DeathShotXD / 0xCr0ssCrush

Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.

NomanNasirMinhas / Ringer

Static + live analysis of Windows kernel drivers: extract IOCTL codes and shared ring-buffer strings, then load the driver and verify every finding against the running system.

security-attack / RingKiller

RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminateProcess. EDR/AV termination primitive. Lab only.

Applet-LLC / OpenInputBridge

Clean-room, original-protocol-compatible reimplementation of the Interception keyboard/mouse kernel driver's IOCTL protocol for Windows 11.