Kernel Driver Utility

🤖 Kill The Protected Process 🤖

yet another AV killer tool using BYOVD

Some POCs for my BYOVD research and find some vulnerable drivers

「💀」Proof of concept on BYOVD attack

DSE & PG bypass via BYOVD attack

「⚠️」Performing a BYOVD on the truesight.sys driver

📟 A tiny code that performs kernel-mode read/write using CVE-2023-38817.

Dump ntoskrnl.exe important offsets for building your navigation system in the Windows Kernel, using Radare2 and Rust

Backstab rewrite in nim, AV/EDR killer

BYOVD IOCs (Based LOLDrivers)

Local privilege escalation PoC exploit for CVE-2019-16098

This exploit rebuilds and exploit the CVE-2019-16098 which is in driver Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. Instead of hardcoded base address of Ntoskrnl.exe, I calculated it dynamically and recalulated the fields offsets