DriverBuddyReloaded

Driver Buddy Reloaded Table of Contents Driver Buddy Reloaded Table of Contents Installation Quick Usage Advanced Usage About Driver Buddy Reloaded Finding DispatchDeviceControl Labelling WDM and WDF Structures Finding and Decoding IOCTL Codes Flagging Functions Finding DeviceName Dumping Pooltag...

BYOVD-Research

BYOVD-Research KOSEC이 수행한 BYOVD 연구. 취약한 드라이버와 분석 보고서를 포함합니다. 면책 조항: 이 연구는 교육 목적으로 게시되며, Windows 커널 보안 연구 발전을 위한 것입니다...

HolyGrail

HolyGrail HolyGrailドライバ（BYOVDに適したWindowsドライバ）を探すためのBYOVDハンターです。 インストール git clone https://github.com/BlackSnufkin/HolyGrail cd HolyGrail cargo build --release クイックスタート HolyGrail.exe -d "C:\path\to\driver.sys" 必要に応じてJSON出力、カスタム出力ディレクトリ、ポリシーディレクトリを追加します: HolyGrail.exe -d "C:\path\to\driver.sys" -o...

ampa.sys-exp

ampa.sys-exp 私のコードではありません。保存用です。 https://zeifan.my/Ampa-Driver-Analysis/...

Exploring malicious Windows drivers (Part 1): Introduction to the kernel and drivers

Drivers have long been of interest to threat actors, whether they are exploiting vulnerable drivers or creating malicious ones. Malicious drivers are difficult to detect and successfully leveraging one can give an attacker full access to a system. Real-world examples can be found in our previous...

Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center

Windows 10 and Windows 11 have continued to raise the security bar for drivers running in the kernel. Kernel-mode driver publishers must pass the Hardware Lab Kit HLK compatibility tests, malware scanning, and prove their identity through extended validation EV certificates. This has significantl...

Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center

Windows 10 and Windows 11 have continued to raise the security bar for drivers running in the kernel. Kernel-mode driver publishers must pass the Hardware Lab Kit HLK compatibility tests, malware scanning, and prove their identity through extended validation EV certificates. This has significantl...

[Memoryze] Find Evil in Live Memory (Memory Forensic Software)

Mandiant’s Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis. Mandiant’s Memoryze features: image the full range of system memory no...