BYOVD

Bring Your Own Vulnerable Driver: load a legitimately signed but vulnerable driver to obtain kernel read/write (or other primitives), then disable protections, map unsigned code, or blind anti-cheat.

Typical chain

1. Load signed vulnerable driver (e.g. historically abused families like Capcom, RTCore, iqvw64e, dbutil, …)
2. Trigger vulnerable IOCTL / bug for arbitrary R/W
3. Tamper with DSE, callbacks, ETW, or load a hostile mapper

Mitigations

Microsoft vulnerable-driver blocklist ([[msft-driverblocklist]] mirrors the Recommended Driver Block Rules for defensive / AC research); blocklist-derived hash inventories such as [[ms-vulnerable-driver-list]] (gmh5225; Microsoft-acknowledged signed drivers with known IOCTL-exploitable flaws for BYOVD research); [[hvci]], AC driver allowlists ([[vanguard]]-style), PiDDBCache/MmUnloadedDrivers forensics, EPT-protected callback lists. The canonical LOLdriver catalog [[loldrivers]] (magicsword-io; YAML metadata, YARA enrichment, HVCI tracking, validation tooling) is the upstream reference for known-abused signed drivers. HVCI-oriented LOLdriver checks such as [[hvci-loldrivers-check]] help inventory those drivers against Memory Integrity constraints. [[byovdfinder]] (ghostbyt3; identifies LOLdrivers not blocked by the active HVCI policy—BYOVD paths that remain loadable under Memory Integrity) complements that inventory lane. Broader LOLdriver scan clients such as [[loldrivers-client]] (Go/PowerShell) sit in the same cheat / vulnerable-driver research lane. Lightweight filesystem triage such as [[vulnerable-driver-scanner]] (Xxmmy; C++ CLI; scans directories for vulnerable Windows drivers in common system driver locations; quick BYOVD exposure assessment for bypass research, IR, and defensive audits) complements those catalog clients. PE-import triage such as [[vulnerable-driverscanner]] (Sentient111; C++ console; folder scan; flags driver PEs with indicative kernel API imports; preliminary attack-surface assessment—not full behavioral analysis) offers another lightweight static option in the same lane. Read-only endpoint assessment such as [[driver-risk-scout]] (Systemhaus-Schulz; PowerShell + optional Python collector; loaded/installed/DriverStore inventory; signature verification; LOLDrivers/MS blocklist/BYOVD profile correlation; static PE/YARA scoring; Sysmon/Code Integrity correlation; HVCI/VBS/WDAC posture; CSV/JSON/HTML/Wazuh NDJSON with optional NVD CVE enrichment and Sigma rules; defenders/IR/game-security BYOVD hunting without exploiting drivers or modifying the host) extends that defensive triage lane. Unprivileged Go LOLdriver scanner [[loldriverscan]] (FourCoreLabs; public driver threat feed; local hash/metadata compare; verbose + JSON export; defensive auditing and AC environment checks) complements those catalog clients.

Physical-memory–oriented vulnerable-driver inventories such as [[physmem-drivers]] (namazso; list only, no PoC) help catalog signed drivers that expose physmem primitives commonly abused in BYOVD chains.

Categorized third-party driver binary corpora such as [[drivers-and-shit]] (alfarom256; large .sys collection from OEM tools, utilities, and security products; reference corpus for vulnerable-driver research and exploit reproduction—binaries only, no PoC) complement hash-list inventories in the same lane.

Curated signed vulnerable-driver binary collection such as [[vulnerable-drivers]] (KeServiceDescriptorTable; dozens of vendor .sys binaries exposing exploitable IOCTL interfaces, memory-access primitives, or other weaknesses; BYOVD cataloging and exploitation-surface analysis—binaries only, no PoC) sits in the same research corpus lane beside [[drivers-and-shit]].

Multi-vendor compiled .sys sample corpus such as [[drivers-binaries]] (CaledoniaProject; vendor kernel driver binaries plus CVE/report/exploit writeup reference links; practical samples for detection-rule, threat-hunting, and signed-driver-abuse defensive testing; defender-focused kernel attack-surface research—binaries only, no PoC) complements those curated corpora.

Single-driver binary distribution such as [[cormem-sys-vulnerable-driver]] (KeServiceDescriptorTable; cormem.sys; memory R/W primitives for kernel-level access; BYOVD research binary) complements those curated corpora.

Educational kernel-exploit reference material such as [[windows-kernel-exploits]] sits in the same cheat / vulnerable-driver documentation lane. Broader curated kernel learning collections such as [[winkernel-resources]] (NullArray; papers, talks, vulnerable-driver links, sample driver projects; cheat / Guide) complement exploit-specific write-ups in that lane. Hands-on vulnerable-driver lab guides such as [[hacksysextremevulnerabledriver]] (HackSys Team; kernel exploitation training in the cheat / vulnerable-driver lane) complement that documentation. Intentionally vulnerable training drivers such as [[vulnerablekernel-driver]] (gmh5225; MsIo64.sys; IOCTL demos for arbitrary R/W, overflow, UAF, and race conditions) offer another kernel-exploitation lab target beside HackSys-style guides.

Concrete AV/EDR-evasion research such as [[ven0m-ransomware]] abuses iMFForceDelete.sys from IObit Malware Fighter (v12.1.0) rather than a classic ZwTerminateProcess-style killer driver. LPE PoC [[cve-2025-26125]] (ZeroMemoryEx; CVE-2025-26125; MSI-based file/folder deletion abuse → SYSTEM via the same IMFForceDelete.sys; NT API + resource manipulation) complements that IObit driver lane. IObitUnlocker IObitUnlocker.sys IOCTL abuse such as [[cve-2020-14974]] (gmh5225; CVE-2020-14974; unlock/delete/rename/copy/move locked files from low privilege; file-utility signed-driver research) sits in the same IObit vendor driver lane.

Process-terminate style killers such as [[av-edr-killer]] target wsftprm.sys via IOCTL 0x22201C (1036-byte buffer; first DWORD = target PID).

WatchDog Anti-Malware driver abuse such as [[watchdog-killer]] targets amsdk.sys / wamsdk.sys via \\.\amsdk (or guard device GUID): optional IOCTL_REGISTER_PROCESS (0x80002010) self-registration, then IOCTL_TERMINATE_PROCESS (0x80002048) to terminate protected AV/EDR processes—Silver Fox tradecraft lane; tested build reportedly absent from common LOLdriver/HVCI blocklists at publication.

Zemana anti-malware driver abuse such as [[zam64-zemina]] targets zam64.sys via IOCTLs for process termination and memory access—another security-product driver in the known LOLdriver / process-kill lane.

Focused AV/EDR/AC terminate tooling such as [[terminator]] (gmh5225; zam64.sys BYOVD; arbitrary process-termination IOCTL → kill kernel-protected security and anti-cheat processes; red-team / LOLdriver termination research) complements IOCTL-focused [[zam64-zemina]] in the same Zemana backend lane.

Go-based Spyboy Terminator reproduction such as [[edr-xdr-av-killer]] (EvilBytecode; IOCTL PID trust-list bypass on zam64.sys → kernel-level EDR/XDR/AV process termination; BYOVD / security-product blind research) sits beside [[terminator]] in the same Zemana backend lane.

GMER anti-rootkit driver abuse such as [[blackout]] (gmh5225; gmer64.sys from [[loldrivers]]; BYOVD load → IOCTL terminate EDR/AV by PID; continuous Windows Defender suppression to block service restart) sits in the same process-kill BYOVD lane beside [[terminator]] and [[watchdog-killer]].

Kaspersky signed kernel-driver abuse such as [[evil-kaspersky]] (gmh5225; leverage trusted Kaspersky driver capabilities for unauthorized privileged operations and kernel code execution while appearing as legitimate antivirus activity; README [Kaspersky]) sits in the same security-product BYOVD lane beside hypervisor syscall redirection in [[kaspersky-hook]].

Avast signed hypervisor-component abuse such as [[avasthv]] (gmh5225; document/exploit Avast antivirus hypervisor for kernel-level ops; signed hypervisor driver → elevated privileges or hypervisor-context code execution; trusted-driver status bypasses DSE and anti-cheat protections; AV hypervisor BYOVD research; README [Avast]) extends that security-product lane toward hypervisor-context primitives.

Curated educational BYOVD lab [[entities/byovd|BYOVD Lab]] (gmh5225; multi-driver PoC collection for AV/EDR termination—viragt64.sys, TfSysMon, ksapi64, BdApiUtil, wsftprm.sys; Viragt64 branch notes real-world campaign overlap after publication) complements single-driver kill samples in the same lane.

BdApiUtil64.sys educational EDR-kill PoC such as [[byovd-edrkiller]] (0xJs; C BYOVD PoC; reverse-engineered device naming, IOCTL selection, and input buffer structure; automates driver deployment, security-process enumeration, repeated termination attempts, and cleanup; authorized red-team research on defensive product resilience and kernel attack surface; README [BdApiUtil64.sys]) complements the BdApiUtil branch in [[entities/byovd|BYOVD Lab]].

viragt64.sys process-kill tooling such as [[process-killer-byovd]] (gmh5225; load signed vulnerable driver → kernel access → forceful termination of user-mode-protected anti-cheat, EDR, and AV processes; red-team / LOLdriver termination research) sits in the same BYOVD process-terminate lane as [[terminator]] and [[watchdog-killer]].

NSecKrnl.sys process-termination PoC such as [[nsecsoft-byovd]] (ANYLNK; Windows executable + vulnerable third-party driver → privileged actions against a target PID; documents real-world abuse patterns and assigned CVE; kernel security / endpoint hardening research; README [NSecKrnl.sys]) extends the same process-kill BYOVD lane.

Malware-style multi-stage PoC such as [[urek-mazino-malware]] (CyberSecurityUP; C++; viragt64.sys BYOVD → crafted IOCTL security-process kill; WinINet payload download + temp execution; executable-memory shellcode loader; BYOVD threat simulation / IR training / endpoint tampering research; README [viragt64.sys]) extends that viragt64.sys lane with staged payload delivery beside [[process-killer-byovd]].

PoisonX.sys Cobalt Strike BOF payloads such as [[poison-killer-bof]] (Muz1K1zuM; C BOFs + MinGW cross-compile + Python helper; process killing, driver load/unload, and kernel-mode file deletion through the signed vulnerable driver; red-team / BYOVD process-termination and kernel file-op research via Beacon Object Files) extend the same lane into C2 in-memory tradecraft.

Kernel process-structure manipulation killers such as [[killer]] (gmh5225; kernel driver → forceful termination of protected anti-cheat, EDR, and AV processes that resist standard APIs; valid BYOVD killer reportedly not HVCI-blocklisted and not in common LOLdriver catalogs at publication) extend the same process-terminate lane.

Red-team RE/exploit lab [[killer-exercice]] (gmh5225; companion to [[killer]]; handle-table manipulation, APC injection, direct EPROCESS modification; valid BYOVD killer reportedly not HVCI-blocklisted and not in LOLBIN at publication) teaches the same protected-process kill primitives hands-on.

Samsung S4 driver abuse such as [[s4killer]] targets probmon.sys via crafted IOCTLs for arbitrary physical or virtual kernel read/write—typical BYOVD primitives for unsigned driver load, kernel structure patching, or AC bypass research.

Samsung S4 driver manual mapper research such as [[s4mapper]] (gmh5225; SignalRgbDriver.sys memory-access IOCTLs → pool alloc, section copy, relocs, imports, entry invocation; unsigned driver map via Samsung BYOVD primitives) complements access-primitive PoC [[s4killer]] in the same Samsung S4 backend lane.

MSI Afterburner RTCore64.sys manual mapper research such as [[rtcore64-vulnerability]] (gmh5225; white-signed RTCore64 read/write primitives + data-pointer hook dispatch → kernel routine search incl. MmAllocateIndependentPagesEx and full unsigned PE map; MSI Afterburner tooling lane) sits in the same BYOVD unsigned-load lane beside other mapper-focused PoCs.

CYBERSEC 2023 Taiwan RTCore64.sys BYOVD demo such as [[cybersec2023-byovd-demo]] (gmh5225; nullifies DSE flag → loads unsigned malicious driver; disables 360 Total Security ObRegisterCallbacks + process notify callbacks for arbitrary process manipulation; conference PoC chaining DSE bypass + AC callback blind) complements mapper-focused [[rtcore64-vulnerability]] and callback-removal samples such as [[ps-notif-routine-unloader]].

Combined DSE + PatchGuard bypass research such as [[dse-pg-bypass]] (4l3x777; C++ PoC + reversing notes tracing signature validation callbacks and integrity-check paths; BYOVD model leveraging vulnerable signed drivers to interfere with code integrity and patch-protection; educational kernel security / defender BYOVD surface study) complements multi-technique runtime disable references such as [[upgdsed]].

Razer peripheral driver abuse such as [[razer-rzctl]] targets rzctl.sys for privileged I/O that can simulate mouse/keyboard input at kernel level or yield kernel memory access via vulnerable IOCTLs—overlapping BYOVD and ring-0 input-evasion research.

Razer Synapse rzpnk.sys PoC such as [[cve-2017-9769]] (gmh5225; CVE-2017-9769; crafted IOCTL → ZwOpenProcess; unprivileged arbitrary-process handle; Synapse 2.20.15.1104) complements [[razer-rzctl]] in the same Razer signed-driver lane.

Qualcomm QCI0701 ACPI driver abuse such as [[qiomem]] targets QIOMem.sys by registering a virtual software device and issuing IOCTLs for physical memory read/write—typical BYOVD physmem primitives for unsigned driver load or AC bypass research.

OEM BootRepair terminate primitives such as [[phantomkiller]] abuse signed Lenovo BootRepair.sys via IOCTL 0x222014 → ZwTerminateProcess to kill PPL-protected AV/EDR.

FortiClient anti-exploit minifilter abuse such as [[forti-research]] (mein-0; fortimon3_74.sys; Filter Manager communication port → unauthenticated 8-byte kill message; kernel-mode process terminate incl. PPL Windows Defender and lsass; missing caller authentication and handle-table misuse; Fortinet-signed BYOVD risk)

PPL-strip tooling such as [[pplkiller]] (gmh5225; RTCore64.sys BYOVD or other kernel R/W primitive → patch EPROCESS protection level to downgrade PPL antimalware/AV for debugging or termination; PPL bypass research) complements terminate-first samples such as [[phantomkiller]] and [[process-killer-byovd]].

DSE-disable controllers such as [[kvc]] use a signed Microsoft driver to patch CI.dll (g_CiOptions), plus skci.dll hijack / SeCiCallbacks redirection loaders and PP/PPL paths for LSASS dumps under HVCI/VBS.

Broader Win11 research kits such as [[kernel-research-kit]] combine boot-time SeCiCallbacks DSE bypass with multiple unsigned-load methods including BYOVD alongside manual map and IRP hijack (25H2; native subsystem; anti-loop dual-path).

Defender neutralization CLIs such as [[windefctl]] escalate via a kernel driver to disable real-time protection and Tamper Protection (Win11 26H1; UAC/GUI bypass, stealth execution)—same AV/EDR-control research lane as process-kill BYOVD samples.

Full-stack EDR-blinding toolkits such as [[edrsandblast]] combine BYOVD with callback/ETW TI disable and ntdll unhook (offset automation + demo credential dump).

LSASS credential extractors such as [[kslkatz]] abuse Microsoft Defender’s KslD.sys for kernel-mode reads of WDigest plaintext and encrypted LSA secrets past PPL/AV.

PPL LSASS dump research such as [[ksldump]] (andreisss; legacy on-disk Defender KslD.sys; IOCTL 0x222044 → MmCopyMemory arbitrary kernel read + CR disclosure for KASLR; repoints service to Microsoft-shipped unpatched binary—no external driver load; PPL bypass / vendor BYOVD study) complements [[kslkatz]] in the same Defender-driver credential lane.

OEM-driver LPE PoCs such as [[lenovo-cve-2025-8061]] target Lenovo LnvMSRIO.sys (CVE-2025-8061) via IOCTL abuse for kernel R/W and a SYSTEM shell.

Classic signed-utility driver abuse such as [[cpuz]] (CPU-Z; XP–Win10 1607) sits in the same cheat / vulnerable-driver research lane.

BitLocker PdFwKrnl.sys IOCTL abuse such as [[pdfwkrnl-exploit]] loads and executes unsigned kernel code via the driver's IOCTL surface → arbitrary kernel code execution.

BitLocker PdFwKrnl.sys DSE-bypass mapper research such as [[pdfwkrnl-mapper]] (gmh5225; same signed driver backend → SeValidateImageData/header patching → unsigned PE map into kernel space) complements IOCTL code-exec PoC [[pdfwkrnl-exploit]] in the same BitLocker BYOVD lane.

ampa.sys IOCTL abuse such as [[ampa-sys-exp]] (gmh5225; C/C++ automated exploit; insecure IOCTL → arbitrary kernel R/W or code execution; unsigned driver load, privilege escalation, or AC bypass) sits in the same cheat / vulnerable-driver research lane.

AMD Ryzen Master v17 kernel driver abuse such as [[amd-ryzen-master-driver-v17-exploit]] (gmh5225; IOCTL interface → unprivileged physical memory R/W; BYOVD primitive for kernel exploitation, driver mapping, or AC bypass) sits in the OEM utility-driver physmem lane beside [[qiomem]].

Rentdrv2 Rentdrv2.sys exploitation such as [[badrentdrv2]] (gmh5225; insecure IOCTL interface → arbitrary physical memory R/W; unsigned driver mapping, kernel patching, or AC bypass; Rentdrv2 BYOVD research) sits in the same physmem-primitive lane beside [[qiomem]] and [[amd-ryzen-master-driver-v17-exploit]].

Educational eneio64.sys physmem exploit PoC such as [[eneio64-driver-exploit]] (Xacone; C++; signed-driver physical memory R/W → virtual-to-physical translation for effective virtual memory access; modern Windows offset notes; token-theft LPE path; kernel security / vulnerable-driver analysis training) complements physmem-focused samples in the same lane.

ThrottleStop ThrottleStop.sys CVE-2025-7771 PoC such as [[throttlestop-poc]] (U65535F; C; IOCTL physmem and I/O port R/W from user mode; virtual-to-physical translation + basic EPROCESS checks; kernel security / vulnerable-driver / AC threat-modeling research) complements physmem-focused samples in the same lane.

ViGEmBus ViGEmBus.sys virtual gamepad driver research PoC such as [[vigembus-driver-exploitation]] (CyberSecurityUP; C++; documents insecure IOCTL handling and access-control issues; C++ PoCs trigger vulnerable paths for privilege escalation or system instability; RE artifacts; gaming-related driver ecosystem hardening) complements IOCTL-focused samples in the same lane.

HITCON 2023 AMDCpuProfiler.sys demo such as [[hitcon-2023-demo-cve-2023-20562]] (gmh5225; CVE-2023-20562; AMD signed driver exploitation → local privilege escalation or arbitrary kernel code execution; conference PoC in the AMD driver BYOVD lane) complements physmem-focused [[amd-ryzen-master-driver-v17-exploit]].

Multi-exploit Windows kernel driver collection such as [[exploits]] (Bad-Jubies; AMD uProf AmdPowerProfiler.sys arbitrary file write CVE-2025-61969 + kernel write CVE-2026-0466; ASIO64 driver exploitation; MS-BKRP padding-oracle decryption; complements AMD profiling-driver PoCs in the same lane) sits beside [[hitcon-2023-demo-cve-2023-20562]] and [[windows-kernel-exploits]].

AMD atdcm64a.sys LPE PoC such as [[atdcm64a-lpe]] (MrAle98; C++ Visual Studio + deployment scripts; arbitrary pointer dereference in signed AMD driver; lab-oriented kernel exploitation template for driver security hardening and anti-cheat research) extends that AMD signed-driver lane beside [[hitcon-2023-demo-cve-2023-20562]].

Security-product handle-donor abuse such as [[dsark64]] targets Qihoo 360’s WHQL-signed DsArk64.sys (suspended installer + shellcode open \\.\DsArk, then DuplicateHandle → ring-0 process kill + kernel R/W).

WFP network-blinding abuse such as [[360wfp-exploit]] loads Qihoo 360’s 360netmon_x64.sys_wfp to block EDR/XDR network connections instead of terminating security processes.

Hardware-feature bypass PoCs such as [[smep-bypass]] use vulnerable-driver primitives (or ROP) to clear CR4.SMEP so the kernel can execute user-mode shellcode.

Agere Modem driver LPE such as [[cve-2025-24990-poc]] abuses ltmdm64.sys METHOD_NEITHER IOCTLs (missing user/kernel boundary checks) → 4-byte write via IOCTL_GET_VERSION + null-deref fixup via VirtualAlloc → arbitrary kernel R/W, with an IoRing LPE variant.

Game-AC driver abuse such as [[mhyprot2]] (gmh5225; IOCTL kernel R/W + process termination via mhyprot2.sys), [[mhyprot2drvcontrol]] (gmh5225; C++ control library wrapping the same driver's IOCTL surface for process R/W, module enumeration, and process kill), [[mhydeath]] (gmh5225; BYOVD arbitrary kernel R/W + process termination via the same signed AC driver), and [[evil-mhyprot-cli]] (CLI PoC for unprivileged kernel/user memory R/W on the same Genshin Impact driver; gmh5225 mhyprot::init service front end and kkent030315 fork) target miHoYo signed AC drivers in the canonical LOLdriver lane; CVE tracking [[cve-2020-36603]] (gmh5225; HoYoVerse mhyprot2.sys 1.0.0.0 fails to restrict unprivileged calls → SYSTEM LPE).

Physical-memory mapping abuse via msIo64.sys such as [[ms-io-exploit]] sits in the same cheat / vulnerable-driver research lane; the anycall project offers fuller client-and-driver-side physmem mapping.

Gigabyte gdrv64.sys/gdrv.sys loader research such as [[gdrv-loader]] (gmh5225; arbitrary R/W IOCTL → manual map unsigned PE; DSE bypass via BYOVD), [[gdrv-loader-v2]] (C/C++; alternate gdrv.sys loader in the cheat / vulnerable-driver lane), and updated loader [[gdrv-loader-updated]] (1337kenzo; C/C++; Win10/11 compatibility; streamlined vulnerable-driver byte loading; CLI load/unload; kernel security lab research; README [gdrv.sys Win11]), PoC exploit toolkit [[gdrv-sys-exploit]] (AmitMoshel1; C++ Visual Studio solution; arbitrary-write and shellcode-oriented gdrv.sys examples for modern Windows/Win11; educational BYOVD kernel exploitation research), plus reusable access-primitive library [[gdriver-lib]] (gmh5225; C++ wrapper for physmem R/W, physical mapping, and kernel ops via gdrv IOCTLs); Win10 KDP-aware unsigned loader [[kdp-compatible-driver-loader]] (gmh5225; gdrv.sys write primitives → SeCiCallbacks patch for DSE bypass on KDP-enabled builds); CVE-2018-19320 DSE-bypass PoC such as [[cve-2018-19320]] (gmh5225; ring-0 memcpy-like IOCTL → arbitrary kernel R/W → leak/toggle CI!g_CiOptions to disable DSE); LPE variant [[cve-2018-19320-lpe]] (gmh5225; arbitrary alloc/write IOCTLs → SYSTEM escalation; Win10 x64 21H1).

Intel iqvw64e.sys (Nal diagnostics) CVE-2015-2291 PoC such as [[cve-2015-2291]] (gmh5225; IOCTL-based arbitrary kernel memory R/W via the vulnerable Nal driver; NtQuerySystemInformation kernel-base leak for privilege escalation; foundational Intel BYOVD backend reused by kdmapper-family mappers such as [[saturn-mapper]] and [[kdu]]) sits in the canonical cheat / vulnerable-driver research lane.

Multi-provider unsigned-driver mappers such as [[kdu]] (Kernel Driver Utility; hfiref0x; extensible vulnerable-driver providers across Intel/ASUS/MSI/Gigabyte families; automated DSE bypass, PE map, cleanup) sit in the canonical cheat / driver-mapper research lane.

Lenovo diagnostics driver mapper research such as [[lenovo-mapper]] (gmh5225; LenovoDiagnosticsDriver.sys memory-access IOCTLs → manual unsigned driver map) targets the same BYOVD unsigned-load lane through a single OEM signed-driver backend.

Lenovo diagnostics driver arbitrary kernel execution such as [[lenovo-exec]] (gmh5225; LenovoDiagnosticsDriver.sys insecure IOCTL → custom kernel code; user-mode to kernel BYOVD chain) complements mapper-focused [[lenovo-mapper]] in the same OEM signed-driver research lane.

Multi-backend vulnerable-driver kits such as [[vdk]] (Vulnerable Driver Kit; gmh5225; unified interface across signed-driver backends including Speedfan.sys; kernel R/W, process manipulation, driver loading) complement single-driver PoCs in the same BYOVD research lane.

Dedicated Speedfan.sys PoC such as [[speedfan-exploit]] (gmh5225; SpeedFan hardware-monitoring IOCTL abuse → physical memory read/write for arbitrary kernel access; legacy monitoring-tool BYOVD research) sits in the same Speedfan.sys backend lane as [[vdk]].

OpenHardwareMonitor OpenHardwareMonitorLib.sys MSR-exposure PoC such as [[openhardwaremonitor-poc]] (gmh5225; minimal demo; IOCTLs 0x9C402084/0x9C402088 → arbitrary MSR read/write from user mode via read_msr/write_msr; hardware-monitoring driver MSR bug research) sits in the same legacy monitoring-tool BYOVD lane beside [[speedfan-exploit]].

Modular BYOVD primitive library such as [[vdm]] (Voyager Driver Manager; backengineering; C++; multi-backend vulnerable signed-driver API—gdrv, cpuz, etc.—→ physical memory R/W, virtual-address translation, kernel shellcode execution; modular backend for [[kdmapper]], [[msrexec]], and bluepill; BYOVD attack-primitive research) complements multi-backend kits such as [[vdk]].

MSR write→kernel-exec escalation library such as [[msrexec]] (backengineering; C++; arbitrary MSR write primitive → full kernel code execution via IA32_LSTAR syscall-handler redirect; [[vdm]] and bluepill backends for initial MSR capability; MSR-based kernel exploitation research) complements raw MSR-exposure PoCs such as [[openhardwaremonitor-poc]].

HP Hardware Diagnostics etdsupp.sys IOCTL LPE PoC such as [[hp-hardware-diagnostics-poc]] (gmh5225; HP OEM diagnostics kernel driver IOCTL abuse → elevated privileges on HP systems; preinstalled OEM-driver BYOVD research) complements other vendor diagnostics backends such as [[lenovo-mapper]].

C/C++ kernel utility research such as [[kur]] (gmh5225; echo_driver.sys vulnerable signed-driver backend; kernel R/W, process manipulation, driver-load primitives) sits in the same access-primitives lane.

Writeup-backed echo.ac echo_driver.sys LPE PoC such as [[echoac-poc]] (gmh5225; read-memory IOCTL → PsInitialSystemProcess / ActiveProcessLinks token theft → SYSTEM on spawned cmd.exe; anti-cheat-adjacent screenshare driver case study) complements utility-focused [[kur]] in the same backend lane.

AsUpIO.sys manual mapper research such as [[imxyvimapper]] (gmh5225; vulnerable signed-driver kernel access primitive → PE manual map with sections, imports, relocs, and entry invocation) sits in the same BYOVD unsigned-load lane.

nvaudio.sys manual mapper research such as [[ucmapper]] (gmh5225; user-mode loader reuses internal EncodePayLoad after loading the signed driver into user space; full PE relocation/import/image pipeline; runtime-list entry removal for post-load stealth) sits in the same BYOVD unsigned-load lane.

NVIDIA kernel-driver physmem library such as [[nvdrv]] (gmh5225; C++ wrapper; crafted IOCTLs to nvoclock/nvlddmkm → arbitrary physical memory R/W from user mode; BYOVD primitive for driver mapping, kernel patching, or AC bypass without loading a custom driver; README nvaudio.sys) complements mapper-focused [[ucmapper]] in the same NVIDIA signed-driver backend lane.

Classic Capcom.sys arbitrary kernel execution such as [[dolboeb-executor]] (gmh5225; load vulnerable signed driver → IOCTL abuse → custom kernel shellcode or arbitrary kernel function calls from user mode; BYOVD code-execution research) sits in the same historically abused LOLdriver lane referenced in step 1 of the typical chain above.

Capcom.sys DKOM tooling such as [[capcom-dkom]] (gmh5225; IOCTL 0xAA013044 ring-0 shellcode; MmGetSystemRoutineAddress for kernel API resolution; Direct Kernel Object Manipulation) extends that lane toward kernel object hiding/manipulation rather than generic code exec alone.

Cheat Engine dbk64.sys IOCTL abuse such as [[dbk64-vulnerability-driver]] (gmh5225; signed debugging-tool driver shipped with CE for kernel-mode memory access → arbitrary kernel R/W via vulnerable IOCTLs; BYOVD research on game-debugging driver backends) sits in the same cheat-tool / LOLdriver lane.

Dell dbutil_2_3.sys runtime test-signing toggle PoC such as [[ts-fucker]] (gmh5225; kernel R/W via already-loaded vulnerable driver → live-patch TestSigning state without reboot; symbol-assisted offset discovery for current Windows build; focused security-state manipulation, not a generic BYOVD toolkit) sits in the same LOLdriver / trust-state lane.

Dell dbutil_2_3.sys multifunction post-exploitation console such as [[kernel-cactus]] (gmh5225; user-mode toolkit; \\.\DBUtil_2_3 IOCTLs 0x9B0C1EC4/0x9B0C1EC8 → ETW disable, PPL toggle, protected-process kill, token copy, file delete, shellcode injection/thread hijack; broader BYOVD console than single-purpose [[ts-fucker]]) complements the same LOLdriver backend lane.

Educational multi-PoC BYOVD toolkit such as [[byovd-read-write-primitive]] (0xJs; C proof-of-concept tools; vulnerable signed driver → IOCTL kernel R/W with offset/symbol resolution; PPL change, token edit, ETW disable, callback/minifilter removal, DSE modification; authorized kernel security research and anti-cheat/EDR hardening gap study; README [BYOVD Read Write primitive]) sits in the same post-exploitation research lane beside [[kernel-cactus]] and [[edrsandblast]].

Reusable CVE-2021-21551 memory scaffold such as [[cve-2021-21551-poc]] (gmh5225; Memory class; virtual/physical R/W IOCTLs 0x9B0C1EC4/0x9B0C1EC8/0x9B0C1F40/0x9B0C1F44; ntoskrnl/EPROCESS/DirectoryTableBase demos; cleaner post-exploitation primitive layer than token-theft-only [[cve-2021-21551]]) sits in the same Dell LOLdriver lane.

ASUS bsitf.sys/AsusBSItf.sys contiguous-pool map IOCTL abuse such as [[asus-bsitf-0-day-poc]] (gmh5225; Rust PoC for CVE-2026-13585; IOCTL 0x222808 allocates physically contiguous NonPagedPool, maps it into the caller with full usermode R/W, and leaks virtual + physical addresses; IOCTL 0x22280C frees; NonPagedPool exhaustion and physaddr disclosure; executable kernel staging on older builds) sits in the OEM signed-driver BYOVD lane.

ASUS AsusBiosIoDrv64.sys hardware-monitoring IOCTL wrapper such as [[asusdrv]] (gmh5225; motherboard utility driver IOCTL abuse → physical memory R/W; BYOVD primitive for kernel exploitation research) sits in the same OEM utility-driver physmem lane beside [[openhardwaremonitor-poc]].

ASUS AsIO3.sys LPE PoC such as [[asio-exploit]] (gmh5225; native-syscall shellcode opens \Device\Asusgio3 → ASIO_RDMSR_IOCTL/ASIO_WRMSR_IOCTL MSR access plus ASIO_ADDPID parent-PID trust bypass; authorization-model + IOCTL-surface abuse for LPE research) sits in the same OEM utility-driver lane beside [[asusdrv]].

ASUS asromgdrv.sys IOCTL communication research such as [[windows-10-22h2-vulnerable-driver-communication]] (gmh5225; user-mode wrapper opens \\.\AsrOmgDrv and drives vendor IOCTLs via DeviceIoControl; contiguous kernel memory alloc/free plus control-register R/W; still loadable on Win10 22H2 / Win11; reversed-interface study for BYOVD tooling) sits in the same OEM signed-driver communication lane.

Multi-driver exploit collection such as [[win-driver-exp]] (gmh5225; exploit code for multiple vulnerable signed drivers via insecure IOCTLs → arbitrary kernel R/W, code execution, process manipulation; README includes AsUpIO64.sys / CVE-2024-33218) complements single-driver PoCs like [[imxyvimapper]] in the same BYOVD research lane.

Related

[[kernel-callbacks]] · [[hvci]] · [[msft-driverblocklist]] · [[ms-vulnerable-driver-list]] · [[loldrivers]] · [[hvci-loldrivers-check]] · [[byovdfinder]] · [[loldrivers-client]] · [[physmem-drivers]] · [[patchguard]] · [[dse-pg-bypass]] · [[windows-kernel-exploits]] · [[exploits]] · [[hacksysextremevulnerabledriver]] · [[smep-bypass]] · [[ven0m-ransomware]] · [[av-edr-killer]] · [[byovd-edrkiller]] · [[edr-xdr-av-killer]] · [[watchdog-killer]] · [[terminator]] · [[blackout]] · [[avasthv]] · [[evil-kaspersky]] · [[process-killer-byovd]] · [[nsecsoft-byovd]] · [[poison-killer-bof]] · [[killer]] · [[killer-exercice]] · [[kernel-cactus]] · [[byovd-read-write-primitive]] · [[pplkiller]] · [[forti-research]] · [[ts-fucker]] · [[zam64-zemina]] · [[s4killer]] · [[s4mapper]] · [[rtcore64-vulnerability]] · [[razer-rzctl]] · [[cve-2015-2291]] · [[cve-2017-9769]] · [[qiomem]] · [[amd-ryzen-master-driver-v17-exploit]] · [[badrentdrv2]] · [[throttlestop-poc]] · [[phantomkiller]] · [[dsark64]] · [[360wfp-exploit]] · [[lenovo-cve-2025-8061]] · [[lenovo-mapper]] · [[lenovo-exec]] · [[imxyvimapper]] · [[ucmapper]] · [[nvdrv]] · [[win-driver-exp]] · [[dolboeb-executor]] · [[dbk64-vulnerability-driver]] · [[asus-bsitf-0-day-poc]] · [[asusdrv]] · [[asio-exploit]] · [[windows-10-22h2-vulnerable-driver-communication]] · [[cve-2025-24990-poc]] · [[cpuz]] · [[pdfwkrnl-exploit]] · [[pdfwkrnl-mapper]] · [[ampa-sys-exp]] · [[mhydeath]] · [[mhyprot2]] · [[mhyprot2drvcontrol]] · [[evil-mhyprot-cli]] · [[ms-io-exploit]] · [[gdrv-loader]] · [[gdrv-loader-v2]] · [[gdrv-sys-exploit]] · [[gdriver-lib]] · [[kdu]] · [[vdk]] · [[speedfan-exploit]] · [[openhardwaremonitor-poc]] · [[kur]] · [[echoac-poc]] · [[kvc]] · [[kslkatz]] · [[ksldump]] · [[kernel-research-kit]] · [[windefctl]] · [[edrsandblast]] · [[overviews/windows-kernel]] · [[overviews/game-hacking]]