DeepZero: Open-source hunting for vulnerable Windows drivers
DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.
DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.
- Seven-stage pipeline parses PE headers, keeps kernel drivers with IOCTL surfaces, and excludes loldrivers.io entries.
- Uses headless Ghidra decompilation and Semgrep rules before an LLM assesses exploitability at the end.
- Records IoCreateDevice call location to indicate whether findings can be confirmed without physical hardware.
- Maintainer reports verified vulnerabilities in the Snappy Driver Installer corpus with disclosures pending.
- Free on GitHub; the engine is target-agnostic beyond Windows kernel drivers.
Full article478 words · extracted from helpnetsecurity.com · click to collapse
DeepZero is an open-source engine that automates the search for exploitable Windows kernel drivers. You point it at a folder of binaries and it parses them, pulls them apart, scans them, throws most of them away, and asks a language model whether what survives can be attacked. Pipelines are written in YAML, the code is Python 3.11 and up.
Rehman Ahmadzai, who maintains the project, said DeepZero has “found multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus, with some still undergoing the disclosure process.” The bundled pipeline targets BYOVD, short for bring your own vulnerable driver: an attacker loads a legitimately signed driver that contains a flaw and uses it to reach the kernel.
What the pipeline does
Seven stages run in order. The first parses PE headers. The second keeps only kernel-mode drivers that expose IOCTL surfaces, the control codes user space sends a driver to make it do something. The third excludes drivers already cataloged on loldrivers.io, the public list defenders block from. Ghidra then runs headless over what is left, Semgrep rules scan the exported C source, a reduce step named pick_top_10 trims the field to a top candidate tier, and only then does a model assess exploitability.
Anything the model sees got past that third filter.
“The AI evaluation step is placed at the end so that the earlier stages can gather context (such as binary decompilation, filtering out pre-known vulnerable drivers or unsupported/32-bit binaries from the pipeline) which will be evaluated by the AI step in the end,” Ahmadzai told Help Net Security.
A finding may still need the physical hardware
Many drivers create their device object only once their hardware is enumerated. On a machine or VM without that device, the path never opens, nothing the driver exposes can be reached, and from the report alone that looks identical to a driver with nothing wrong with it. The decompile stage records which function calls IoCreateDevice and whether that function is DriverEntry or something DriverEntry calls. A true value means the device appears on any machine that will load the driver, so a finding against it can be confirmed. False usually means a plug-and-play callback creates it, and confirming anything takes the hardware. When IoCreateDevice is not found at all, the stage records neither value instead of guessing.
“DeepZero’s underlying engine is already built as a target-agnostic pipeline orchestrator. While the included loldrivers research pipeline is specifically tailored for Windows kernel drivers, the framework itself is not restricted to a single architecture or binary type,” Ahmadzai said.
DeepZero is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/16/vulnerable-windows-drivers-deepzero-open-source/