Kernel Driver Utility

🤖 Kill The Protected Process 🤖

yet another AV killer tool using BYOVD

Some POCs for my BYOVD research and find some vulnerable drivers

「💀」Proof of concept on BYOVD attack

DSE & PG bypass via BYOVD attack

「⚠️」Performing a BYOVD on the truesight.sys driver

📟 A tiny code that performs kernel-mode read/write using CVE-2023-38817.

Some basic info, resources, and code snippets about windows kernel exploitation

Dump ntoskrnl.exe important offsets for building your navigation system in the Windows Kernel, using Radare2 and Rust

BYOVD IOCs (Based LOLDrivers)

Backstab rewrite in nim, AV/EDR killer

Local privilege escalation PoC exploit for CVE-2019-16098

This exploit rebuilds and exploit the CVE-2019-16098 which is in driver Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. Instead of hardcoded base address of Ntoskrnl.exe, I calculated it dynamically and recalulated the fields offsets