Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective

This article examines how Windows kernel drivers can be exploited without their intended hardware, particularly relevant to BYOVD attacks.

• •BYOVD attacks require driver exploits that cause meaningful system disruption and remain exploitable regardless of hardware presence
• •Device object creation patterns vary: unconditional creation during driver load or conditional creation requiring specific hardware
• •Non-PnP drivers create device objects in DriverEntry, enabling exploitation through simple service creation and startup commands
• •PnP drivers use AddDevice callbacks invoked only when the PnP manager detects matching devices, requiring proper device enumeration
• •Determining whether vulnerable driver code is reachable without physical hardware depends on understanding initialization patterns and callback mechanisms