Low Severity
CVE-2025-7771
Published: Nov 3, 2026
PoC for CVE-2025-7771: abuses ThrottleStop.sys for arbitrary physical r/w, turns DSE off, then spoofs the integrity query so it still reports as enabled.
# CiGaslight
abuses [CVE-2025-7771](https://www.cve.org/CVERecord?id=CVE-2025-7771) to turn DSE off, then makes the integrity query lie about it so nothing notices.
## disclaimer
This was tested on windows 10 22H2!
## requirements
win10/11 x64, vs2022 (v143 is already set in the project). admin, the manifest asks for it. and `ThrottleStop.sys` sitting next to the exe, you can find which build on loldrivers, link at the bottom.
## run
build the sln, it drops the exe in `bin/`, put the sys in there too and run it. it tells you what it's doing as it goes and either ends with `SPOOF OK` or tells you where it died. the service gets deleted either way, i'm not leaving a kernel service pointing at a file i might move.
## logic
- gets ntoskrnl and ci.dll bases from `SystemModuleInformation`, pulls their pdb off msdl and lets dbghelp resolve what it needs. no hardcoded offsets, i got tired of redoing them every patch tuesday.
- builds a va->pa map out of the superfetch pfn query so it can translate kernel addresses by itself. falls back to `MmGetPhysicalAddress` if a page isn't in the map, which happens.
- patches the first 12 bytes of `NtAddAtom` to jump to whatever kernel function it wants, calls NtAddAtom normally from usermode, puts the bytes back. that's how the stub page gets allocated. racy, 12 bytes, works.
- zeroes the real `g_CiOptions`. at this point DSE is genuinely off and unsigned stuff loads.
- repoints `SeCiCallbacks.QueryInformation` at the stub, which answers `{Length = 8, CodeIntegrityOptions = 0x4001}` instead of 0. stub also returns the correct error codes for bad buffers and null pointers, otherwise it's obviously a stub.
- calls the normal api to check. if it's not 0x4001 it fails out loud.
so `g_CiOptions` is 0 and everyone who asks gets told 0x4001. that's the whole trick.
## output
```
[+] Driver loaded: C:\...\bin\ThrottleStop.sys
[+] NtAddAtom = 0xFFFFF805...
[+] ExAllocatePoolWithTag = 0xFFFFF805...
[+] M