# hfiref0x/KDU

Kernel Driver Utility

Repository: https://github.com/hfiref0x/KDU
Canonical: https://ross.abutalabs.com/products/kdu
Language: C
License: MIT
License Family: permissive
Topics: loader, driver-loader, dse, byovd
Last push: 2026-08-18T00:18:41+00:00

## Health v2 (maintenance only)
Score: 91/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 76, longevity 100
- inputs: {"age_days": 2404, "days_push": 16, "days_rel": 81, "gap_med": 58.0, "n_releases_24m": 7}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2704, forks 542 (observed 2026-08-28T04:07:11.497701+00:00)

## What it is
KDU (Kernel Driver Utility) is a Windows command-line tool that abuses known vulnerable drivers to load unsigned kernel drivers, bypass Driver Signature Enforcement, and manipulate protected processes. It is aimed at security researchers exploring the Windows kernel without a local debugger.

## Use cases
- load an unsigned driver into the Windows kernel without signing it
- bypass driver signature enforcement on Windows 10/11
- disable or modify DSE state flags for testing
- launch a process as Protected Process Light (PPL)
- dump the virtual memory of a protected process
- open an arbitrary process with full access handles
- explore Windows kernel internals without setting up a kernel debugger

## When to choose
- you need to map a test driver into the kernel on x64 Windows without signing it
- you are researching BYOVD techniques or Windows kernel security
- you need to strip PPL protections from a process during analysis
- you want a DSEFix/TDL-style tool with multiple vulnerable driver providers

## When to avoid
- you need a production or legitimate driver-loading mechanism
- you are on a non-Windows platform
- you cannot obtain administrative privileges
- you want a tool that avoids using vulnerable drivers (BYOVD is inherently risky and detectable)

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, reverse-engineering, developer-tools
- domain: security, windows, developer-tools
- platform: windows, cli
- tags: byovd, driver-loader, dse-bypass, kernel, vulnerable-drivers, ppl

## Member repositories
- hfiref0x/KDU (main) score 91

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:11.497701+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:15:51.964396+00:00, confidence not recorded.
  - readme: https://github.com/hfiref0x/KDU (fetched 2026-08-28T04:07:11.497701+00:00, sha ad4e7c4b2083)
- Data as of 2026-08-30T08:39:29.467469+00:00.