Arbitrary Process Termination in Tower of Fantasy GameDriverX64.sys

This repository is a real exploit/advisory package for CVE-2025-61155, a local Windows BYOVD vulnerability in the signed Tower of Fantasy anti-cheat driver GameDriverX64.sys (affected versions <= 7.23.4.7). The repo is not framework-based; its main executable artifact is poc/poc.cpp, while the rest of the repository is documentation, detection content, mitigation guidance, and IOC material. Repository structure: 16 files total. The only exploit code is poc/poc.cpp (C++). Detection content includes detection/cve-2025-61155.yar and detection/iocs.md. Extensive markdown documentation explains reverse engineering, exploitation, detection, mitigation, and in-the-wild abuse. The vulnerable driver binary itself is intentionally not included; sample/SAMPLE.md documents its hashes, signer, and provenance. Exploit capability: the PoC performs arbitrary local process termination by abusing the driver's weak access controls. It first loads DLLs named QmGUI.dll, QmGUI4.dll, and gameuirender.dll to satisfy the driver's filename-only IRP_MJ_CREATE verification. It then opens the device \\.\HtAntiCheatDriver and sends DeviceIoControl with IOCTL 0x222040 and an 8-byte structure containing magic 0xFA123456 and a target PID. According to the included reverse-engineering notes, the driver then calls ZwOpenProcess(GENERIC_ALL) and ZwTerminateProcess in kernel context, allowing termination of arbitrary processes, including PPL-protected AV/EDR services. The PoC defaults to targeting notepad.exe, but the primitive is clearly an EDR-killer when pointed at security products. Attack vector: strictly local. The exploit does not expose remote networking behavior and does not contact C2 or external services. Its success depends on the vulnerable driver already being installed/loaded on the host. The documentation also notes in-the-wild abuse where threat actors rename the driver to UpdateCheckerX64.sys and package it in tooling such as polers.dll. Notable fingerprintable artifacts extracted from the repo include the device paths \\.\HtAntiCheatDriver, \Device\HtAntiCheatDriver, and \??\HtAntiCheatDriver; the verification DLL names QmGUI.dll, QmGUI4.dll, and gameuirender.dll; the vulnerable driver names GameDriverX64.sys and UpdateCheckerX64.sys; the leaked PDB path E:\PWRD\AntiCheatGit\HtDriver2.0_maomx\output\x64_Release\PwrdDriver\app\PwrdDriver.pdb; the vulnerable IOCTL 0x222040; and the magic constant 0xFA123456. Overall, this is an operational PoC with a basic hardcoded payload rather than a fully weaponized framework.

This repository is a real exploit-focused research repo for CVE-2025-61155, not just a README. It documents and demonstrates a local BYOVD-style abuse path in the signed Windows anti-cheat driver GameDriverX64.sys used by Tower of Fantasy. The core exploit capability is arbitrary process termination from kernel context: an unprivileged local process can satisfy the driver's weak create-time gate by loading any DLL named QmGUI.dll, QmGUI4.dll, or gameuirender.dll, then open the exposed device \\.\HtAntiCheatDriver and send IOCTL 0x222040 with an 8-byte buffer containing magic 0xFA123456 and a target PID. The driver then performs ZwOpenProcess(GENERIC_ALL) and ZwTerminateProcess in kernel mode, allowing termination of arbitrary processes including protected AV/EDR services. Repository structure is primarily documentation-heavy, with one actual PoC source file and one YARA detection ruleset. Key files are: poc/poc.cpp (minimal C++ PoC and main entry point), advisory.md (formal advisory), docs/01-technical-analysis.md (reverse-engineering teardown of the driver internals and exploit chain), docs/02-exploitation.md (walkthrough of the abuse flow), docs/03-detection.md and detection/* (YARA and IOC content), docs/04-mitigation.md (blocklist/WDAC guidance), and docs/05-in-the-wild.md (threat-actor usage context). The vulnerable driver binary itself is intentionally omitted; sample/SAMPLE.md provides hashes, signer, and provenance instead. The PoC is operational but basic rather than weaponized: it defaults to targeting notepad.exe, uses hardcoded constants, and does not include driver installation or advanced targeting logic. Still, it clearly demonstrates the exploit chain and the main offensive outcome: local disabling of security tooling via a vulnerable signed driver already reported as abused in the wild.