Sep 19, 2026 · Kernel · 11 min
The hunt for the golden driver
I processed 807 signed Windows kernel drivers looking for one that hands kernel access to any user who asks. I found it.
Sep 19, 2026 · Kernel · 14 min
The magic word
Three signed kernel drivers from three different vendors all authenticate any caller who sends one hardcoded string. None of them are in any blocklist.
Sep 18, 2026 · Kernel · 12 min
Callback-free process birth via self-re-execution
The kernel tells EDR drivers about every new process. Unless you zero out the notification list first, then spawn yourself as the child.
Sep 18, 2026 · Kernel · 18 min
Loading unsigned drivers when g_CiOptions is read-only
Windows 11's hypervisor protects the classic DSE bypass target. But the kernel calls CI.dll through a function pointer table that the hypervisor doesn't touch.
Sep 18, 2026 · Kernel · 16 min
From MSR write to ring zero in one syscall
What the full chain looks like when a signed driver hands you an unrestricted MSR write and the CPU itself becomes your only hook.
Sep 17, 2026 · Kernel · 11 min
Not all kernel writes are equal
The write primitive your BYOVD driver gives you determines which kernel techniques you can use, and which ones will BSOD the box.
Feb 22, 2026 · Edr-bypass · 14 min
Why indirect syscalls still work
Direct syscalls used to dodge EDR hooks just fine. Then endpoint vendors started checking where the syscall instruction lives in memory. The fix is simpler than you'd think.