kgameprotect.sys

kgameprotect.sys exposes FILE_ANY_ACCESS IOCTL 0x222048 through \\.\kgameprotect. The handler accepts a caller-selected PID and opens that process from KernelMode with PROCESS_TERMINATE before calling ZwTerminateProcess. It performs no caller, registered-client, or target-PID authorization on this IOCTL branch. The reviewed sample is version 2.7.1.7 and also registers a file-system minifilter, so correct minifilter installation is required. Static review confirms the process-termination path, but does not establish that unprivileged users can open the device or that protected processes can be terminated on every Windows configuration.