hwrwdrv.sys

hwrwdrv.sys is the kernel half of a hardware-tweaker utility that gives a user-mode program direct read and write access to physical memory and CPU model-specific registers. That is the same family of access primitive used by overclocking tools, BIOS utilities, and chipset diagnostics; in a lab it is useful, on a normal gaming PC it is mostly a liability.

The driver's provenance has two layers, both worth knowing about. The Authenticode signature on the public binary traces to a code-signing certificate issued to Shuttle Inc. (a long-standing hardware vendor). The National Vulnerability Database, however, attributes the vulnerable product itself to 'Nil Hardware Editor's Hardware Read and Write Utility' (CVE-2025-66678). The mismatch is a small reminder that a valid signature describes who paid for the cert, not always who built the tool that ships the driver.

The driver is on the LOLDrivers list (entry UUID e4609b54-cb25-4433-a75a-7a17f43cec00) and on Microsoft's Vulnerable Driver Blocklist.

If you find it on your system and you do not remember installing a hardware-tuning utility, uninstall whatever brought it in; the blocklist will keep the older signed build from loading.

hwrwdrv.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.