Terminator

Terminator zam64.sys ドライバを悪用してすべての EDR/XDR/AV プロセスを終了させる Spyboy の手法を再現 Spyboy は Terminator ソフトウェアを 3,000 ドルで販売していた 詳細はこちら サンプルは loldrivers から入手 使用方法 コンパイル済みバージョンは こちら にあります ドライバ Terminator.sys を実行ファイルと同じパスに配置してください プログラムを管理者として実行してください サービスがアンチマルウェアを再起動しないように、プログラムを実行したままにしておいてください 技術的詳細...

CVE-2026-16006

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

EUVD-2026-72625

Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armour...

CVE-2026-16006

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

EUVD-2026-72621

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

EUVD-2026-71685

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

SUSE CVE-2019-10063

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the...