About hfiref0x/KDU
KDU (Kernel Driver Utility) is a tool designed for exploring the Windows kernel and its components without requiring extensive setup or a local debugger. It provides functionalities such as Protected Process Hijacking via arbitrary PPL or process handles, Driver Signature Enforcement (DSE) override (similar to DSEFix), a driver loader for bypassing DSE (similar to TDL/Stryker), and support for various vulnerable drivers used as functionality providers. The tool offers a wide range of command-line arguments for process manipulation, memory dumping, DSE state modification, and kernel driver mapping, targeting x64 Windows 7 through 11 with administrative privileges.
Key Features
Protected Process Hijacking via arbitrary PPL or arbitrary Process Handles through EPROCESS object modification
Driver Signature Enforcement Overrider (similar to DSEFix)
Driver loader for bypassing Driver Signature Enforcement (similar to TDL/Stryker)
Support for various vulnerable drivers used as functionality providers
Process protection manipulation: downgrade or escalate (PPL-AntiMalware, PPL-WinTcb)
Virtual memory dumping of arbitrary processes
DSE state flag modification via -dse command
Kernel driver mapping using -map command with shellcode options
Pros & Cons
Pros
- Provides a simple command-line interface for complex kernel operations
- Supports a wide range of Windows versions (7, 8, 8.1, 10, 11) on x64
- Includes multiple vulnerable driver providers for flexibility
- Active development with 240 commits and regular updates
- Offers both process manipulation and driver loading functionalities in one tool
Cons
- Requires administrative privileges to run
- Limited to x64 Windows systems
- The -map command has significant limitations: loaded drivers must be specially designed as 'driverless', no SEH support, and standard DriverEntry parameters are invalid
- Potential misuse for malicious purposes (e.g., disabling DSE, loading unsigned drivers)
- Command-line only; no graphical user interface
Best For
Exploring Windows kernel internals without a debuggerBypassing Driver Signature Enforcement to load unsigned or test driversHijacking protected processes for security research or debuggingRunning processes as Protected Process Light (PPL) for testingDumping process memory for analysisModifying Driver Signature Enforcement state for development or debugging