DriverBuddyReloaded

Driver Buddy Reloaded Table of Contents Driver Buddy Reloaded Table of Contents インストール クイック使用法 高度な使用法 Driver Buddy Reloadedについて DispatchDeviceControlの検出 WDMおよびWDF構造のラベリング IOCTLコードの検出とデコード 関数のフラグ付け DeviceNameの検出 Pooltagのダンプ ヒューリスティック脆弱性チェック 機能フラグ テスト 既知の注意点と制限事項 クレジットと謝辞 インストール...

HolyGrail

HolyGrail 一款BYOVD狩猎工具，用于寻找适合BYOVD的HolyGrail驱动——Windows驱动程序。 安装 root@kitploit: git clone https://github.com/BlackSnufkin/HolyGrail cd HolyGrail cargo build --release 快速开始 root@kitploit: HolyGrail.exe -d "C:\path\to\driver.sys" 如果需要JSON输出、自定义输出目录和策略目录，可添加以下参数： root@kitploit: HolyGrail.exe -d...

BYOVD-Research

BYOVD-Research KOSEC 执行的 BYOVD 研究。包含易受攻击的驱动程序和漏洞分析报告。 免责声明：本研究仅用于教育目的，旨在推动 Windows 内核安全研究。...

ampa.sys-exp

ampa.sys-exp No es mi código. Solo para guardar https://zeifan.my/Ampa-Driver-Analysis/...

Exploring malicious Windows drivers (Part 1): Introduction to the kernel and drivers

Drivers have long been of interest to threat actors, whether they are exploiting vulnerable drivers or creating malicious ones. Malicious drivers are difficult to detect and successfully leveraging one can give an attacker full access to a system. Real-world examples can be found in our previous...

Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center

Windows 10 and Windows 11 have continued to raise the security bar for drivers running in the kernel. Kernel-mode driver publishers must pass the Hardware Lab Kit HLK compatibility tests, malware scanning, and prove their identity through extended validation EV certificates. This has significantl...

Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center

Windows 10 and Windows 11 have continued to raise the security bar for drivers running in the kernel. Kernel-mode driver publishers must pass the Hardware Lab Kit HLK compatibility tests, malware scanning, and prove their identity through extended validation EV certificates. This has significantl...

[Memoryze] Find Evil in Live Memory (Memory Forensic Software)

Mandiant’s Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis. Mandiant’s Memoryze features: image the full range of system memory no...