← Back to driver explorer
Driver intelligenceVulnerableVerified
WinIo64.sys
WinIo64 is a hardware-access driver based on the WinIo library that provides direct physical-memory mapping and I/O-port operations from user mode. Its IOCTL interface exposes physical-memory map and unmap, I/O-port read and write, and physical-address translation primitives that are repeatedly incorporated into BYOVD tooling.
Known samples 5
1 recorded TRUE · 4 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
WinIo64.sysSample 1 · HVCI TRUE
- MD5
66ab7f46db42bf52db06840ec3b4deb3- SHA1
9745d77e3c27437bbccf39e074f7d57a99fe83b1- SHA256
eaaed21c1788baca09ee16b06e1a231cb11c8417b3949d7d90596d50305dc604- Imphash
6e12984aefe0bde46dd36197366ec5c2- Authentihash MD5
1e57dea8b5fd6d017784014b01b6194b- Authentihash SHA1
1419392fc1ec6ef497442fee3f7553a68b78a03d- Authentihash SHA256
b12c8f36a9498df244c0659efae6f5f942068a1e0e9e0f1ba02baa4a378056be- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
WinIo64.sysSample 2 · HVCI FALSE
- MD5
b3225765f3d125af668e077478a671ab- SHA1
380f8b4c5fb7985e414add59e7a2a015623d4ec9- SHA256
462fdbbc7a638d5168a3017ebd333dab90fbb44c045aa2d65d7df3667e364b77- Imphash
3547cd37c31cc9ec12dced85dc2b1f24- Authentihash MD5
2d21884ef1cef5af9cbb9a0909d02e28- Authentihash SHA1
8522bd30b4028c43b747c96665f60ab920f341ea- Authentihash SHA256
48ec0783d0a2aaf4956102479ba4ddfe9f760066d00e1c5b7f022a084951dc73- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
WinIo64.sysSample 3 · HVCI FALSE
- MD5
34458980db56fbab608ba99b108246cb- SHA1
0549d02d10edec9deab6dc73be1297c644377f05- SHA256
175e32800edf65d0027821ed2f484088ab4e935527f8a1bd83010a005dec4a5e- Imphash
3547cd37c31cc9ec12dced85dc2b1f24- Authentihash MD5
2d21884ef1cef5af9cbb9a0909d02e28- Authentihash SHA1
8522bd30b4028c43b747c96665f60ab920f341ea- Authentihash SHA256
48ec0783d0a2aaf4956102479ba4ddfe9f760066d00e1c5b7f022a084951dc73- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
WinIo64.sysSample 4 · HVCI FALSE
- MD5
d91e0b4cf17e1c7f94175dd790df54aa- SHA1
b1f0659d94c4c077ebf79e6e0c330d850e1827af- SHA256
bbb7e83911abdedfc9529e9329d0f90cf7c94a7d00845b610c5f7099efaca492- Imphash
3547cd37c31cc9ec12dced85dc2b1f24- Authentihash MD5
2d21884ef1cef5af9cbb9a0909d02e28- Authentihash SHA1
8522bd30b4028c43b747c96665f60ab920f341ea- Authentihash SHA256
48ec0783d0a2aaf4956102479ba4ddfe9f760066d00e1c5b7f022a084951dc73- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
WinIo64.sysSample 5 · HVCI FALSE
- MD5
f356d371ac517c6655f7321e34bde956- SHA1
036357ba2605bd0010e3549c7b37e466e415df2c- SHA256
be929ae99015fafa0ab55cb475035e8c1359db1b61e00507defc1919a3538385- Imphash
3547cd37c31cc9ec12dced85dc2b1f24- Authentihash MD5
2d21884ef1cef5af9cbb9a0909d02e28- Authentihash SHA1
8522bd30b4028c43b747c96665f60ab920f341ea- Authentihash SHA256
48ec0783d0a2aaf4956102479ba4ddfe9f760066d00e1c5b7f022a084951dc73- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create WinIo64 binPath=C:\windows\temp\WinIo64.sys type=kernel && sc.exe start WinIo64Elevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Will Dormann, fluffycats31 @wdormann, @fluffycats31