← Back to driver explorer
Driver intelligenceVulnerableVerified
ppa_x64.sys
ppa_x64.sys is a kernel driver by Remko Weijnen that provides physical memory access via the PhysicalMemory section object. The device name PhyMem indicates this is part of the PhyMem driver family, of which several variants are already tracked in LOLDrivers (phymem64.sys, Phymemx64.sys, phymem_ext64.sys). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
ppa_x64.sysSample 1 · HVCI FALSE
- MD5
9851c3d7aee98aa0d712c50e9ca20eb9- SHA1
513e8fc423ce2737843053852a0a672c43d2db9e- SHA256
988960e31a258ea71cf93a7791ae8c91c8cefb6ad8a50cdbd1b07f73b524aa61- Imphash
8e01c1742ba7ebcbb0d61dd1ca8a6e91- Authentihash MD5
a7c7afe04a23793de0fe3b0d99cc20bd- Authentihash SHA1
ce465a42be6f19ca8e99c23b78c42b6073c8b673- Authentihash SHA256
5721c075bfec3ce946b8a96a58551a765be294212eaf27e5ffd6b738baef57d3- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create ppa_x64 binPath=C:\windows\temp\ppa_x64.sys type=kernel && sc.exe start ppa_x64Elevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/315
- https://github.com/KeServiceDescriptorTable/vulnerable-drivers
- https://github.com/Haider303/trinity-2.0-lpe
- https://medium.com/@haider303mustafa/teaccess-sys-adv64drv-sys-phymem-sys-kaslr-bypass-to-system-token-theft-69441310b7f4
- https://github.com/magicsword-io/LOLDrivers/issues/395
Acknowledgement: @rainbowdynamix, @DbgPrint