byovd

Kernel Driver Utility

BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, CVE-2026-8501).

🤖 Kill The Protected Process 🤖

KslDump — Why bring your own knife when Defender already left one in the kitchen?

yet another AV killer tool using BYOVD

Another BYOVD process killer. works on all EDR's. fully signed.

Windows rootkit designed to work with BYOVD exploits

「💀」Proof of concept on BYOVD attack

BYOVD hunter to help prioritize windows drivers worth manual analysis

BYOVD tool for manipulating Windows Protected Process Light (PPL) protection at the kernel level.

Driver Reverse & Exploitation

DSE & PG bypass via BYOVD attack

Advanced PoC & Research for CVE-2026-0828 (Safetica) and CVE-2025-7771 (ThrottleStop). Analysis of BYOVD (Bring Your Own Vulnerable Driver) TTPs for Ring 0 process termination and physical memory R/W. Researching EDR-Killer patterns, PPL bypasses, and kernel-mode primitives used by MedusaLocker and other threat actors.

Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.

「⚠️」Performing a BYOVD on the truesight.sys driver

Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.

CVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory

A BYOVD technique abuse tool

Pure-Go offensive-security primitives library: syscalls, evasion (AMSI/ETW/unhook/sleepmask), injection, PE packer, credentials, post-ex, C2. MITRE ATT&CK mapped. Authorized research only.

📟 a tiny code that performs kernel-mode read/write using CVE-2023-38817.