Advanced PoC & Research for CVE-2026-0828 (Safetica) and CVE-2025-7771 (ThrottleStop). Analysis of BYOVD (Bring Your Own Vulnerable Driver) TTPs for Ring 0 process termination and physical memory R/W. Researching EDR-Killer patterns, PPL bypasses, and kernel-mode primitives used by MedusaLocker and other threat actors.
☆60Oct 3, 2026Updated last month
Alternatives and similar repositories for 0xKern3lCrush
Users that are interested in 0xKern3lCrush are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- PPLReaper is a Windows UNSIGNED kernel driver + userland companion tool designed to inspect and manipulate Protected Process Light (PPL) …☆26Mar 4, 2026Updated 8 months ago
- BYOVD research performed by KOSEC. Includes vulnerable drivers and writeups (CVE-2026-0828).☆14May 28, 2026Updated 5 months ago
- SmuggleMyPayload generates HTML pages that embed and reconstruct files client-side using JavaScript. The toolkit offers multiple HTML Smu…☆57Oct 13, 2026Updated 3 weeks ago
- Static analysis & exploitation-triage toolkit for Windows kernel drivers. Discover IOCTLs, Symbolic Links, and check cert , and Downlaods…☆211Apr 27, 2026Updated 6 months ago
- Novel Windows process injection: assembles existing open handles (process & thread), natural RWX regions, and special user APC (NtQueueAp…☆81Feb 17, 2026Updated 8 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opport…☆38Oct 27, 2026Updated last week
- CVE-2025-7771: Arbitrary physical memory and I/O port read/write via ThrottleStop driver☆19Sep 5, 2025Updated last year
- Handle Redirect via BYOVD Kernel Read/Write☆22Sep 13, 2026Updated last month
- Rust-based Windows kernel driver research project with a companion user-mode client for IOCTL-based experiments with process, token, PPL,…☆20Apr 30, 2026Updated 6 months ago
- Evasive loader for .NET Framework assemblies☆84May 12, 2026Updated 5 months ago
- My studies on Malware Development☆22Jul 6, 2026Updated 4 months ago
- Performs a global AMSI bypass by patching amsi.dll in memory.☆22Updated this week
- Process ID Mutator via BYOVD Kernel R/W☆22Sep 6, 2026Updated 2 months ago
- Pure-Go offensive-security primitives library: syscalls, evasion (AMSI/ETW/unhook/sleepmask), injection, PE packer, credentials, post-ex,…☆27Jul 13, 2026Updated 3 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Exploit LnvMSRIO.sys vulnerable driver☆18Dec 10, 2025Updated 10 months ago
- KslDump — Why bring your own knife when Defender already left one in the kitchen?☆420Apr 13, 2026Updated 6 months ago
- Havoc BOF implementation of BYOVD attack to terminate PPL-protected EDR processes using a signed Microsoft kernel driver.☆42Apr 6, 2026Updated 7 months ago
- COM Windows Persistence Technique☆91Apr 27, 2026Updated 6 months ago
- Find Windows RWX Memory Regions depending on the memory space needed☆18Nov 26, 2023Updated 2 years ago
- Surgical UNWIND_INFO preservation for sleep masking without call stack spoofing.☆56Mar 30, 2026Updated 7 months ago
- EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)☆78Oct 18, 2026Updated 3 weeks ago
- ☆75Apr 20, 2026Updated 6 months ago
- BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE…☆1,009Aug 18, 2026Updated 2 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- AV/EDR processes termination by exploiting a vulnerable driver (BYOVD)☆304Jan 21, 2026Updated 9 months ago
- Rust based C2 Framework☆35Sep 29, 2026Updated last month
- Terminate Processes from a Kernel Driver receiving the process to kill via simple userland application☆15Oct 10, 2024Updated 2 years ago
- Vulnerable Drivers☆13Jul 30, 2026Updated 3 months ago
- C++ Implementation to Hide File in ADS with the option of Encrpytion + Fragmentation☆13Dec 18, 2024Updated last year
- C++23 compile time integral encryption.☆11Dec 2, 2023Updated 2 years ago
- Run PowerShell command without invoking powershell.exe☆27Apr 9, 2026Updated 6 months ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆112Oct 27, 2026Updated last week
- AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64☆638Oct 24, 2026Updated 2 weeks ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Monitoring Process Creation/Termination, Thread Creation/Termination and Image Load Notifications from a Kernel Driver☆13Oct 22, 2024Updated 2 years ago
- DLL Injector leveraging EAC for injection☆20Apr 15, 2025Updated last year
- C++ Code to Bypass Sandbox and VM via RAM and Core victim info☆10Apr 3, 2023Updated 3 years ago
- Six-layer call-stack spoofing via .pdata lacunae — defeats ETW-Ti, kernel callbacks, CET shadow stack, and return-address validation in…☆204Jun 25, 2026Updated 4 months ago
- Simple C++ Rendering Framework for DX11-DX12☆22Apr 22, 2026Updated 6 months ago
- Windows Defender Killer | Registry-Based Disablement + BYOVD Process Termination (C++)☆569Apr 2, 2026Updated 7 months ago
- A simple POC to show how to chain multiple callbacks via tail calls to artificially construct a call stack☆114May 25, 2026Updated 5 months ago