# blacksnufkin/byovd architecture

> Architecture diagram of the GitHub repository blacksnufkin/byovd, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/blacksnufkin/byovd
- Repository: https://github.com/blacksnufkin/byovd

## Overview

BYOVD is a collection of Windows proof-of-concept process terminators using vulnerable drivers. The common workflow accepts a target process name, resolves it to a PID, loads or attaches to a driver, sends a driver-specific IOCTL, and may monitor for newly appearing targets and clean up. Most PoCs use the shared library; K7Terminator and several named PoCs have distinct standalone implementations. The README documents additional low-level library modes, but their wiring is not fully shown in the sampled source.

Main entry points: [`byovd-lib/src/lib.rs`](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/lib.rs) (Run Orchestrator), [`byovd-lib/src/process.rs`](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/process.rs) (Process Lookup), [`byovd-lib/src/device.rs`](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/device.rs) (Device IOCTL), [`K7Terminator/src/main.rs`](https://github.com/blacksnufkin/byovd/blob/main/K7Terminator/src/main.rs) (K7 LPE/BYOVD)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_shared["Shared Runtime"]
  node_config["Driver Config<br/>[lib.rs]"]
  node_run["Run Orchestrator<br/>[lib.rs]"]
  node_process["Process Lookup<br/>[process.rs]"]
  node_privilege["Privilege Checks<br/>[privilege.rs]"]
  node_service["Driver Service<br/>[service.rs]"]
  node_device["Device IOCTL<br/>[device.rs]"]
  node_monitor["Target Monitor<br/>[monitor.rs]"]
  node_handles["RAII Handles<br/>[handle.rs]"]
end

subgraph group_pocs["Shared-Library PoCs"]
  node_common_cli["PoC CLI<br/>[main.rs]"]
  node_standard_pocs["Standard Driver PoCs<br/>[main.rs]"]
  node_honor_pocs["HONOR Driver PoCs<br/>[main.rs]"]
  node_game_poc["GameDriver PoC<br/>[main.rs]"]
  node_safetica_poc["Safetica PoC<br/>[main.rs]"]
  node_pct_poc["PCTcore PoC<br/>[main.rs]"]
  node_unknown_poc["Unknown Driver PoC<br/>[main.rs]"]
  node_viragt_poc["Viragt PoC<br/>[main.rs]"]
end

subgraph group_standalone["Standalone PoCs"]
  node_k7["K7 LPE/BYOVD<br/>[main.rs]"]
  node_astra["Astra Shadow SSDT<br/>[main.rs]"]
  node_ktapi["Ktapi Shellcode<br/>[main.rs]"]
  node_xhunter["Xhunter Handle Stomp<br/>[main.rs]"]
end

subgraph group_external["Windows Environment"]
  node_windows["Windows OS"]
  node_scm["Service Control Manager"]
  node_driver["Vulnerable Driver"]
  node_targets[("Target Processes")]
end

node_user(("Operator"))

node_user -->|"provides target"| node_common_cli
node_common_cli -->|"defines driver"| node_config
node_common_cli -->|"invokes run"| node_run
node_config -->|"configures"| node_run
node_run -->|"checks privileges"| node_privilege
node_run -->|"resolves targets"| node_process
node_process -->|"queries processes"| node_windows
node_run -->|"manages service"| node_service
node_service -->|"installs and starts"| node_scm
node_run -->|"dispatches IOCTL"| node_device
node_device -->|"sends request"| node_driver
node_run -->|"starts monitoring"| node_monitor
node_monitor -->|"checks targets"| node_process
node_run -->|"uses wrappers"| node_handles
node_standard_pocs -->|"calls run"| node_run
node_honor_pocs -->|"calls run"| node_run
node_game_poc -->|"calls run"| node_run
node_safetica_poc -->|"calls run"| node_run
node_pct_poc -->|"calls run"| node_run
node_pct_poc -->|"attach dispatch"| node_device
node_unknown_poc -->|"calls run"| node_run
node_unknown_poc -->|"attach dispatch"| node_device
node_viragt_poc -->|"calls run"| node_run
node_k7 -->|"manages service"| node_scm
node_k7 -->|"sends IOCTL"| node_driver
node_k7 -->|"enumerates processes"| node_targets
node_astra -->|"reads and patches"| node_driver
node_astra -->|"targets processes"| node_targets
node_ktapi -->|"accesses physical memory"| node_driver
node_ktapi -->|"targets processes"| node_targets
node_xhunter -->|"sends commands"| node_driver
node_xhunter -->|"finds and verifies"| node_targets
node_process -->|"resolves names"| node_targets

click node_common_cli "https://github.com/blacksnufkin/byovd/blob/main/BdApiUtil-Killer/src/main.rs"
click node_config "https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/lib.rs"
click node_run "https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/lib.rs"
click node_process "https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/process.rs"
click node_privilege "https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/privilege.rs"
click node_service "https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/service.rs"
click node_device "https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/device.rs"
click node_monitor "https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/monitor.rs"
click node_handles "https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/handle.rs"
click node_standard_pocs "https://github.com/blacksnufkin/byovd/blob/main/AppRemover-Killer/src/main.rs"
click node_honor_pocs "https://github.com/blacksnufkin/byovd/blob/main/HNOs2Ec-Killer/src/main.rs"
click node_game_poc "https://github.com/blacksnufkin/byovd/blob/main/GameDriverX64-Killer/src/main.rs"
click node_safetica_poc "https://github.com/blacksnufkin/byovd/blob/main/STProcessMonitor-Killer/src/main.rs"
click node_pct_poc "https://github.com/blacksnufkin/byovd/blob/main/PCTcore64-Killer/src/main.rs"
click node_unknown_poc "https://github.com/blacksnufkin/byovd/blob/main/UnknownKiller/src/main.rs"
click node_viragt_poc "https://github.com/blacksnufkin/byovd/blob/main/Viragt64-Killer/src/main.rs"
click node_k7 "https://github.com/blacksnufkin/byovd/blob/main/K7Terminator/src/main.rs"
click node_astra "https://github.com/blacksnufkin/byovd/blob/main/Astra64-Killer/src/main.rs"
click node_ktapi "https://github.com/blacksnufkin/byovd/blob/main/Ktapi-Killer/src/main.rs"
click node_xhunter "https://github.com/blacksnufkin/byovd/blob/main/Xhunter1-Killer/src/main.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_config,node_run,node_process,node_privilege,node_service,node_device,node_monitor,node_handles toneBlue
class node_common_cli,node_standard_pocs,node_honor_pocs,node_game_poc,node_safetica_poc,node_pct_poc,node_unknown_poc,node_viragt_poc toneAmber
class node_k7,node_astra,node_ktapi,node_xhunter toneMint
class node_windows,node_scm,node_driver,node_targets toneRose
class node_user toneIndigo
```

## Components

### Shared Runtime

- [Driver Config](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/lib.rs): `byovd-lib/src/lib.rs`
- [Run Orchestrator](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/lib.rs): `byovd-lib/src/lib.rs`
- [Process Lookup](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/process.rs): `byovd-lib/src/process.rs`
- [Privilege Checks](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/privilege.rs): `byovd-lib/src/privilege.rs`
- [Driver Service](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/service.rs): `byovd-lib/src/service.rs`
- [Device IOCTL](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/device.rs): `byovd-lib/src/device.rs`
- [Target Monitor](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/monitor.rs): `byovd-lib/src/monitor.rs`
- [RAII Handles](https://github.com/blacksnufkin/byovd/blob/main/byovd-lib/src/handle.rs): `byovd-lib/src/handle.rs`

### Shared-Library PoCs

- [PoC CLI](https://github.com/blacksnufkin/byovd/blob/main/BdApiUtil-Killer/src/main.rs): `BdApiUtil-Killer/src/main.rs`
- [Standard Driver PoCs](https://github.com/blacksnufkin/byovd/blob/main/AppRemover-Killer/src/main.rs): `AppRemover-Killer/src/main.rs`
- [HONOR Driver PoCs](https://github.com/blacksnufkin/byovd/blob/main/HNOs2Ec-Killer/src/main.rs): `HNOs2Ec-Killer/src/main.rs`
- [GameDriver PoC](https://github.com/blacksnufkin/byovd/blob/main/GameDriverX64-Killer/src/main.rs): `GameDriverX64-Killer/src/main.rs`
- [Safetica PoC](https://github.com/blacksnufkin/byovd/blob/main/STProcessMonitor-Killer/src/main.rs): `STProcessMonitor-Killer/src/main.rs`
- [PCTcore PoC](https://github.com/blacksnufkin/byovd/blob/main/PCTcore64-Killer/src/main.rs): `PCTcore64-Killer/src/main.rs`
- [Unknown Driver PoC](https://github.com/blacksnufkin/byovd/blob/main/UnknownKiller/src/main.rs): `UnknownKiller/src/main.rs`
- [Viragt PoC](https://github.com/blacksnufkin/byovd/blob/main/Viragt64-Killer/src/main.rs): `Viragt64-Killer/src/main.rs`

### Standalone PoCs

- [K7 LPE/BYOVD](https://github.com/blacksnufkin/byovd/blob/main/K7Terminator/src/main.rs): `K7Terminator/src/main.rs`
- [Astra Shadow SSDT](https://github.com/blacksnufkin/byovd/blob/main/Astra64-Killer/src/main.rs): `Astra64-Killer/src/main.rs`
- [Ktapi Shellcode](https://github.com/blacksnufkin/byovd/blob/main/Ktapi-Killer/src/main.rs): `Ktapi-Killer/src/main.rs`
- [Xhunter Handle Stomp](https://github.com/blacksnufkin/byovd/blob/main/Xhunter1-Killer/src/main.rs): `Xhunter1-Killer/src/main.rs`

### Windows Environment

- **Windows OS**
- **Service Control Manager**
- **Vulnerable Driver**
- **Target Processes**

### Other components

- **Operator**

## Connections

- Operator → PoC CLI: provides target
- PoC CLI → Driver Config: defines driver
- PoC CLI → Run Orchestrator: invokes run
- Driver Config → Run Orchestrator: configures
- Run Orchestrator → Privilege Checks: checks privileges
- Run Orchestrator → Process Lookup: resolves targets
- Process Lookup → Windows OS: queries processes
- Run Orchestrator → Driver Service: manages service
- Driver Service → Service Control Manager: installs and starts
- Run Orchestrator → Device IOCTL: dispatches IOCTL
- Device IOCTL → Vulnerable Driver: sends request
- Run Orchestrator → Target Monitor: starts monitoring
- Target Monitor → Process Lookup: checks targets
- Run Orchestrator → RAII Handles: uses wrappers
- Standard Driver PoCs → Run Orchestrator: calls run
- HONOR Driver PoCs → Run Orchestrator: calls run
- GameDriver PoC → Run Orchestrator: calls run
- Safetica PoC → Run Orchestrator: calls run
- PCTcore PoC → Run Orchestrator: calls run
- PCTcore PoC → Device IOCTL: attach dispatch
- Unknown Driver PoC → Run Orchestrator: calls run
- Unknown Driver PoC → Device IOCTL: attach dispatch
- Viragt PoC → Run Orchestrator: calls run
- K7 LPE/BYOVD → Service Control Manager: manages service
- K7 LPE/BYOVD → Vulnerable Driver: sends IOCTL
- K7 LPE/BYOVD → Target Processes: enumerates processes
- Astra Shadow SSDT → Vulnerable Driver: reads and patches
- Astra Shadow SSDT → Target Processes: targets processes
- Ktapi Shellcode → Vulnerable Driver: accesses physical memory
- Ktapi Shellcode → Target Processes: targets processes
- Xhunter Handle Stomp → Vulnerable Driver: sends commands
- Xhunter Handle Stomp → Target Processes: finds and verifies
- Process Lookup → Target Processes: resolves names