BYOVD-Research

Overview This is an older driver that was recently exploited in a BYOVD campaign detailed here: https://www.bleepingcomputer.com/news/security/edr-killer-tool-uses-signed-kernel-driver-from-forensic-software/ The exploit path is as follows: 1. The attacker's program runs as admin and gets its own...

BYOVD

EnPortv-Killer PoC for vulnerability in EnPortv driver from EnCase As of 2026-07-10, the driver is listed onLOLDDrivers but remains absent from Microsoft's recommended driver block rules as of 2026-07-10 Built on byovd-lib -- implements the DriverConfig trait and delegates the full BYOVD flow to...

CVE-2026-29923

CVE-2026-29923 - Local Privilege Escalation Attack via pstrip64.sys Disclaimer: This code is provided for educational and defensive research purposes only. It was written to further the understanding of kernel exploitation and help defenders protect against similar vulnerabilities. Any...

STProcessMonitorBYOVD

STProcessMonitorBYOVD Reference: https://bbs.kafan.cn/thread-2288675-1-1.html Usage: 1. Place the vulnerable driver under the same directory of the exe. The version 11.11.4.0 the older one is with CVE-2025-70795 / CVE-2026-0828, compatible with the parameter /Kill; The version 11.26.18 Updated is...

GhostDriver

GhostDriver 👻 About GhostDriver is a Rust-built AV killer tool using BYOVD. Get Started 1. Install Rust from rust-lang.org 2. Clone: git clone https://github.com/BlackSnufkin/GhostDriver.git 3. Build: cargo build --release --target=x8664-pc-windows-msvc 4. Run: Execute the GhostDriver binary Usag...

0xCr0ssCrush

0xCr0ssCrush Two signed drivers. One dangerous kernel primitive. 0xCr0ssCrush is a Windows BYOVD research project covering the DCRCVDrv.sys and Alinubx.sys drivers abused by the Cruciferra malware-as-a-service loader: their interfaces, their kernel primitives, their provenance, and how to detect...

NSecSoftBYOVD

NSecSoftBYOVD Update 2026.1.13: The vulnerbility has been assigned the number CVE-2025-68947 Reference: https://bbs.kafan.cn/thread-2284992-1-1.html, https://blog.csdn.net/qq40827990/article/details/148997201 Same techniques are widely used by Silverfox Group to terminate AV processes BYOVD Usage...

CVE-2025-24990_POC

Windows Agere Modem Driver ltmdm64.sys. This driver is very old and is not loaded by default on my test machine, so I will exploit it in a BYOVD scenario. Interestingly, according to my research this driver has existed on Windows 7 and has at least one bug. here At that time, MSRC didn't take any...

NovaHypervisor

NovaHypervisor Description NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks either via Bring Your Own Vulnerable Driver BYOVD or other means by safeguarding defense products AntiVirus / Endpoint Protection and kerne...

cheat-engine-undetectable

Cheat Engine Undetectable Academic Research Edition — Modified Cheat Engine with multi-tiered anti-cheat evasion for cybersecurity education and university-level reverse engineering research. Disclaimer: This project is exclusively for academic research, university coursework, and cybersecurity...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. 🚨 Tested on Windows 11 Pro 24H2. Fully undetectable as ...

HITCON-2023-Demo-CVE-2023-20562

HITCON 2023 Demo CVE-2023-20562 Description This demonstration took place at HITCON 2023 in Taiwan. The demo highlights the exploitation of AMDCpuProfiler.sys within AMD μProf. By triggering an arbitrary write on the EPROCESS token, privilege escalation to SYSTEM level is achieved. Disabling the...

KslKatzBof

KslKatzBOF A Beacon Object File BOF in-line LSASS credential extraction from C2 using the KslD.sys BYOVD technique. This project is based on the blog post: https://avantguard.io/blog/erfahrungsbericht-ki-gest%C3%BCtzte-bof-entwicklung-im-red-team Attribution This BOF is based on KslKatz Maximilia...

0xKern3lCrush

0xKern3lCrush Windows BYOVD research on two real cases: the Safetica ProcessMonitorDriver CVE-2026-0828 and the ThrottleStop driver abused by MedusaLocker CVE-2025-7771. The repository documents the exposed interfaces, the privileged outcome each one reaches, and how to detect the abuse. It ships...

WinDefenderKiller

WinDefenderKiller PermanentDisablefromRegistry C++ Code for Permanently Disabling Windows Defender via Registry Keys Just compile and execute it! And when i restart it: BYOVDWindowsDefenderKiller This module implements a BYOVD Bring Your Own Vulnerable Driver technique to disable Windows Defender...

NimBlackout

NimBlackout Note : This project is for educational purposes only. The use of this code for any malicious activity is strictly prohibited. I am not responsible for any misuse of this software. NimBlackout is an adaptation of the @Blackout project originally developed in C++ by @ZeroMemoryEx, which...

MSRMapper

MSRMapper BYOVD Manual Mapper for Windows x64 · CVE-2025-8061 Overview MSRMapper is a manual kernel driver mapper for Windows x64 that abuses CVE-2025-8061 in the vulnerable Lenovo driver LnvMSRIO.sys to perform a BYOVD Bring Your Own Vulnerable Driver attack. The project maps a PE64 driver...

bdapiutil-bydov

BdApiUtil64.sys BYOVD C++ demonstration tool for Windows that interacts with the BdApiUtil device via DeviceIoControl and a specific IOCTL to request the termination of a process. Requirements 64-bit Windows 10/11 Visual Studio / MSVC BdApiUtil64.sys driver loaded and accessible Administrative...

SharpBlackout

SharpBlackout Terminate AV/EDR leveraging BYOVD attack Note: This project is for educational purposes only. Sharpblackout is an adaptation of the @Blackout project originally developed in C++ by @ZeroMemoryEx, which consists of removing AV/EDRs using the gmer BYOVD driver. Just wanted to try maki...

HolyGrail

HolyGrail A BYOVD hunter for finding the HolyGrail driver - Windows drivers suitable for BYOVD. Install git clone https://github.com/BlackSnufkin/HolyGrail cd HolyGrail cargo build --release Quick start HolyGrail.exe -d "C:\path\to\driver.sys" Add JSON output, custom output dir, and policy dir if...