aegis

Aegis Kernel-mode process protection driver using ObRegisterCallbacks to strip memory access permissions from handles. Basic implementation that hooks handle creation and removes PROCESSVMREAD/WRITE/OPERATION from unauthorized access attempts. Note: If the GIF doesn't animate, view it directly on...

FalconEye

FalconEye: Real-time detection software for Windows process injections FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening real-time. Since FalconEye runs in kernel mode, it...

CVE-2016-7255

CVE-2016-7255 Microsoft Windows Vista SP2, Windows Server 2008 SP2 및 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold 및 R2, Windows RT 8.1, Windows 10 Gold, 1511 및 1607, Windows Server 2016의 커널 모드 드라이버는 제작된 응용 프로그램을 통해 로컬 사용자가 권한을 상승할 수 있도록 허용합니다. 일명 "Win32k 권한 상승 취약점"입니다. 리비아에서 온 성인...

access_updated

Singular Access Windows 10/11 호환성을 위한 Zydis 기반 동적 패턴 검색 기능을 갖춘btbd/access의 업데이트된 포크 핸들을 요구하지 않고 권한 있는 프로세스 작업을 가능하게 하는 커널 모드 syscall 래퍼입니다. 커널-유저모드 통신을 위해 xKdEnumerateDebuggingDevices 포인터 후킹을 사용합니다. 기능 ✅ 하드코딩된 오프셋 없음 - 모든 커널 함수/오프셋은 Zydis 디스어셈블러를 통해 런타임에 발견됩니다. ✅ 버전 독립적 - Windows 101607+ 및...

Driver-kaldereta

Kaldereta 메모리 수정을 수행하는 서명되지 않은 커널 모드 드라이버 기능 프로세스 ID 가져오기 이미지의 베이스 주소 가져오기 메모리 영역의 보호 속성 변경 메모리 영역 할당 메모리 해제 주소에서 읽기/쓰기 오프셋을 사용한 주소에서 읽기/쓰기 메모리에서 버퍼로 읽기 버퍼에서 메모리로 쓰기 마우스 이벤트 시뮬레이션 키보드 이벤트 시뮬레이션 패턴 스캔 수동 맵 x64 설정 Windows Driver Kit 설치 KDMapper로 .sys 파일 로드 지원 도움이 필요하시면 Discord로 문의해 주세요 후원하고 싶으신가요?...

EATGuard

EATGuard EATExport Address Table 보호 완화Export Address Filtering, EAF의 구현 작동 방식 이 프로젝트는 세 개의 바이너리로 구성되며, 컴파일하면 EATGuard\bin\에서 찾을 수 있습니다: 1. EATGuardApplication.exe - EATGuardDll.dll을 프로세스에 로드한 다음 notepad.exe를 실행하는 일부 실행 코드셸코드를 실행하는 "악성" 애플리케이션. 2. EATGuardDll.dll - 사용자 모드와 커널 모드 사이의 "브리지"를 제공하는...

CVE-2026-47603

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure...

NVIDIA Windows GPU Display Driver (September 2026)

The NVIDIA GPU display driver software on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following: - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user...

CVE-2026-47542

A flaw was found in the NVIDIA GPU display driver. A local attacker with high privileges can trigger this vulnerability by supplying crafted input to the kernel-mode driver layer due to improper input validation. A successful exploit may allow the attacker to achieve arbitrary code execution,...

CVE-2026-47519

A flaw was found in nvidia-vgpu-software's Virtual GPU vGPU Manager for Linux. A local user with basic privileges can trigger an out-of-bounds read in the kernel-mode driver, accessing memory outside designated boundaries. A successful exploit could allow the attacker to execute arbitrary code,...

CVE-2026-47579

A flaw was found in the NVIDIA GPU Display Driver. A local user can trigger a use-after-free condition in the kernel mode driver, where the system accesses memory after it has already been released. Successful exploitation could lead to arbitrary code execution, privilege escalation, unauthorized...

CVE-2026-47533

A flaw was found in nvidia-driver. A local attacker with administrative privileges can trigger an array indexing error within the kernel-mode driver layer. Successful exploitation could allow the attacker to execute arbitrary code, escalate system privileges, access sensitive data, or cause a...

LocalStranger

LocalStranger LocalStranger는 취약한 커널 모드 드라이버가 실제로 얼마나 위험한지를 보여주기 위해 설계된 Proof of Concept 프로젝트입니다. WinNotify.sys내가 부르는 이름은 msft.sys는 호출자 검증이 완전히 결여되어 임의의 커널 프리미티브를 노출하는 매우 위험한 취약 드라이버입니다. 예상외로, 이 드라이버는 Microsoft Windows Hardware Compatibility Publisher 파트너십 프로그램으로 서명되어 있으며, 현재까지 Microsoft 취약 드라이버 차...

CVE-2026-47604

A flaw was found in the NVIDIA GPU display driver. Missing authorization checks in the kernel-mode driver allow a local user to access another process's graphics processing unit GPU channel state. Successful exploitation can lead to unauthorized information disclosure...

CVE-2026-47566

A flaw was found in nvidia-driver. An unprivileged local attacker can trigger specific error-handling routines in the kernel-mode driver layer, causing memory to leak instead of being freed. Over time, this memory exhaustion can destabilize the operating system and result in a Denial of Service D...

CVE-2026-47551

A flaw was found in the NVIDIA GPU Display Driver. A local user can trigger a use-after-free condition in the kernel-mode driver layer, where previously freed memory is improperly referenced. A successful exploit could allow an attacker to achieve arbitrary code execution, escalate privileges,...

CVE-2026-47604

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47603

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47602

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver to dereference an untrusted pointer. A successful exploit of this vulnerability might lead to denial of service and information disclosure...

CVE-2026-47579

The NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode driver through which a user might trigger a use-after-free condition. Successful exploitation of this issue could lead to code execution, escalation of privileges, denial of service, information disclosure, and...