
Proof-of-concept exploiting the Toshiba qiomem.sys driver to achieve arbitrary physical memory read/write from ring 3, with a companion writeup.
Arbitrary physical memory read/write using Toshiba qiomem.sys from ring 3 (only works upto 4GB physical addresses).
Driver is distributed via Microsoft Update Catalog. Other variants. Not listed on Microsoft Vulnerable Driver List, no previous CVE alloted.
first run acpi.exe to create the fake device and then main.exe. Writeup