WinPmem

WinPmem -- a physical memory acquisition tool WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project, but has recently been separated into its own repository. This is the Windows version. The Linux version, Linpmem , i...

windows_tcpip_fuzz

windowstcpipfuzz This is my attempt at fuzzing the tcpip.sys driver in windows via using scapy. This is inspired by this vulnerability here: https://doar-e.github.io/blog/2021/04/15/reverse-engineering-tcpipsys-mechanics-of-a-packet-of-the-death-cve-2021-24086/...

evil-mhyprot-cli

evil-mhyprot-cli A PoC for Mhyprot2.sys vulnerable driver that allowing read/write memory in kernel/user via unprivileged user process. libmhyprot Wiki Overview What we can do with this CLI is as follows: Read/Write any kernel memory with privilege of kernel from usermode Read/Write any user memo...

DIBF

DIBF Windows Driver IOCTL Tool Suite. DIBF Dynamic Ioctl Brute-Forcer and fuzzers This tool encompasses two distinct features. It guesses the IOCTL values that the driver accepts and also their valid size limitations and store the results are in a file for future reuse. The second feature is...

CVE-2025-7771

A exploit app written in Rust for CVE-2025-7771 At a glance of the source code data.rs, store the vulnerable driver binary as a static array exploit.rs, implement a arbitrary read/write primitives based on that vulnerable drvier filemap.rs, a simple wrapper for win32 file mapping ops nt.rs, some ...

CVE-2025-0288

CVE-2025-0287 This repository contains a screenshot of the vulnerable function identified during reverse engineering of a vulnerable Windows driver. Description biontdrv.sysVul: vulnerable version biontdrv.sysSecure: patched version POCCVE-2025-0288.c: proof-of-concept code diff.png: screenshot o...

armadito-windows-driver

Armadito Windows Driver Armadito Windows Driver is responsible of on-access protection of Armadito antivirus. Copyright C Teclib', 2015, 2016 Project home : http://www.teclib-edition.com/teclib-products/armadito-antivirus See Online documentation at : http://armadito-av.readthedocs.io/en/latest/...

CVE-2021-1699

CVE-2021-1699 POC for CVE-2021-1699, an information disclosure bug in modem.sys...

NotSecDrv

NotSecDrv - A PoC code for CVE-2018-7249 General Description An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls to IOCTL 0xCA002813 can cause a race...

MiniVisorPkg

MiniVisor This is a research hypervisor written as a UEFI and Windows driver for the educational purpose for Intel processors. This MiniVisor, as a UEFI driver, provides the ability to inspect system activities even before the operating system boots, while as a Windows driver, allows developers t...

kratosminifilter

Kratos MiniFilter Kratos Minifilter is a Windows kernel driver FLTMGR.SYS built for real-time ransomware detection and file I/O mitigation. It intercepts low-level IRPs to instantly block unauthorized mass encryption and canary triggers. Overview Kratos is a research Windows File System Minifilte...

lenovo-dispatcher-poc

Lenovo Dispatcher PoC This is a basic proof of concept to exploit lenovo dispatcher driver LnvMSRIO.sys CVE-2025-8061. Vulnerabilities found by Luis Casvella source: https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html. The main idea of this poc is to exploit the read/write...

hidden

Hidden 🇺🇦 Hidden has been developed like a solution for reverse engineering and researching tasks. This is a windows driver with a usermode interface which is used for hiding specific environment on your windows machine, like installed RCE programs ex. procmon, wireshark, vm infrastructure ex...

Driver-SoulExtraction

SoulExtraction SoulExtraction is a windows driver library for extracting cert information in windows drivers Compile Visual Studio 2022 & WDK10 llvm-msvc link Credit linux BackEngineerLab https://git.back.engineering/gmh5225/Driver-SoulExtraction Some discussions on UnknownCheats...

CVE-2020-15368

How to exploit a vulnerable windows driver Exploit and Proof of Concept PoC for CVE-2020-15368. Asrock repackaged rweverything driver for their RGB controller configuration tool and signed it. They "protect" it by encrypting their ioctls...lol. We found this CVE by accident last summer, and afaik...

CFB

What is it? !CAUTION CFB is meant for research and debug purposes, it should never be used on production systems. Also BSoD may happen. You've been warned. Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the...

CVE-2019-0708-PoC-Hitting-Path

CVE-2019-0708-PoC-Hitting-Path Really Really Bad, don't judge this code hahaha it's terrible It's only hitting vulnerable path in termdd.sys!!! NOT DOS Tested only on Windows XP Sp3 x86, Windows 7 will need negotiation part probably so it won't work I hope that work at all Maybe it will be useful...

cve-2025-7771

CVE-2025-7771 — ThrottleStop.sys LPE Proof-of-concept for CVE-2025-7771. ThrottleStop.sys exposes two IOCTL handlers that allow arbitrary physical memory read/write with no access control — any admin process can read or write anywhere in physical RAM. Tested on Windows 10 22H2 and Windows 11 23H2...

CVE-2025-62470

This is not exploiting, just POC BUGCHECKCODE: 50 BUGCHECKP1: ffffc101f6bf91be BUGCHECKP2: 0 BUGCHECKP3: fffff8007e194409 BUGCHECKP4: 0 READADDRESS: ffffc101f6bf91be MMINTERNALCODE: 0 IMAGENAME: CLFS.SYS MODULENAME: CLFS FAULTINGMODULE: fffff8007e190000 CLFS PROCESSNAME: ConsoleApplication4.exe...

cve-2021-43226PoC

CVE-2021-43226 Reproduction Environment Operating system: Win10 20H2 on Hyper-V, build 19042.508. Found a website https://os.click/en, which has a relatively complete collection of Windows images and no backdoor has been discovered yet. Since the PoC I found was compiled with Visual Studio 2013, ...