windows verified high v1.0.0

SIVX64.sys

Ray Hinchliffe SIV (System Information Viewer) SIVX64.sys v5.85 dynamically resolves MmMapIoSpace and MmMapIoSpaceEx via MmGetSystemRoutineAddress at runtime (neither appears in the IAT), evading static import-based scanning. The driver exposes multiple privileged IOCTL primitives via \\.\SIVDRIVER including arbitrary physical memory mapped read/write (Cmd 0x14, critical), physical memory read via scatter-gather (Cmd 0x10) and bulk MDL (Cmd 0x13), MSR read/write on a whitelisted subset (Cmd 0...

📋 Live Preview 
sc.exe create SIVDRIVER binPath=C:\windows\temp\SIVX64.sys type=kernel && sc.exe start SIVDRIVER
sc.exe create SIVDRIVER binPath=C:\windows\temp\SIVX64.sys type=kernel && sc.exe start SIVDRIVER

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilegeescalation.kernel-exploit

Documentation

examples:

  • description: "Load the kernel driver" command: "sc.exe create SIVDRIVER binPath=C:\\windows\\temp\\SIVX64.sys type=kernel && sc.exe start SIVDRIVER"
  • description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver SIVX64.sys"

SIVX64.sys

Ray Hinchliffe SIV (System Information Viewer) SIVX64.sys v5.85 dynamically resolves MmMapIoSpace and MmMapIoSpaceEx via MmGetSystemRoutineAddress at runtime (neither appears in the IAT), evading static import-based scanning. The driver exposes multiple privileged IOCTL primitives via \.\SIVDRIVER including arbitrary physical memory mapped read/write (Cmd 0x14, critical), physical memory read via scatter-gather (Cmd 0x10) and bulk MDL (Cmd 0x13), MSR read/write on a whitelisted subset (Cmd 0x08/0x0C), unrestricted I/O port read/scan (Cmd 0x44/0x50), and unrestricted PCI configuration space read (Cmd 0x48). WHQL signed by Microsoft Windows Hardware Compatibility Publisher; loads despite HVCI.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References