hfiref0x/TDL

Health v2 · maintenance only

Flags: no_releases archived

Adoption not part of the score

1226 stars · 333 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

TDL is a Windows x64 driver loader that bypasses Driver Signature Enforcement by exploiting a VirtualBox kernel vulnerability to map specially crafted drivers into kernel memory. It is a security research tool written in C, no longer maintained.

Use cases

• load unsigned kernel drivers on 64-bit Windows
• bypass driver signature enforcement without triggering PatchGuard
• research kernel exploit techniques like the Turla VirtualBox exploit
• test specially designed driverless kernel drivers
• study kernel-mode shellcode and driver mapping

When to choose

• you need a PatchGuard-friendly DSE bypass on Windows 7 through 10
• your driver is specifically written to run as driverless code in kernel memory
• you are researching kernel exploitation and driver loading techniques

When to avoid

• you need to load ordinary signed or unsigned drivers that rely on the Windows loader
• you need SEH support, driver unloading, or full import resolution
• you need a maintained tool or support for Windows 11 or newer
• you cannot accept BSOD or system instability risks from kernel exploitation

Facets

cli-tool · maturity abandoned

security reverse-engineering security windows developer-tools windows cpp cli driver-loader dse-bypass kernel-mode rootkit-technique vulnerable-driver-exploit abandonware

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hfiref0x/TDL")