Only the latest released version of OmenMon-Reborn receives security updates. Older releases are not patched — please upgrade before reporting any issue.

OmenMon-Reborn interfaces with kernel-mode drivers and HP's low-level Embedded Controller, so security issues here can have real impact — arbitrary EC writes, kernel-mode read primitives, privilege escalation chains. Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

You have two options:

1. GitHub private advisory (preferred): use the repository's "Report a vulnerability" button under the Security tab. This creates a private channel between you and the maintainer that GitHub can later convert into a published advisory once a fix is out.
2. Discord: DM vsun (835146076016607323). Please include the word "security" in your first message so it's not lost in the general support flow.

A useful report contains, at minimum:

• The OmenMon-Reborn version (OmenMon.exe -h shows it, or check the tray menu's "About" entry).
• Your Windows version (winver) and whether HVCI / Memory Integrity is on.
• Whether PawnIO is installed and what version (OmenMon.exe -Diag output covers all of this in one paste — see below).
• A description of the issue, ideally with a reproducer.
• The impact you believe it has (information disclosure, privilege escalation, denial of service, etc.).

For non-trivial reports, running OmenMon.exe -Diag and attaching the resulting OmenMon-Diag-*.md file gives the maintainer everything needed to triage without back-and-forth.

• Acknowledgement within a few days (this is a hobby project — I don't promise 24-hour response times, but I do read every message).
• A coordinated disclosure timeline once severity is established.
• Credit in the resulting release notes if you'd like it (anonymous reports are also welcome).

Things that are not security issues for this project:

• Windows Defender flagging older 1.3.x releases — that's the WinRing0 driver, and it's fixed in 1.4.0+ by switching to the Microsoft-signed PawnIO driver. Just upgrade.
• Bugs that require an already-administrative attacker to exploit — they already have everything OmenMon could give them.
• Crashes that produce a stack trace but no exploitable state. Please file those as regular bug reports.

OmenMon-Reborn is a hardware-control utility that talks to the Embedded Controller through the Microsoft-signed PawnIO driver. It does not ship its own kernel driver, does not connect to any network, does not inject into other processes, and does not modify system persistence. That said, heuristic anti-virus engines occasionally flag low-level hardware tools simply because the behaviour profile (IOCTLs, privileged access) overlaps with what some malware does.

The OmenMon.exe binary was submitted to Microsoft Security Intelligence and reviewed by a Microsoft analyst on 2026-05-21:

• Submission ID: 504e5120-8e6f-46c6-bf5f-da34a0176fca
• Result: "At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed."
• Public record: https://www.microsoft.com/wdsi/filesubmission/details/504e5120-8e6f-46c6-bf5f-da34a0176fca

The dynamic-signature detection was removed at Microsoft's end. New Defender clients will pick up the cleared determination automatically once they refresh their signature definitions.

An independent multi-engine scan of the binary submitted to Microsoft returned a clean result across all 76 antivirus engines queried:

• VirusTotal: https://www.virustotal.com/gui/file/21384a329e082b66bf12255c057e84fc8608a44785231ee58a9f0316bcdcf0d1
• Detections: 0 / 76
• SHA-256 (MAPS-submitted build): 21384a329e082b66bf12255c057e84fc8608a44785231ee58a9f0316bcdcf0d1

Each release on GitHub ships with a SHA256SUMS.txt asset alongside the .zip. The hash in that file is generated by the release CI pipeline, so it always matches the artifact you just downloaded — a new build always produces a new hash (the assembly's file version is stamped per build), so don't expect the hash to match across different versions or rebuilds.

On Windows (PowerShell):

Get-FileHash -Algorithm SHA256 .\OmenMon-v1.4.1-reborn-Release.zip

Compare the output against the line for that filename in SHA256SUMS.txt. If they match, the download is intact.

On Linux / WSL / Git Bash:

sha256sum -c SHA256SUMS.txt

The MAPS-submitted hash above is preserved here as the trust anchor for that specific binary. Future v1.4.x releases will have different hashes — verify each one against its own SHA256SUMS.txt.

A local Defender instance may have cached the old detection. To force it to drop the cache and pull the latest definitions:

1. Open Command Prompt as Administrator.
2. cd "C:\Program Files\Windows Defender"
3. MpCmdRun.exe -removedefinitions -dynamicsignatures
4. MpCmdRun.exe -SignatureUpdate

You should see "Dynamic Signature removal — Done!" followed by "Signature update finished." After this, the binary will not be flagged on this machine.

If a new heuristic detection appears in a future release, please open an issue with the exact Defender threat name (e.g. Trojan:Win32/…) and the OmenMon-Reborn version, so a fresh MAPS submission can be filed.

This policy covers the OmenMon-Reborn codebase and the embedded Resources/LpcACPIEC.bin PawnIO module redistribution. Issues in the upstream PawnIO driver itself should be reported to namazso/PawnIO directly.