DeepZero: Open-source hunting for vulnerable Windows drivers
DeepZero is an open-source engine that automates the search for exploitable Windows kernel drivers. You point it at a folder of binaries and it parses them, pulls them apart, scans them, throws most of them away, and asks a language model whether what survives can be attacked. Pipelines are written in YAML, the code is Python 3.11 and up.
Rehman Ahmadzai, who maintains the project, said DeepZero has “found multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus, with some still undergoing the disclosure process.” The bundled pipeline targets BYOVD, short for bring your own vulnerable driver: an attacker loads a legitimately signed driver that contains a flaw and uses it to reach the kernel.
What the pipeline does
Seven stages run in order. The first parses PE headers. The second keeps only kernel-mode drivers that expose IOCTL surfaces, the control codes user space sends a driver to make it do something. The third excludes drivers already cataloged on loldrivers.io, the public list defenders block from. Ghidra then runs headless over what is left, Semgrep rules scan the exported C source, a reduce step named pick_top_10 trims the field to a top candidate tier, and only then does a model assess exploitability.
Anything the model sees got past that third filter.
“The AI evaluation step is placed at the end so that the earlier stages can gather context (such as binary decompilation, filtering out pre-known vulnerable drivers or unsupported/32-bit binaries from the pipeline) which will be evaluated by the AI step in the end,” Ahmadzai told Help Net Security.
A finding may still need the physical hardware
Many drivers create their device object only once their hardware is enumerated. On a machine or VM without that device, the path never opens, nothing the driver exposes can be reached, and from the report alone that looks identical to a driver with nothing wrong with it. The decompile stage records which function calls IoCreateDevice and whether that function is DriverEntry or something DriverEntry calls. A true value means the device appears on any machine that will load the driver, so a finding against it can be confirmed. False usually means a plug-and-play callback creates it, and confirming anything takes the hardware. When IoCreateDevice is not found at all, the stage records neither value instead of guessing.
“DeepZero’s underlying engine is already built as a target-agnostic pipeline orchestrator. While the included loldrivers research pipeline is specifically tailored for Windows kernel drivers, the framework itself is not restricted to a single architecture or binary type,” Ahmadzai said.
DeepZero is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
