WinRing0

lastmod 2025-04-22created 2025-04-221 edits

WinRing0 is a hardware access library for Windows.

Why Windows started flagging various PC monitoring apps as malware

Operating systems use a "protection ring" structure to protect the system. There are rings 0 through 3, but modern OSes use only 0 and 3.
Ring 0 is kernel space, with unrestricted direct access to every part of the computer, including hardware, memory, and CPU registers.
Ring 3 is application space, where all ordinary applications except system software run.
Outer rings cannot see inner rings, and a device driver is needed to access kernel space from application space.

As competition in the PC peripheral market intensified, manufacturers increasingly bundled dedicated software to differentiate their features.
- For example, a CPU cooler can directly control fan speed based on CPU temperature, and this can be configured through software.
Many hardware devices are designed to communicate with the operating system through a protocol called SMBus (System Management Bus).
However, SMBus cannot be accessed at the application level; it is accessible only through a device driver.

Controlling hardware through SMBus requires a kernel-mode driver running on ring 0.
Because kernel-mode drivers require a high level of security, they must have an EV (Extended Validation) digital signature, and the process requires Microsoft to review and digitally sign the driver itself.
Since this process is demanding and costly, peripheral manufacturers began bypassing it through WinRing0.
WinRing0 is a driver and library developed in 2007 by Miyazaki Noriyuki, the creator of CrystalDiskMark, that exposes various parts residing in ring 0 to the application layer.
Peripheral manufacturers built software that controls hardware by accessing ring 0 directly from the application layer through WinRing0.
WinRing0 appears to have been digitally signed through cross-signing before Windows tightened its driver certification process.
The author stated that WinRing0 was made as a kind of toy project for exploring low-level programming, but as it kept being used in real products, he recommended against using it any further in 2010 and stopped development.
However, being open source, it continued to be distributed and used in many places even after the developer stopped maintaining it.

Since the purpose of WinRing0 is to expose areas that the kernel should manage directly to the application layer, it effectively neutralizes the fundamental security of the OS, and concerns have been raised about this.
Several CVEs have been registered in this regard (CVE-2019-6333, CVE-2020-14979, CVE-2021-44901)
Real attacks have also been found, such as the "SteelFox" malware, known to have stolen credit card numbers, browsing history, browser cookies, and more, which exploited it.
Not only software that uses WinRing0 directly but also countless programs that depend on WinRing0 indirectly through OpenHardwareMonitor (https://github.com/openhardwaremonitor/openhardwaremonitor) and LibreHardwareMonitor (https://github.com/LibreHardwareMonitor/LibreHardwareMonitor) are affected.
- Because HP's Touchpoint Analytics software used OpenHardwareMonitor, every HP laptop on the market in 2019 was affected.
On March 11, 2025, Microsoft blocked all WinRing0 drivers.

author Zer0 sitemap