DeepZero: Open-Source Hunting for Vulnerable Windows Drivers

Post Views: 3

DeepZero is an open-source framework designed to automate the identification of exploitable Windows kernel drivers.

Introduction

DeepZero is an open-source framework designed to automate the identification of exploitable Windows kernel drivers. Users can input a directory of binary files, and the system dissects them, analyzing their structure, extracting relevant components, and filtering out irrelevant data. A language model then evaluates the remaining elements to determine potential exploitability. The tool’s pipelines are configured using YAML, while the core codebase is developed in Python 3.11 or later.

Framework Overview

Rehman Ahmadzai, the project’s maintainer, reported that DeepZero has identified multiple confirmed vulnerabilities within a subset of the Snappy Driver Installer dataset, with some findings still undergoing formal disclosure. The tool’s primary focus is on the BYOVD (Bring Your Own Vulnerable Driver) attack vector, where adversaries leverage legitimately signed drivers containing flaws to gain kernel-level access.

Seven-Stage Pipeline

The framework operates through seven sequential stages. The initial phase examines PE (Portable Executable) headers, followed by filtering to retain only kernel-mode drivers that expose IOCTL (Input/Output Control) interfaces. These interfaces enable user-space applications to communicate with drivers, instructing them to perform specific actions.

Filtering and Exclusions

The third stage excludes drivers listed on loldrivers.io, a public database used by defenders to block known vulnerable components. Subsequent steps involve running Ghidra, a reverse engineering tool, in headless mode to decompile the remaining binaries. Semgrep rules then analyze the exported C source code for potential weaknesses.

Reduction and AI Evaluation

A reduction phase called pick_top_10 narrows the dataset to the most promising candidates. Finally, an AI model assesses exploitability. Ahmadzai emphasized that the AI evaluation is positioned as the final step to leverage context gathered from earlier stages, such as binary decompilation, exclusion of pre-identified vulnerable drivers, and filtering out unsupported or 32-bit binaries.

Hardware Validation Challenges

Some findings require physical hardware for validation. Many drivers initialize device objects only when their associated hardware is detected. On systems or virtual machines lacking the necessary hardware, the driver’s exposed interfaces remain inaccessible, making it difficult to distinguish between a non-vulnerable driver and one with hidden flaws.

Decompile Stage Analysis

The decompile stage tracks whether the IoCreateDevice function is present and whether it is called during DriverEntry or by functions invoked by DriverEntry. A positive result indicates the device is created on any system that loads the driver, enabling verification of findings. A negative result suggests the device is initialized via a plug-and-play callback, requiring physical hardware for confirmation. If IoCreateDevice is absent entirely, the stage does not make assumptions but records the absence.

Architecture and Availability

The underlying architecture of DeepZero is designed as a target-agnostic pipeline orchestrator. While the current loldrivers research pipeline is tailored for Windows kernel drivers, the framework itself supports multiple architectures and binary types, according to Ahmadzai. The tool is freely available on GitHub, offering a customizable platform for security researchers to adapt to various threat scenarios.

“Ahmadzai emphasized that the AI evaluation is positioned as the final step to leverage context gathered from earlier stages…”