redteamfortress / KillerLand

Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you.

hfiref0x / KDU

Kernel Driver Utility

DeathShotXD / 0xM0nCrush

Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.

Rurixis / MSRKit

A concept of using a ROP chain paired with a WRMSR primitive to call kernel functions and map unsigned drivers through BYOVD (AmdTools64.sys)

nbs32k / LocalStranger

PoC for WinNotify, demonstrated through a driver mapper, and local privilege escalation.

DeathShotXD / 0xCr0ssCrush

Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.

security-attack / RingKiller

RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminateProcess. EDR/AV termination primitive. Lab only.