← Back to driver explorer
Driver intelligenceVulnerableVerified
AsrCDDrv.sys
AsrCDDrv.sys is a kernel driver from ASRock Incorporation that exposes control register read/write (cr0, cr2, cr3, cr4, cr8), arbitrary MSR read/write, arbitrary physical memory read/write via MmMapIoSpace, contiguous memory allocation/free via MmAllocateContiguousMemorySpecifyCache, and I/O port read/write (8/16/32-bit). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
AsrCDDrv.sysSample 1 · HVCI FALSE
- MD5
7ee002414a5fa3650d418ebde92e528d- SHA1
554c4784bafef107fc64c170c073af85b8e8b85a- SHA256
04cc7df4077e36199b04afa39204c8f568f7f66f045e73010fb9b7685324442f- Imphash
57c7a5afa78ef66662909df8a27a1455- Authentihash MD5
7ff3d0c2e1fc70b8ab22c7632f12a116- Authentihash SHA1
f0378e4b642a435804a8bc9c4f2560d5a19eb2a7- Authentihash SHA256
550ce92e71808dc6b7fc5cba903c57f761816d35b2e76b4230cb6de6c540fce6- Machine
- AMD64
- Version
- 1.00.00.0000 built by: WinDDK
- Publisher
- ASRock Incorporation
Recorded command
sc.exe create AsrCDDrv binPath=C:\windows\temp\AsrCDDrv.sys type=kernel && sc.exe start AsrCDDrvElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: @rainbowdynamix, @DbgPrint