hfiref0x/KDU

Health v2 · maintenance only

Adoption not part of the score

2704 stars · 542 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

KDU (Kernel Driver Utility) is a Windows command-line tool that abuses known vulnerable drivers to load unsigned kernel drivers, bypass Driver Signature Enforcement, and manipulate protected processes. It is aimed at security researchers exploring the Windows kernel without a local debugger.

Use cases

• load an unsigned driver into the Windows kernel without signing it
• bypass driver signature enforcement on Windows 10/11
• disable or modify DSE state flags for testing
• launch a process as Protected Process Light (PPL)
• dump the virtual memory of a protected process
• open an arbitrary process with full access handles
• explore Windows kernel internals without setting up a kernel debugger

When to choose

• you need to map a test driver into the kernel on x64 Windows without signing it
• you are researching BYOVD techniques or Windows kernel security
• you need to strip PPL protections from a process during analysis
• you want a DSEFix/TDL-style tool with multiple vulnerable driver providers

When to avoid

• you need a production or legitimate driver-loading mechanism
• you are on a non-Windows platform
• you cannot obtain administrative privileges
• you want a tool that avoids using vulnerable drivers (BYOVD is inherently risky and detectable)

Facets

cli-tool · maturity active

security reverse-engineering developer-tools security windows developer-tools windows cli byovd driver-loader dse-bypass kernel vulnerable-drivers ppl

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hfiref0x/KDU")