Kernel Driver Utility

BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055,).

🤖 Kill The Protected Process 🤖

KslDump — Why bring your own knife when Defender already left one in the kitchen?

yet another AV killer tool using BYOVD

Windows rootkit designed to work with BYOVD exploits

「💀」Proof of concept on BYOVD attack

BYOVD hunter to help prioritize windows drivers worth manual analysis

Driver Reverse & Exploitation

DSE & PG bypass via BYOVD attack

vulnerable drivers for windows machines.

「⚠️」Performing a BYOVD on the truesight.sys driver

Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.

📟 a tiny code that performs kernel-mode read/write using CVE-2023-38817.

Some basic info, resources, and code snippets about windows kernel exploitation

A BYOVD technique abuse tool

Dump ntoskrnl.exe important offsets for building your navigation system in the Windows Kernel, using Radare2 and Rust

A simple PoC demonstrating the vulnerability in the ThrottleStop.sys driver, showcasing arbitrary physical memory read and write capabilities, as well as virtual-to-physical address translation using Superfetch.

abusing a vulnerable amd driver for elevating our process.

Go offensive-security research library — 15+ injection methods, AMSI/ETW/ntdll-unhook evasion, sleep mask (Ekko × XOR/RC4/AES), call-stack spoof, BYOVD (RTCore64) + kernel callback removal, LSASS dump + pure-Go MSV1_0 parser w/ PPL bypass, recon (sandbox/VM/debugger/dllhijack), PE ops (sRDI/BOF/CLR), Meterpreter C2, UAC bypass, CVE-2024-30088 LPE.