GhostDriver

GhostDriver 👻 About GhostDriver is a Rust-built AV killer tool using BYOVD. Get Started 1. Install Rust from rust-lang.org 2. Clone: git clone https://github.com/BlackSnufkin/GhostDriver.git 3. Build: cargo build --release --target=x8664-pc-windows-msvc 4. Run: Execute the GhostDriver binary Usag...

asus-bsitf-0-day-poc

POC - ASUS bsitf.sys Kernel Memory Mapping to Usermode CVE-2026-13585 Summary The ASUS bsitf.sys also distributed as AsusBSItf.sys kernel driver exposes IOCTL 0x222808 which allocates physically contiguous kernel memory of attacker-controlled size, maps it into the calling process's address space...

BYOVD-CVE-2023-52271-POC

Disclaimer: This repository contains code that is provided strictly for educational and research purposes only. DO NOT use this code on systems you do not own or have explicit permission to test. Any misuse of this code may violate local, national, or international laws. CVE-2023-52271 POC Exploi...

BYOVD-Research

Overview This is an older driver that was recently exploited in a BYOVD campaign detailed here: https://www.bleepingcomputer.com/news/security/edr-killer-tool-uses-signed-kernel-driver-from-forensic-software/ The exploit path is as follows: 1. The attacker's program runs as admin and gets its own...

0xKern3lCrush

0xKern3lCrush Windows BYOVD research on two real cases: the Safetica ProcessMonitorDriver CVE-2026-0828 and the ThrottleStop driver abused by MedusaLocker CVE-2025-7771. The repository documents the exposed interfaces, the privileged outcome each one reaches, and how to detect the abuse. It ships...

STProcessMonitorBYOVD

STProcessMonitorBYOVD Reference: https://bbs.kafan.cn/thread-2288675-1-1.html Usage: 1. Place the vulnerable driver under the same directory of the exe. The version 11.11.4.0 the older one is with CVE-2025-70795 / CVE-2026-0828, compatible with the parameter /Kill; The version 11.26.18 Updated is...

cve-2026-0828

CVE-2026-0828 — Safetica ProcessMonitorDriver.sys BYOVD PoC Safetica DLP kernel driver ProcessMonitorDriver.sys exposes an unauthenticated IOCTL that allows any user-mode caller to terminate arbitrary processes via ZwTerminateProcess in kernel context, bypassing PPL Protected Process Light...

NimBlackout

NimBlackout Note : This project is for educational purposes only. The use of this code for any malicious activity is strictly prohibited. I am not responsible for any misuse of this software. NimBlackout is an adaptation of the @Blackout project originally developed in C++ by @ZeroMemoryEx, which...

BYOVD

EnPortv-Killer PoC for vulnerability in EnPortv driver from EnCase As of 2026-07-10, the driver is listed onLOLDDrivers but remains absent from Microsoft's recommended driver block rules as of 2026-07-10 Built on byovd-lib -- implements the DriverConfig trait and delegates the full BYOVD flow to...

HITCON-2023-Demo-CVE-2023-20562

HITCON 2023 Demo CVE-2023-20562 Description This demonstration took place at HITCON 2023 in Taiwan. The demo highlights the exploitation of AMDCpuProfiler.sys within AMD μProf. By triggering an arbitrary write on the EPROCESS token, privilege escalation to SYSTEM level is achieved. Disabling the...

BYOVD-DriverKiller

BYOVD-DriverKiller This README EN may contain errors ! ⚠️ Disclaimer : This project is strictly educational and demonstrative. It is not intended for malicious use. The goal is to learn reverse engineering methodology and the exploitation steps of a Windows driver. Here I explain the approach I...

MSRMapper

MSRMapper BYOVD Manual Mapper for Windows x64 · CVE-2025-8061 Overview MSRMapper is a manual kernel driver mapper for Windows x64 that abuses CVE-2025-8061 in the vulnerable Lenovo driver LnvMSRIO.sys to perform a BYOVD Bring Your Own Vulnerable Driver attack. The project maps a PE64 driver...

HolyGrail

HolyGrail A BYOVD hunter for finding the HolyGrail driver - Windows drivers suitable for BYOVD. Install git clone https://github.com/BlackSnufkin/HolyGrail cd HolyGrail cargo build --release Quick start HolyGrail.exe -d "C:\path\to\driver.sys" Add JSON output, custom output dir, and policy dir if...

rusty_drivers

RustyDrivers This project is a BYOVD collection with the focus on killing EDR / AV processes. Currently the following drivers are supported: Driver| Argument Name| Blocked ---|---|--- Process Explorer| processexplorer| Yes Genshin Impact| genshin| Yes Rentdrv2| rentdrv2| No TrueSight| truesight| ...

SharpBlackout

SharpBlackout Terminate AV/EDR leveraging BYOVD attack Note: This project is for educational purposes only. Sharpblackout is an adaptation of the @Blackout project originally developed in C++ by @ZeroMemoryEx, which consists of removing AV/EDRs using the gmer BYOVD driver. Just wanted to try maki...

Reaper

「💀」 About Reaper Reaper is a proof-of-concept designed to exploit BYOVD Bring Your Own Vulnerable Driver driver vulnerability. This malicious technique involves inserting a legitimate, vulnerable driver into a target system, which allows attackers to exploit the driver to perform malicious action...

WinDefenderKiller

WinDefenderKiller PermanentDisablefromRegistry C++ Code for Permanently Disabling Windows Defender via Registry Keys Just compile and execute it! And when i restart it: BYOVDWindowsDefenderKiller This module implements a BYOVD Bring Your Own Vulnerable Driver technique to disable Windows Defender...

cheat-engine-undetectable

Cheat Engine Undetectable Academic Research Edition — Modified Cheat Engine with multi-tiered anti-cheat evasion for cybersecurity education and university-level reverse engineering research. Disclaimer: This project is exclusively for academic research, university coursework, and cybersecurity...

CVE-2025-24990_POC

Windows Agere Modem Driver ltmdm64.sys. This driver is very old and is not loaded by default on my test machine, so I will exploit it in a BYOVD scenario. Interestingly, according to my research this driver has existed on Windows 7 and has at least one bug. here At that time, MSRC didn't take any...

bdapiutil-bydov

BdApiUtil64.sys BYOVD C++ demonstration tool for Windows that interacts with the BdApiUtil device via DeviceIoControl and a specific IOCTL to request the termination of a process. Requirements 64-bit Windows 10/11 Visual Studio / MSVC BdApiUtil64.sys driver loaded and accessible Administrative...