Driver-SoulExtraction

SoulExtraction SoulExtraction is a windows driver library for extracting cert information in windows drivers Compile Visual Studio 2022 & WDK10 llvm-msvc link Credit linux BackEngineerLab https://git.back.engineering/gmh5225/Driver-SoulExtraction Some discussions on UnknownCheats...

armadito-windows-driver

Armadito Windows Driver Armadito Windows Driver is responsible of on-access protection of Armadito antivirus. Copyright C Teclib', 2015, 2016 Project home : http://www.teclib-edition.com/teclib-products/armadito-antivirus See Online documentation at : http://armadito-av.readthedocs.io/en/latest/...

hidden

Hidden 🇺🇦 Hidden has been developed like a solution for reverse engineering and researching tasks. This is a windows driver with a usermode interface which is used for hiding specific environment on your windows machine, like installed RCE programs ex. procmon, wireshark, vm infrastructure ex...

WinPmem

WinPmem -- a physical memory acquisition tool WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project, but has recently been separated into its own repository. This is the Windows version. The Linux version, Linpmem , i...

windows_tcpip_fuzz

windowstcpipfuzz This is my attempt at fuzzing the tcpip.sys driver in windows via using scapy. This is inspired by this vulnerability here: https://doar-e.github.io/blog/2021/04/15/reverse-engineering-tcpipsys-mechanics-of-a-packet-of-the-death-cve-2021-24086/...

cve-2022-21877

POC CVE-2022-21877 This repository contains a POC for the CVE-2022-21877, found by Quang Linh, working at STAR Labs. This is an information leak found inside the spaceport.sys driver. An accompying blogpost can be found at this address. Using it To build the POC, simply run .\build. To run it, yo...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys version 10.0.20348.825 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9 r8=0000001000000020...

CVE-2019-0708-PoC-Hitting-Path

CVE-2019-0708-PoC-Hitting-Path Really Really Bad, don't judge this code hahaha it's terrible It's only hitting vulnerable path in termdd.sys!!! NOT DOS Tested only on Windows XP Sp3 x86, Windows 7 will need negotiation part probably so it won't work I hope that work at all Maybe it will be useful...

CVE-2025-62470

This is not exploiting, just POC BUGCHECKCODE: 50 BUGCHECKP1: ffffc101f6bf91be BUGCHECKP2: 0 BUGCHECKP3: fffff8007e194409 BUGCHECKP4: 0 READADDRESS: ffffc101f6bf91be MMINTERNALCODE: 0 IMAGENAME: CLFS.SYS MODULENAME: CLFS FAULTINGMODULE: fffff8007e190000 CLFS PROCESSNAME: ConsoleApplication4.exe...

CVE-2021-42205

CVE-2021-42205 ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice. authentication| complexity| vector ---|---|--- not...

kratosminifilter

Kratos MiniFilter Kratos Minifilter is a Windows kernel driver FLTMGR.SYS built for real-time ransomware detection and file I/O mitigation. It intercepts low-level IRPs to instantly block unauthorized mass encryption and canary triggers. Overview Kratos is a research Windows File System Minifilte...

MiniVisorPkg

MiniVisor This is a research hypervisor written as a UEFI and Windows driver for the educational purpose for Intel processors. This MiniVisor, as a UEFI driver, provides the ability to inspect system activities even before the operating system boots, while as a Windows driver, allows developers t...

CFB

What is it? !CAUTION CFB is meant for research and debug purposes, it should never be used on production systems. Also BSoD may happen. You've been warned. Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the...

DriverSentinel

🛡️ DriverSentinel 🛡️ Vulnerable Windows Driver Scanner DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them against the LOLDrivers.io database. Features • Installation • Usage • How It Works 📋 Table of Contents Features...

DIBF

DIBF Windows Driver IOCTL Tool Suite. DIBF Dynamic Ioctl Brute-Forcer and fuzzers This tool encompasses two distinct features. It guesses the IOCTL values that the driver accepts and also their valid size limitations and store the results are in a file for future reuse. The second feature is...

evil-mhyprot-cli

evil-mhyprot-cli A PoC for Mhyprot2.sys vulnerable driver that allowing read/write memory in kernel/user via unprivileged user process. libmhyprot Wiki Overview What we can do with this CLI is as follows: Read/Write any kernel memory with privilege of kernel from usermode Read/Write any user memo...

CVE-2020-15368

How to exploit a vulnerable windows driver Exploit and Proof of Concept PoC for CVE-2020-15368. Asrock repackaged rweverything driver for their RGB controller configuration tool and signed it. They "protect" it by encrypting their ioctls...lol. We found this CVE by accident last summer, and afaik...

CVE-2021-27965

CVE-2021-27965 Simple PoC for exploiting CVE-2021-27965 for LPE by spawning system cmd. https://vulners.com/cve/CVE-2021-27965 An issue was discovered in signed MICSYS windows driver MsIo64.sys which may lead to compromisation of whole local system. Driver's ioctl dispatch routine suffers from...

CVE-2021-1699

CVE-2021-1699 POC for CVE-2021-1699, an information disclosure bug in modem.sys...

NotSecDrv

NotSecDrv - A PoC code for CVE-2018-7249 General Description An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls to IOCTL 0xCA002813 can cause a race...