ksophon_x64.sys

KSophon_x64.sys is an earlier build of the anti-cheat kernel driver shipped with Tower of Fantasy, the free-to-play MMO from Hotta Studio (published by Perfect World). Later builds of the same driver ship under the name GameDriverX64.sys; the two are the same family, doing the kind of low-level kernel monitoring competitive games rely on to detect injection and tampering. Earlier versions were packed with VMProtect.

It is on the public LOLDrivers list. The access-control weakness in this driver family, in which an IOCTL handler accepts process-termination requests from any local user without validation, is tracked publicly as CVE-2025-61155, filed under the later GameDriverX64.sys name. In its disclosed form it is a denial-of-service primitive: any unprivileged process can terminate any other process by PID.

A quirk players have documented is that the driver can stay registered as a kernel service and keep loading at boot after the game itself is uninstalled, the same pattern as the HoYoverse mhyprot family, in some cases surfacing as a blue screen after removal.

Its presence on a gaming PC almost always means Tower of Fantasy is or was installed. If you have removed the game, check Windows services for a leftover driver entry and follow the game's full-uninstall steps to clear it.

ksophon_x64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.