# hfiref0x/TDL

Driver loader for bypassing Windows x64 Driver Signature Enforcement

Repository: https://github.com/hfiref0x/TDL
Canonical: https://ross.abutalabs.com/products/hfiref0x-tdl
Language: C
License: BSD-2-Clause
License Family: permissive
Topics: dse, loader, abandonware, tdl, c, driver-loader
Archived: true
Last push: 2019-08-01T04:47:02+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3863, "days_push": 2589, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1226, forks 333 (observed 2026-08-28T04:04:03.181691+00:00)

## What it is
TDL is a Windows x64 driver loader that bypasses Driver Signature Enforcement by exploiting a VirtualBox kernel vulnerability to map specially crafted drivers into kernel memory. It is a security research tool written in C, no longer maintained.

## Use cases
- load unsigned kernel drivers on 64-bit Windows
- bypass driver signature enforcement without triggering PatchGuard
- research kernel exploit techniques like the Turla VirtualBox exploit
- test specially designed driverless kernel drivers
- study kernel-mode shellcode and driver mapping

## When to choose
- you need a PatchGuard-friendly DSE bypass on Windows 7 through 10
- your driver is specifically written to run as driverless code in kernel memory
- you are researching kernel exploitation and driver loading techniques

## When to avoid
- you need to load ordinary signed or unsigned drivers that rely on the Windows loader
- you need SEH support, driver unloading, or full import resolution
- you need a maintained tool or support for Windows 11 or newer
- you cannot accept BSOD or system instability risks from kernel exploitation

## Facets
- artifact type: cli-tool
- maturity: abandoned
- function: security, reverse-engineering
- domain: security, windows, developer-tools
- platform: windows, cpp, cli
- tags: driver-loader, dse-bypass, kernel-mode, rootkit-technique, vulnerable-driver-exploit, abandonware

## Member repositories
- hfiref0x/TDL (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:03.181691+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:15:19.352312+00:00, confidence not recorded.
  - readme: https://github.com/hfiref0x/TDL (fetched 2026-08-28T04:04:03.181691+00:00, sha 0f1f4c822cfe)
- Data as of 2026-08-30T08:39:29.467469+00:00.