DeepZero: Open-source tool to hunt vulnerable Windows drivers

Automating the Hunt for Flawed Windows Drivers

DeepZero represents a significant advancement in automated security auditing, functioning as an open-source engine designed to systematically identify exploitable vulnerabilities within Windows kernel drivers. The tool operates by accepting a directory of binary files, which it then parses and dissects. Rather than analyzing every file indiscriminately, the system filters out non-viable candidates before employing a language model to assess whether the remaining binaries contain attackable flaws. Built on Python 3.11 or higher, the project utilizes YAML configurations to define its processing pipelines, offering researchers a structured approach to binary analysis.

Rehman Ahmadzai, the maintainer behind the project, highlighted the tool’s practical impact, noting that DeepZero has “found multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus, with some still undergoing the disclosure process.” The primary pipeline focuses on BYOVD, or bring your own vulnerable driver, a technique where attackers leverage legitimately signed but flawed drivers to escalate privileges and access the kernel. This method bypasses standard signature checks, making the identification of such drivers critical for system hardening.

A Seven-Stage Filtering Process

The core functionality of DeepZero relies on a sequential seven-stage pipeline that progressively narrows down the field of potential threats. The process begins by parsing PE headers to identify valid executable structures. The second stage isolates only those drivers operating in kernel mode that expose IOCTL surfaces, which are the control codes user-space applications use to interact with the driver. To reduce noise, the third stage excludes any drivers already cataloged on loldrivers.io, a public repository maintained by defenders to track known malicious or vulnerable drivers.

For the remaining candidates, the tool employs Ghidra to perform headless decompilation, converting binaries into readable C source code. Subsequent steps involve scanning this source using Semgrep rules to detect common vulnerability patterns. A reduction step named `picktop10` then selects the most promising candidates from this group. Only after these rigorous technical filters are applied does the final stage engage the AI model to evaluate exploitability.

Ahmadzai explained the strategic placement of the AI component: “The AI evaluation step is placed at the end so that the earlier stages can gather context (such as binary decompilation, filtering out pre-known vulnerable drivers or unsupported/32-bit binaries from the pipeline) which will be evaluated by the AI step in the end.” This ensures the language model receives high-quality, contextual data rather than raw, unfiltered binaries.

Hardware Dependencies and Framework Flexibility

A critical nuance in driver analysis involves how device objects are initialized. Many drivers instantiate their device objects only when specific hardware is present and enumerated. On systems lacking that particular physical device, the execution path never triggers, rendering the potential vulnerability unreachable in that environment. DeepZero addresses this by recording whether functions like `IoCreateDevice` are called during `DriverEntry` or subsequent callbacks. If the device is created immediately upon loading, the finding is considered confirmable without additional hardware. If creation is deferred to a plug-and-play callback, physical hardware is required to verify the flaw.

Beyond Windows-specific analysis, the architecture of DeepZero is designed for broader applicability. While the current research pipeline targets Windows kernel drivers, the underlying framework is not limited to a single binary type or architecture. As Ahmadzai stated, “DeepZero’s underlying engine is already built as a target-agnostic pipeline orchestrator. While the included loldrivers research pipeline is specifically tailored for Windows kernel drivers, the framework itself is not restricted to a single architecture or binary type.”

The tool is freely available for download and modification on GitHub, providing security professionals with a powerful, customizable asset for proactive vulnerability discovery.