynamix, @DbgPrint, @Haider303