DeepZero: Open-source hunting for vulnerable Windows drivers
DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.
DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.
- Seven-stage pipeline parses PE headers, keeps kernel drivers with IOCTL surfaces, and excludes loldrivers.io entries.
- Uses headless Ghidra decompilation and Semgrep rules before an LLM assesses exploitability at the end.
- Records IoCreateDevice call location to indicate whether findings can be confirmed without physical hardware.
- Maintainer reports verified vulnerabilities in the Snappy Driver Installer corpus with disclosures pending.
- Free on GitHub; the engine is target-agnostic beyond Windows kernel drivers.
From the original article
2 min read at helpnetsecurity.com
DeepZero is an open-source engine that automates the search for exploitable Windows kernel drivers. You point it at a folder of binaries and it parses them, pulls them apart, scans them, throws most of them away, and asks a language model whether what survives can be attacked. Pipelines are written in YAML, the code is Python 3.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.