byovd

Kernel Driver Utility

BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, CVE-2026-8501).

🤖 Kill The Protected Process 🤖

KslDump — Why bring your own knife when Defender already left one in the kitchen?

yet another AV killer tool using BYOVD

Another BYOVD process killer. works on all EDR's. fully signed.

Windows rootkit designed to work with BYOVD exploits

「💀」Proof of concept on BYOVD attack

BYOVD hunter to help prioritize windows drivers worth manual analysis

Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.

BYOVD tool for manipulating Windows Protected Process Light (PPL) protection at the kernel level.

Driver Reverse & Exploitation

DSE & PG bypass via BYOVD attack

Advanced PoC & Research for CVE-2026-0828 (Safetica) and CVE-2025-7771 (ThrottleStop). Analysis of BYOVD (Bring Your Own Vulnerable Driver) TTPs for Ring 0 process termination and physical memory R/W. Researching EDR-Killer patterns, PPL bypasses, and kernel-mode primitives used by MedusaLocker and other threat actors.

「⚠️」Performing a BYOVD on the truesight.sys driver

Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.

PoC for WinNotify, demonstrated through a driver mapper, and local privilege escalation.

Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.

CVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory

RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminateProcess. EDR/AV termination primitive. Lab only.