Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective

This article details a technique for evaluating the exploitability of Windows kernel mode drivers, focusing on the potential for BYOVD (Bring Your Own Vulnerability Driver) attacks. It highlights how vulnerabilities in drivers, particularly those lacking hardware dependencies, can be leveraged to disrupt security components like EDR systems. The analysis provides a methodology for determining if a driver vulnerability remains reachable and exploitable even without the intended hardware, emphasizing the importance of device object creation and maintenance patterns in driver design.