3ware.sys - Clean (13/100) - DriverShield Analysis

Analysis of 3ware.sys: clean verdict, risk score 13/100. 0 YARA matches, 0/75 multi-engine detections. SHA256 537c7bf0dcc56757. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

3ware.sys - Analysis Report

DriverShield analyzed the Windows kernel driver 3ware.sys and assigned a verdict of Clean with a composite risk score of 13/100, indicating no notable risk signals (0-29 band).

VerdictClean (13/100)
YARA matches0
Multi-engine detections0 / 75
File size108464 bytes
Code-signing signerMicrosoft Windows
Analyzed2026-06-17
SHA256537c7bf0dcc56757ddb97d709fa65c1b3cbf9619563df9a13fa8287b71d9e8b5
SHA1633631c232753493319141af21d104816d7f5de4
MD588a7916db7d9b8fa202a03b1352a4959

Driver identity

Version resource data embedded in the 3ware.sys PE header, as extracted by the analysis engine.

File descriptionLSI 3ware SCSI Storport Driver
ProductLSI 3ware RAID Controller
CompanyLSI
File version5.01.00.051
CopyrightCopyright (c) 2011 LSI

How the 13/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

ComponentSub-score
Multi-engine consensus0 / 100
YARA signature matches0 / 100
Dangerous kernel imports0 / 100
IOCTL dispatch surface72 / 100
Known-vulnerable corpus0 / 100
Code-signing state80 / 100
Packing and entropy0 / 100
Dynamic behaviour0 / 100
CVE cross-reference0 / 100

Kernel imports (1)

Kernel-mode APIs resolved from the Import Address Table of 3ware.sys, ranked by exploitation relevance.

APIRiskWhy it matters
DbgPrintExlowStandard kernel API - generally benign

IOCTL dispatch codes (24)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

CodeSeverityTransferDescription
0x0080850FhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #323
0x0080840FhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #259
0x00803043highMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #3088
0x00808D8BhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #866
0x002200F0mediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #60
0x008003B9mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #238
0x008000B8mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #46
0x00802484mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2337
0x008000BEmediumMETHOD_OUT_DIRECTFILE_DEVICE_CUSTOM Function #47
0x008043E8mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #250
0x0080AF8DmediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #3043
0x008000BAmediumMETHOD_OUT_DIRECTFILE_DEVICE_CUSTOM Function #46
0x008002B8mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #174
0x008001B8mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #110
0x00803D15mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #3909
0x008007B8mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #494
0x0080B841mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #3600
0x008000B9mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #46
0x00804FE8mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #1018
0x002283F9mediumMETHOD_IN_DIRECTFILE_DEVICE_UNKNOWN Function #254
0x0022832AmediumMETHOD_OUT_DIRECTFILE_DEVICE_UNKNOWN Function #202
0x00801705mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #1473
0x0080C481mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #288
0x00340304mediumMETHOD_BUFFEREDFILE_DEVICE_DISK Function #193

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

SectionVirtual sizeRaw sizeEntropyFlags
.text0x13E8A0x140006.48CODE, EXEC, READ
.rdata0x19940x1A005.05IDATA, READ
.data0x09580x0A002.68IDATA, READ, WRITE
.pdata0x06E40x08004.32IDATA, READ
.idata0x04280x06003.3IDATA, READ
INIT0x00450x02001.1CODE, EXEC, READ, DISCARD
GFIDS0x00640x02000.88IDATA, READ, DISCARD
.rsrc0x05880x06004.69IDATA, READ, DISCARD
.reloc0x01940x02004.62IDATA, READ, DISCARD

Exploit mitigations

Control Flow GuardEnabled
ASLREnabled
DEPEnabled
Integrity checkNot enforced
Mitigation score85 / 100

MITRE ATT&CK techniques (3)

Techniques this driver could enable if loaded by an adversary.

IDTechniqueTactic
T1071Application Layer ProtocolCommand and Control
T1543.003Windows ServicePersistence
T1652Device Driver DiscoveryDiscovery

Code-signing chain

SignerMicrosoft Windows
Signer organisationMicrosoft Corporation
IssuerMicrosoft Windows Production PCA 2011
Serial330000045FF3C96C1A7FF7DA1D00000000045F
Valid from2023-11-16 19:20 UTC
Valid until2024-11-14 19:20 UTC (expired)
Signature validityNot verified

Symbolic execution

Engine angr, status completed, 28 paths explored at a maximum depth of 28. Vulnerability classes reached: 0. Exploitable paths: 0.

Frequently asked questions about 3ware.sys

Is 3ware.sys safe?

Based on DriverShield static and dynamic analysis, 3ware.sys is assessed as clean, with no notable risk signals. Its composite risk score is 13/100 (verdict: clean). Always validate findings independently before acting.

What is the risk score of 3ware.sys?

3ware.sys has a DriverShield composite risk score of 13/100, placing it in the clean verdict band. SHA256: 537c7bf0dcc56757ddb97d709fa65c1b3cbf9619563df9a13fa8287b71d9e8b5.

What is 3ware.sys?

3ware.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Microsoft Windows.

Related: Other drivers signed by Microsoft Windows · What an IOCTL dispatch code is · BYOVD research index · full driver database · CVE library · code signing atlas

DriverShield © 2025-2026 · Terms · Privacy · Contact