MSRMapper

BYOVD Manual Mapper for Windows x64 · CVE-2025-8061

---

Overview

MSRMapper is a manual kernel driver mapper for Windows x64 that abuses CVE-2025-8061 in the vulnerable Lenovo driver LnvMSRIO.sys to perform a BYOVD (Bring Your Own Vulnerable Driver) attack.

The project maps a PE64 driver directly into kernel memory without using sc create or a service, and executes its DriverEntry in ring 0. The whole process relies on:

• MSR and physical memory read/write through LnvMSRIO.sys.
• Kernel symbol resolution via PDB files using DbgHelp.
• VA → PA translation through the SuperfetchPfnQuery class of NtQuerySystemInformation.
• Temporary LSTAR hijacking to execute ring-0 shellcode.
• Temporary NtAddAtom hooking to call kernel functions such as ExAllocatePoolWithTag, RtlCopyMemory, and DriverEntry.

Status: Tested on Windows 10 22H2 (OS Build 19045.6466). The driver is mapped successfully and DriverEntry returns STATUS_SUCCESS (0x0).

---

Features

• Manual PE64 mapping in kernel using ExAllocatePoolWithTag.
• Kernel symbol resolution (KiSystemCall64, NtAddAtom, etc.) by downloading PDBs from the Microsoft Symbol Server.
• VA → PA translation with Superfetch (NtQuerySystemInformation class 0x4F), without needing a custom page-table walker.
• MSR (LSTAR, FMASK) and physical memory read/write through LnvMSRIO.sys.
• Dynamically generated shellcode that:
  • Restores the original LSTAR.
  • Calls MmGetPhysicalAddress to obtain the PA of NtAddAtom.
  • Returns control to user mode via swapgs; sysret.
• Temporary NtAddAtom hook (12-byte ) to call arbitrary kernel functions.

---

How It Works

1. Initialization

• Opens \\.\WinMsrDev (service exposed by LnvMSRIO.sys).
• Gets the ntoskrnl base via EnumDeviceDrivers and validates it with LSTAR.
• Initializes PdbResolver to resolve kernel symbol RVAs.

2. Obtaining the PA of NtAddAtom

• Builds a shellcode that will run in ring 0 when LSTAR is hijacked.
• Writes the swapgs; iretq gadget into LSTAR.
• Prepares the stack with PrepareStack and enables AC=1 in user mode via EnableACUserMode.
• On syscall, the CPU jumps to the gadget, runs the shellcode, calls MmGetPhysicalAddress(NtAddAtom), and stores the PA in a user buffer.
• The shellcode restores LSTAR and returns to user mode with swapgs; sysret.

3. Driver Mapping

• Allocates non-paged pool with ExAllocatePoolWithTag (invoked through the temporary NtAddAtom hook).
• Copies the PE image into the pool with RtlCopyMemory.
• Applies relocations, resolves imports, and fixes the security cookie.
• Calls DriverEntry with DriverObject = NULL and RegistryPath = NULL.

4. Cleanup

• Restores the original bytes of NtAddAtom.
• Restores the original MSRs.
• Closes the vulnerable driver handle.

Requirements

• Windows 10/11 x64 (tested on 22H2).
• Visual Studio 2022 with:
  • Desktop development with C++.
  • MASM (Microsoft Macro Assembler) to build the .asm files.
• Windows SDK and WDK (if you need to build the payload driver).
• Vulnerable LnvMSRIO.sys (CVE-2025-8061) installed and the WinMsrDev service running.
• Administrator privileges.
• Internet access the first time to download Microsoft PDBs, or a local cache in C:\Symbols.
• CMake 3.20 or newer.

Build

This project uses CMake. To build from the command line:

1. Generate the Visual Studio 2022 solution:

   root@kitploit:~

   cmake -B build -G "Visual Studio 17 2022" -A x64
   

2. Build in Release mode:

   root@kitploit:~

   cmake --build build --config Release
   

The output binaries will be in build/bin/Release/ (or a similar path depending on the CMake configuration).

Alternatively, you can open the generated build/KernelLoader.sln in Visual Studio 2022 and build from there.

Make sure ShellcodeAsm.asm and EnableAC.asm are compiled with MASM. The provided CMakeLists.txt handles this automatically.

If you need to adjust the build configuration, edit CMakeLists.txt.

Usage

1. Install and start the LnvMSRIO.sys service:

   root@kitploit:~

   sc create WinMsrDev type= kernel binPath= C:\path\to\LnvMSRIO.sys
   sc start WinMsrDev
   

2. Run KernelLoader.exe as Administrator:

   root@kitploit:~

   KernelLoader.exe
   

3. To see the mapped driver's DbgPrint output, use DebugView (Sysinternals) as Administrator with:

   • Capture → Capture Kernel
   • Options → Enable Verbose Kernel Output
   • If necessary, adjust the filter at:
     root@kitploit:~

     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter
     

     by creating a DWORD named Default with value .

Notes

• The DBGHELP: ... - unmatched message that appears in some PdbResolver logs is cosmetic. The PDB is loaded at an artificial virtual base and SymFromName still works correctly. It does not affect symbol resolution.
• On Windows 11 24H2, EnumDeviceDrivers may return an incorrect base. This project calculates the real base with LSTAR - KiSystemCall64.
• The NtAddAtom hook is temporary and restored after each call. Still, use this only in controlled environments.
• The shellcode assumes SMEP/SMAP are enabled. They are temporarily disabled via CR4 and restored before returning to user mode.