Driver intelligenceVulnerableVerified

CardIo64.sys

CardIo64.sys is a kernel driver from ICP DAS Co., LTD. (Taiwan), an industrial automation and I/O board manufacturer. The driver exposes arbitrary physical memory read/write via MmMapIoSpace, port I/O read/write (8/16/32-bit), and PCI bus data read/write via HalGetBusDataByOffset and HalSetBusDataByOffset. The driver is only 13KB and is also available in the KeServiceDescriptorTable/vulnerable-drivers repository on GitHub.

UUID / 97e3077a-ca57-4f45-ba7c-f63dc9c4ea32ADDED / 2026-04-13AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

CardIo64.sysSample 1 · HVCI FALSE

MD5: 8dc4fc2f7b2ab7c22aab5a71c90c5f1b
SHA1: ec38aa86ce7f39fb8945002ec9839ad55c968b07
SHA256: 8a6265d23d30d6c4c7e159624686de6dbf2ccb86a421b0f45510005f7a40cd1a
Imphash: 60a339aa0d778dc179bb8a51c983cd31
Authentihash MD5: 7d24b09082567fa8ab363195d881d582
Authentihash SHA1: ec495d2d4e13564ad545e668e5e4c19696d79846
Authentihash SHA256: d2210fe09378b142d1bfc6034cf9e37cbe389bbd55d866a037b936a3fb49cae6
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create CardIo binPath=C:\windows\temp\CardIo64.sys type=kernel && sc.exe start CardIo

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint