How blacksnufkin/byovd works
BYOVD is a collection of Windows proof-of-concept process terminators using vulnerable drivers. The common workflow accepts a target process name, resolves it to a PID, loads or attaches to a driver, sends a driver-specific IOCTL, and may monitor for newly appearing targets and clean up. Most PoCs use the shared library; K7Terminator and several named PoCs have distinct standalone implementations. The README documents additional low-level library modes, but their wiring is not fully shown in the sampled source.
Main entry points: lib.rs Run Orchestrator · process.rs Process Lookup · device.rs Device IOCTL · main.rs K7 LPE/BYOVD
Components 25
Shared Runtime
- Driver Config
byovd-lib/src/lib.rs - Run Orchestrator
byovd-lib/src/lib.rs - Process Lookup
byovd-lib/src/process.rs - Privilege Checks
byovd-lib/src/privilege.rs - Driver Service
byovd-lib/src/service.rs - Device IOCTL
byovd-lib/src/device.rs - Target Monitor
byovd-lib/src/monitor.rs - RAII Handles
byovd-lib/src/handle.rs
Shared-Library PoCs
- PoC CLI
BdApiUtil-Killer/src/main.rs - Standard Driver PoCs
AppRemover-Killer/src/main.rs - HONOR Driver PoCs
HNOs2Ec-Killer/src/main.rs - GameDriver PoC
GameDriverX64-Killer/src/main.rs - Safetica PoC
STProcessMonitor-Killer/src/main.rs - PCTcore PoC
PCTcore64-Killer/src/main.rs - Unknown Driver PoC
UnknownKiller/src/main.rs - Viragt PoC
Viragt64-Killer/src/main.rs
Standalone PoCs
- K7 LPE/BYOVD
K7Terminator/src/main.rs - Astra Shadow SSDT
Astra64-Killer/src/main.rs - Ktapi Shellcode
Ktapi-Killer/src/main.rs - Xhunter Handle Stomp
Xhunter1-Killer/src/main.rs
Windows Environment
- Windows OS
- Service Control Manager
- Vulnerable Driver
- Target Processes
Other components
- Operator
Connections 33
- Operator → PoC CLI: provides target
- PoC CLI → Driver Config: defines driver
- PoC CLI → Run Orchestrator: invokes run
- Driver Config → Run Orchestrator: configures
- Run Orchestrator → Privilege Checks: checks privileges
- Run Orchestrator → Process Lookup: resolves targets
- Process Lookup → Windows OS: queries processes
- Run Orchestrator → Driver Service: manages service
- Driver Service → Service Control Manager: installs and starts
- Run Orchestrator → Device IOCTL: dispatches IOCTL
- Device IOCTL → Vulnerable Driver: sends request
- Run Orchestrator → Target Monitor: starts monitoring
- Target Monitor → Process Lookup: checks targets
- Run Orchestrator → RAII Handles: uses wrappers
- Standard Driver PoCs → Run Orchestrator: calls run
- HONOR Driver PoCs → Run Orchestrator: calls run
- GameDriver PoC → Run Orchestrator: calls run
- Safetica PoC → Run Orchestrator: calls run
- PCTcore PoC → Run Orchestrator: calls run
- PCTcore PoC → Device IOCTL: attach dispatch
- Unknown Driver PoC → Run Orchestrator: calls run
- Unknown Driver PoC → Device IOCTL: attach dispatch
- Viragt PoC → Run Orchestrator: calls run
- K7 LPE/BYOVD → Service Control Manager: manages service
- K7 LPE/BYOVD → Vulnerable Driver: sends IOCTL
- K7 LPE/BYOVD → Target Processes: enumerates processes
- Astra Shadow SSDT → Vulnerable Driver: reads and patches
- Astra Shadow SSDT → Target Processes: targets processes
- Ktapi Shellcode → Vulnerable Driver: accesses physical memory
- Ktapi Shellcode → Target Processes: targets processes
- Xhunter Handle Stomp → Vulnerable Driver: sends commands
- Xhunter Handle Stomp → Target Processes: finds and verifies
- Process Lookup → Target Processes: resolves names