DeepZero, an open-source engine designed to automate the discovery of exploitable vulnerabilities in Windows kernel drivers, has identified multiple confirmed flaws within a subset of the Snappy Driver Installer corpus. Some of these findings are reportedly still undergoing the disclosure process. The project, maintained by Rehman Ahmadzai, is available for free on GitHub.
The engine's bundled pipeline specifically targets "bring your own vulnerable driver" (BYOVD) scenarios, where an attacker loads a legitimately signed driver containing a flaw to gain kernel-level access. DeepZero is built as a target-agnostic pipeline orchestrator, meaning its underlying framework is not limited to Windows kernel drivers or a single architecture, although the included research pipeline is tailored for them.
The vulnerability detection process involves a seven-stage pipeline. Initially, it parses Portable Executable (PE) headers. The second stage filters for kernel-mode drivers that expose Input/Output Control (IOCTL) surfaces, which are the control codes user space sends to a driver. Drivers already cataloged on loldrivers.io, a public list of known vulnerable drivers, are then excluded.
Following these initial filters, the Ghidra reverse engineering platform runs headless to decompile the remaining binaries. Semgrep rules then scan the exported C source code. A "pick_top_10" reduction step trims the field to a top candidate tier before a language model assesses the exploitability of the surviving binaries. The AI evaluation is placed at the end to leverage the context gathered by earlier stages, such as binary decompilation and the exclusion of known vulnerable or unsupported binaries.
Ahmadzai noted that confirming a finding can sometimes require physical hardware. Many drivers create their device object only when their associated hardware is enumerated. Without the specific device on a machine or virtual machine, the driver's exposed functionalities may be unreachable, making it appear benign from a report alone.
To address this, the decompile stage records whether the `IoCreateDevice` function is called and if it's invoked by `DriverEntry` or a function that `DriverEntry` calls. A "true" value indicates the device will appear on any machine loading the driver, allowing for straightforward confirmation of a finding. A "false" value typically suggests a plug-and-play callback creates the device, necessitating the specific hardware for confirmation. If `IoCreateDevice` is not found, neither value is recorded.
