Skip to content

BYOVD

Jump to bottom
NeverSightAI edited this page Jul 16, 2026 · 2 revisions

BYOVD

Bring Your Own Vulnerable Driver: load a legitimately signed but vulnerable driver to obtain kernel read/write (or other primitives), then disable protections, map unsigned code, or blind anti-cheat.

Typical chain

  1. Load signed vulnerable driver (e.g. historically abused families like Capcom, RTCore, iqvw64e, dbutil, …)
  2. Trigger vulnerable IOCTL / bug for arbitrary R/W
  3. Tamper with DSE, callbacks, ETW, or load a hostile mapper

Mitigations

Microsoft vulnerable-driver blocklist, HVCI, AC driver allowlists (Vanguard-style), PiDDBCache/MmUnloadedDrivers forensics, EPT-protected callback lists.

Related

Kernel Callbacks · HVCI · PatchGuard · Windows Kernel · Game Hacking

awesome-game-security · gs.awesome.rip · Wiki mirrors the in-repo knowledge layer under wiki/

Home

Guides

Topics

Reference

External

Clone this wiki locally