amdsata.sys - Clean (16/100) - DriverShield Analysis

Analysis of amdsata.sys: clean verdict, risk score 16/100. 0 YARA matches, 0/74 multi-engine detections. SHA256 25433299f63eb920. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

amdsata.sys - Analysis Report

DriverShield analyzed the Windows kernel driver amdsata.sys and assigned a verdict of Clean with a composite risk score of 16/100, indicating no notable risk signals (0-29 band).

VerdictClean (16/100)
YARA matches0
Multi-engine detections0 / 74
File size84400 bytes
Code-signing signerMicrosoft Windows
Analyzed2026-10-11
SHA25625433299f63eb920a6a74b0c1d40a95c7d9bc647ff5cd71d4f1730283b660e86
SHA18bee88eb11fe905d70b7d1e7374621be93be9507
MD54b7a08f908cabaa7a51e6fcae7fc431a

Driver identity

Version resource data embedded in the amdsata.sys PE header, as extracted by the analysis engine.

File descriptionAHCI 1.3 Device Driver
ProductAHCI 1.3 Device Driver
CompanyAdvanced Micro Devices
Original filenameamdsata.sys
Internal nameamdsata.sys
File version1.1.3.277 (NT.150223-1854)
CopyrightCopyright © 2008-2015 AMD, Inc.

How the 16/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

ComponentSub-score
Multi-engine consensus0 / 100
YARA signature matches0 / 100
Dangerous kernel imports0 / 100
IOCTL dispatch surface66 / 100
Known-vulnerable corpus0 / 100
Code-signing state80 / 100
Packing and entropy80 / 100
Dynamic behaviour0 / 100
CVE cross-reference0 / 100

IOCTL dispatch codes (22)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

CodeSeverityTransferDescription
0x00228303highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #192
0x0022B9D7highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #3701
0x00346083highMETHOD_NEITHERFILE_DEVICE_DISK Function #2080
0x00220123highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #72
0x002200F0mediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #60
0x00808689mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #418
0x00808589mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #354
0x0080818AmediumMETHOD_OUT_DIRECTFILE_DEVICE_CUSTOM Function #98
0x0022830CmediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #195
0x00802515mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #2373
0x00809705mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #1473
0x0080FB05mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #3777
0x00806B05mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #2753
0x00800F3DmediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #975
0x008000B9mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #46
0x0080BA38mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #3726
0x008000BAmediumMETHOD_OUT_DIRECTFILE_DEVICE_CUSTOM Function #46
0x0080EA81mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #2720
0x0080249CmediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2343
0x00340305mediumMETHOD_IN_DIRECTFILE_DEVICE_DISK Function #193
0x00345415mediumMETHOD_IN_DIRECTFILE_DEVICE_DISK Function #1285
0x00340340mediumMETHOD_BUFFEREDFILE_DEVICE_DISK Function #208

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

SectionVirtual sizeRaw sizeEntropyFlags
.text0xE6FA0xE8006.5CODE, EXEC, READ
.rdata0x08D40x0A004.67IDATA, READ
.data0x6E500x06003.28IDATA, READ, WRITE
.pdata0x04680x06003.72IDATA, READ
.idata0x04500x06003.41IDATA, READ
INIT0x01290x02003.8CODE, EXEC, READ, DISCARD
GFIDS0x00980x02001.3IDATA, READ, DISCARD
.rsrc0x15400x16007.15IDATA, READ, DISCARD
.reloc0x00300x02000.54IDATA, READ, DISCARD

Exploit mitigations

Control Flow GuardEnabled
ASLREnabled
DEPEnabled
Integrity checkNot enforced
Mitigation score85 / 100

MITRE ATT&CK techniques (3)

Techniques this driver could enable if loaded by an adversary.

IDTechniqueTactic
T1071Application Layer ProtocolCommand and Control
T1543.003Windows ServicePersistence
T1652Device Driver DiscoveryDiscovery

Code-signing chain

SignerMicrosoft Windows
Signer organisationMicrosoft Corporation
IssuerMicrosoft Windows Production PCA 2011
Serial330000045FF3C96C1A7FF7DA1D00000000045F
Valid from2023-11-16 19:20 UTC
Valid until2024-11-14 19:20 UTC (expired)
Signature validityNot verified

Symbolic execution

Engine angr, status completed, 20 paths explored at a maximum depth of 20. Vulnerability classes reached: 0. Exploitable paths: 0.

Frequently asked questions about amdsata.sys

Is amdsata.sys safe?

Based on DriverShield static and dynamic analysis, amdsata.sys is assessed as clean, with no notable risk signals. Its composite risk score is 16/100 (verdict: clean). Always validate findings independently before acting.

What is the risk score of amdsata.sys?

amdsata.sys has a DriverShield composite risk score of 16/100, placing it in the clean verdict band. SHA256: 25433299f63eb920a6a74b0c1d40a95c7d9bc647ff5cd71d4f1730283b660e86.

What is amdsata.sys?

amdsata.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Microsoft Windows.

Related: Other drivers signed by Microsoft Windows · What an IOCTL dispatch code is · BYOVD research index · full driver database · CVE library · code signing atlas

DriverShield © 2025-2026 · Terms · Privacy · Contact