cpqsysio64.sys
cpqsysio64.sys is a Hewlett-Packard physical-memory driver distributed with ProLiant support and firmware utilities. The tracked 4.5.0.0 and 4.6.0.0 builds handle IOCTL 0x152EF0 by accepting a caller-supplied physical address and length, mapping that range with MmMapIoSpace, and copying from it without constraining the requested physical range. An administrator with device access can read arbitrary physical memory, disclose kernel-sensitive data, and recover addresses that undermine kernel address randomization.
Known samples 2
0 recorded TRUE · 1 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
cpqsysio64.sysSample 1 · HVCI FALSE
- MD5
cb7bc352e0a7531faec48de1dbd8a9a1- SHA1
e17fa2e3ca1d59e2dd8ddbc1020d77bb3b7156d0- SHA256
4024b090cebcabaab884c84ec80ffb15622d12632f236383a9b0a470bff9fe33- Imphash
f1073c0b639c62ba91cae90672cb0e70- Authentihash MD5
31367d4a4da21693461a6c44fdb2f7c9- Authentihash SHA1
71d58e66eaabce2cdb592922afa6101106f4cb09- Authentihash SHA256
2b4eb3695b6f7c991019d9fe7469a99fd4e73242c42b675dc40741084b8e08d3- Machine
- AMD64
- Version
- 4.5.0.0
- Publisher
- Hewlett-Packard
cpqsysio64.sysSample 2 · HVCI unknown
- MD5
710a33afa08c0a5f43bb77055a3d4240- SHA1
11fdd809146244ff0e95bfcaebf819e3799b2953- SHA256
7aff3ecf106289c4d721e7613f83f817f52114c3e89891dc5b2a728b2fc26818- Imphash
b7ee6448b88d46e031b200004f350069- Authentihash MD5
ccf6564241424ff845382dfcaa19e797- Authentihash SHA1
55b1bc7bce839f896d783b9885acb75a5370086b- Authentihash SHA256
6dac3c94cffbd08956eb3654be9bdddb47c5fc6cb5fe8177f2ced1246c8c59cb- Machine
- AMD64
- Version
- 4.6.0.0
- Publisher
- Hewlett Packard Enterprise
Recorded command
sc.exe create cpqsysio binPath=C:\windows\temp\cpqsysio64.sys type=kernel && sc.exe start cpqsysioRead arbitrary physical memory · Privileges: Administrator · OS: Windows 10
Research & references
Acknowledgement: rainbowdynamix, DbgPrint, fluffycats31 @rainbowdynamix, @DbgPrint, @fluffycats31