EfiGuard

概述 EfiGuard 是一款便携式 x64 UEFI 启动工具包（bootkit），可在启动时修补 Windows 启动管理器、启动加载器和内核，以禁用 PatchGuard 和驱动程序签名强制（DSE）。 如果你只是想尝试 EfiGuard，请跳到使用。 功能特性 目前支持自 Vista SP1 至 Windows 11 所有已发布的与 EFI 兼容的 Windows x64 版本。 易于使用：可通过 U 盘或 Windows EFI 分区启动，加载器会自动查找并启动 Windows。驱动程序也可通过 UEFI Shell 或加载器手动加载和配置。 大量使用 Zydis...

AndroidDriveSignity

AndroidDriveSignity AndroidDriveSignity es un script de Python diseñado para parchear archivos del kernel de AndroidARMv8.3, lo que permite cargar controladores sin estar sujetos a diversas comprobaciones de verificación, específicamente las verificaciones de firma. Esta herramienta tiene como...

Stryker

Stryker 基于 CPU-Z CVE-2017-15303 的多用途概念验证工具 系统要求 x64 Windows 7/8/8.1/10； Stryker 仅适用于 x64 Windows； 需要管理员权限。 特性 驱动签名强制覆盖器（类似于 DSEFIx）； 通过修改进程对象实现受保护进程劫持； 用于绕过驱动签名强制的驱动加载器（类似于 TDL）。 使用方法 STRYKER -dse on | off STRYKER -prot 进程ID（进程ID以十进制形式提供） STRYKER -load 文件名 -dse - 关闭/开启驱动签名强制（功能类似于 DSEFix）； -prot ...

DSE-Patcher

DSE-Patcher https://www.codeproject.com/Articles/5348168/Disable-Driver-Signature-Enforcement-with-DSE-Patc...

CVE-2026-21709

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement...

EUVD-2026-23438

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement...

CVE-2026-21709

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement...

CVE-2026-21709

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement...

CVE-2026-21709

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement...

CVE-2026-21709

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement...

PT-2026-33497

Name of the Vulnerable Software and Affected Versions Microsoft-signed third-party bootloader affected versions not specified Description A security-feature bypass allows attackers to affect the system. A Microsoft-signed third-party bootloader completely skips signature verification when loading...

Researchers Uncover OS Downgrade Vulnerability Targeting Microsoft Windows Kernel

A new attack technique could be used to bypass Microsoft's Driver Signature Enforcement DSE on fully patched Windows systems, leading to operating system OS downgrade attacks. "This bypass allows loading unsigned kernel drivers, enabling attackers to deploy custom rootkits that can neutralize...

CVE-2023-20568

Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch RadeonInstaller.exe without validating the file signature potentially leading to arbitrary code execution...

New WinTapix.sys Malware Engages in Multi-Stage Attack Across Middle East

An unknown threat actor has been observed leveraging a malicious Windows kernel driver in attacks likely targeting the Middle East since at least May 2020. Fortinet Fortiguard Labs, which dubbed the artifact WINTAPIX WinTapix.sys, attributed the malware with low confidence to an Iranian threat...

PT-2022-26221

Name of the Vulnerable Software and Affected Versions Zemana AntiMalware version 3.2.28 Watchdog Anti-Malware version 4.1.422 Description The issue allows for arbitrary code injection, which can be exploited to execute code in kernel mode. This can lead to disabling mandatory driver signature...

Exploit for Code Injection in Watchdog Anti-Virus

CVE-2022-42045 Summary We discovered an Arbitrary code in...

Researchers Discover UEFI Bootkit Targeting Windows Computers Since 2012

Cybersecurity researchers on Tuesday revealed details of a previously undocumented UEFI Unified Extensible Firmware Interface bootkit that has been put to use by threat actors to backdoor Windows systems as early as 2012 by modifying a legitimate Windows Boot Manager binary to achieve persistence...

CVE-2018-8549

A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 1...

R0Ak (The Ring 0 Army Knife) - A Command Line Utility To Read/Write/Execute Ring Zero On For Windows 10 Systems

r0ak is a Windows command-line utility that enables you to easily read, write, and execute kernel-mode code with some limitations from the command prompt, without requiring anything else other than Administrator privileges. Quick Peek r0ak v1.0.0 -- Ring 0 Army Knife...

Ring 0 Army Knife: r0ak

r0ak is a Windows command-line utility that enables you to easily read, write, and execute kernel-mode code with some limitations from the command prompt, without requiring anything else other than Administrator privileges. Motivation The Windows kernel is a rich environment in which hundreds of...