https://xusheng.dev/tags/windows/ Recent content in Windows on Xusheng Li Hugo en-us <a href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank" rel="noopener">CC BY-NC 4.0</a> Thu, 03 Sep 2026 00:00:00 -0400 https://xusheng.dev/posts/byotc/main/ Thu, 03 Sep 2026 00:00:00 -0400 https://xusheng.dev/posts/byotc/main/ <p><img src="https://xusheng.dev/posts/byotc/social-preview.jpg" alt="A malicious process injecting code into a signed trusted client, which passes caller verification and reaches a privileged kernel driver"></p> <p>Bring Your Own Vulnerable Driver (BYOVD) is a familiar Windows attack technique: an attacker loads a legitimate, signed driver and abuses a flaw in it to gain kernel-level capabilities. Microsoft maintains a <a href="https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules">vulnerable-driver blocklist</a> to make this harder, while the community-maintained <a href="https://www.loldrivers.io/">LOLDrivers</a> project catalogs known vulnerable and malicious Windows drivers.</p> <p>But sometimes the dangerous capability is intentional. A security or system-inspection driver may legitimately need to terminate processes, open privileged handles, or resist interference. Removing that functionality would break the product, so the driver must instead decide <em>who is allowed to request it</em>. Vendors therefore add caller authentication:</p>