DeepZero Automates Hunting for Vulnerable Windows Drivers
Summary
DeepZero is an open-source Python tool that analyzes Windows kernel drivers for potential vulnerabilities. Its maintainer says it has found multiple verified flaws in the Snappy Driver Installer corpus; some are still undergoing disclosure.
Key points
- DeepZero automates analysis of Windows kernel-driver binaries through a seven-stage pipeline, including filtering, Ghidra decompilation, Semgrep scans, and a final language-model exploitability assessment.
- Its bundled pipeline targets BYOVD: attacks that load a legitimately signed but flawed driver to reach the kernel.
- The project maintainer says DeepZero found multiple verified vulnerabilities in part of the Snappy Driver Installer corpus, with some still undergoing disclosure.
- Some findings may require the relevant physical hardware to confirm, because certain drivers create device objects only after hardware enumeration.
- The framework is open source and described as target-agnostic, although its included research pipeline focuses on Windows kernel drivers.
- The pipeline excludes drivers already listed on loldrivers[.]io.
Article Details
- Event Type
- Open-source security research tool release
- Impact
- DeepZero automates hunting for exploitable Windows kernel drivers. Its maintainer reports that it found multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus; some findings are still undergoing disclosure. The article does not report exploitation or a confirmed impact on affected organizations.
People
Products
DeepZeroDeepZero is an open-source, Python-based engine that automates the hunt for exploitable Windows kernel drivers by parsing binaries, filtering candidates, and using a language model to assess exploitability.Snappy Driver InstallerIts bundled pipeline focuses on BYOVD research and has already found multiple verified vulnerabilities in the Snappy Driver Installer corpus.
Tools
GhidraGhidra then runs headless over what is left, Semgrep rules scan the exported C source, a reduce step named pick_top_10 trims the field to a top candidate tier, and only then does a model assess exploitability.SemgrepGhidra then runs headless over what is left, Semgrep rules scan the exported C source, a reduce step named pick_top_10 trims the field to a top candidate tier, and only then does a model assess exploitability.