Personal Blog Home Page, Personal Blog Home Page

A technical walkthrough on reverse engineering IoCreateDriver and forging a complete DRIVER_OBJECT and DRIVER_EXTENSION for manually mapped drivers.

Modern EDR agents run as Protected Processes backed by tamper-protection flags, kernel callbacks, and watchdog services. For years this defensive stack held firm. Then came Bring Your Own Vulnerable Driver (BYOVD): load a legitimately signed driver from a hardware vendor, invoke a kernel-level process-kill primitive the EDR never expected to watch, and watch the agent terminate. No unsigned code. No DSE bypass. No alert fired. , blog-description

TL;DR

This was discoved with DeepZero Tracked as CVE-2026-13585. ASUS has published a vendor advisory with countermeasures. ASUS ships a kernel driver called bsitf.sys with their Business Manager and Software Manager. It creates a device at \\.\bsitf that requires admin to open. IOCTL 0x222808 takes a size from your input buffer, allocates that much physically contiguous kernel memory, maps it into your process, and gives you back the pointer AND the physical address. There’s no validation on the size, no limit on how many allocations you can make, and no input checking at all., A lightweight commenting system using GitHub issues.

How I built an AI pipeline with LangChain DeepAgents, Ghidra, and Semgrep that scans Windows kernel drivers and found a zero-day in ASUS., A lightweight commenting system using GitHub issues.

Parsing ntkrnlmp.pdb on the target to eliminate the need for static offsetting and thus safely and dynamically bypassing driver signature enforcement across multiple Windows 10 & 11 versions.

Malicious drivers are difficult to detect and successfully leveraging one can give an attacker full access to a system.

As the second entry in our “Exploring malicious Windows drivers” series, we will continue where the first left off: Discussing the I/O system and IRPs.

Cisco Talos is releasing a GDT file on GitHub that contains various definitions for functions and data types.

This blog provides an in-depth analysis of the malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems.

Here is a walkthrough of our solutions to two C/C++ security challenges from the new C/C++ chapter in the Testing Handbook: a Linux ping program with an `inet_ntoa` global buffer gotcha and command injection, and a Windows driver with registry type confusion bugs that can escalate from local DoS to a kernel write primitive. , Here is a walkthrough of our solutions to two C/C++ security challenges from the new C/C++ chapter in the Testing Handbook: a Linux ping program with an inet_ntoa global buffer gotcha and command injection, and a Windows driver with registry type confusion bugs that can escalate from local DoS to a kernel write primitive.

exploiting driver-based vulnerabilities

The KillChain exploit leverages a vulnerability in ProcessMonitorDriver.sys (CVE-2026-0828) by abusing an exposed IOCTL that allows a user-mode application to terminate arbitrary processes — including protected system services — effectively bypassing standard Windows security checks.

PoisonX is a Bring Your Own Vulnerable Driver (BYOVD) research tool that leverages a signed Microsoft kernel driver to terminate any Windows process — including PP (Protected Processes) and PPL (Protected Process Light) processes such as EDR/AV services.

The article analyzes a Microsoft-signed vulnerable driver used in a BYOVD attack to kill security processes. By sending crafted IOCTL requests with a target PID, attackers can terminate EDR services such as CrowdStrike Falcon.

Analysis of CVE-2024-30078, a Windows Wi-Fi driver vulnerability. Detailed root cause analysis and exploitation constraints.

In recent July Patch Tuesday Microsoft patched a vulnerability in the Microsoft Kernel driver appid.sys, which is the central driver behind AppLocker, the application whitelisting technology built into Windows.

In this exploit, the core technique here was hijacking a legitimate syscall (NtShutdownSystem) to act as a gate into arbitrary kernel exports. First, resolved the virtual address of a target kernel routine (PsGetCurrentProcess, DbgPrint, ExAllocatePoolWithTag, etc) by parsing the ntoskrnl export table. Then, temporaril

PPLShade - BYOVD tool for manipulating Windows Protected Process Light (PPL) protection at the kernel level.

Static analysis & exploitation-triage toolkit for Windows kernel drivers. Discover IOCTLs, Symbolic Links, and check cert , and Downlaods BYOVD - GitHub - 0xDbgMan/DrvEye: Static analysis & exploitation-triage toolkit for Windows kernel drivers. Discover IOCTLs, Symbolic Links, and check cert , and Downlaods BYOVD

Proof of Concepts code for Bring Your Own Vulnerable Driver techniques - GitHub - 0xJs/BYOVD_read_write_primitive: Proof of Concepts code for Bring Your Own Vulnerable Driver techniques

goLoL is a Windows host scanner with dual support for LOLBAS binaries and LOLDrivers. It lists LOLBAS techniques runnable at your current privilege level (with MITRE ATT&CK mappings) and can scan local .sys files for vulnerable/malicious LOLDrivers hash matches. - aaron-kidwell/goLoL

Contribute to Astharot15/DriverStuff development by creating an account on GitHub.

Windows driver vulnerability research scanner and interface validation toolkit - Bitwise-Security/DriverScope

BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055,). - BlackSnufkin/BYOVD

BYOVD hunter to help prioritize windows drivers worth manual analysis - BlackSnufkin/HolyGrail

Dump protected process memory by using BYOVD to tamper with handle objects in the kernel. - GitHub - ColeHouston/theHandler-BOF: Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.

Contribute to CyberSecurityUP/Offensive-Windows-Drivers-Development development by creating an account on GitHub.

Windows kernel-mode EDR agent for endpoint detection and response - EynaExp/MiMiNi-EDR

"Service-less" driver loading. Contribute to ioncodes/SilentLoad development by creating an account on GitHub.

DOG is a post-exploitation toolkit that uses your existing kernel read/write primitive to locate, classify, and chain kernel gadgets. - jsacco/DataOnlyGadget

Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths - klezVirus/DriverJack

A comprehensive collection of cheatsheets for reverse engineering, binary analysis, and assembly programming tools. This repository serves as a one-stop reference for security researchers, reverse engineers, and low-level programmers. - mohitmishra786/reversingBits

LPE / RCE Exploits for various vulnerable "Bloatware" products - bloatware-pwn/razerpwn at main · sensepost/bloatware-pwn

KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory - TheCruZ/kdmapper

Executing Kernel Routines via Syscall Table Hijack (Kernel Code Execution) - V-i-x-x/win11-kernel-execution-syscall-hijack

Fully undetectable and evasive ransomware written in Rust, leveraging a BYOVD technique to disable AV/EDR solutions on the infected systems. - xM0kht4r/VEN0m-Ransomware

Introduction In this blog we will walk through the exploitation of a Use-After-Free vulnerabiliy in a Windows Kernel Driver, we will learn about heap spraying techniques for Windows Kernel Pools, understand how to interact with Kernel Drivers and end up executing shellcode in Ring 0 by taking advantage of this Use-After-Free. The exploitation of this bug is not that complex, so it will serve as a great example for learning how to exploit classic UAF vulnerabilities in Kernel Drivers.

Bypassing Code Integrity Using BYOVD for Kernel R/W Primitives Welcome to this new Medium post, in this one we will explore a technique used in offensive security that allows us to bypass CI (Code …

Weaponizing BYOVD to Kill and Evade Windows Defender Welcome to this new Medium post, in which we look at the terminate process via Bring Your Own Vulnerable Driver (BYOVD) technique. This method …

BYOVD & Process Termination: Understanding The Pattern By Reversing TCVINProcTerm Driver Author — Sushant Mane LinkedIn — https://www.linkedin.com/in/sushantmmane/ Website — …

One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of the ASUS series is out, read it here. Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard for my PC. I was a little concerned about having a BIOS that would by default silently install software into my OS in the background. But it could be turned off so I figured I would just do that., One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of the ASUS series is out, read it here. Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard for my PC. I was a little concerned about having a BIOS that would by default silently install software into my OS in the background. But it could be turned off so I figured I would just do that.

BYOVD attacks (Bring Your Own Vulnerable Driver) have evolved into a serious threat in recent years. Attackers exploit legitimate but vulnerable kernel, Introduction BYOVD attacks (Bring Your Own Vulnerable Driver) have evolved into a serious threat in recent years. Attackers exploit legitimate but vulnerable kernel drivers to execute privileged operations on target systems. What matters here is not which drivers are regularly used on the system, but rather which drivers are supported—in other words, which drivers attackers

Latest Research by our Team

Introducing new binary vulnerability research tools and methodology, based on custom Ghidra plugins and Semgrep.

Methodology for reverse engineering Windows drivers, finding vulnerabilities and understanding their exploitability.

A double-free vulnerability occurs when a program frees the same memory block multiple times. This typically happens when ExFreePoolWithTag or ExFreePool is

Vulnerable kernel drivers are one of the most reliable stepping stones for privilege escalation and system compromise. Even when patched, many of these

High-Scale Driver Vulnerability Research with Agent Swarms

Diving into Use-After-Free explotation in the famous HackSys Extreme Vulnerable Driver (HEVD) to gain access to execute a gadget in order to escalate the attack vector to a shellcode, ROP chain..., Diving into Use-After-Free explotation in the famous HackSys Extreme Vulnerable Driver (HEVD) to gain access to execute a gadget in order to escalate the attack vector to a shellcode, ROP chain...

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube., Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.