BYOVD Exploits for Bypassing Windows 10/11 Kernel Protections for Sale

For informational purposes only.

Vulnerability Type: Kernel Privilege Escalation Price: • Memory read and write — starting at $1,000 • Termination of protected processes — starting at $5,000 • Direct kernel calls — negotiable

The author claims to be selling a collection of BYOVD (Bring Your Own Vulnerable Driver) drivers, complete with source code and proof-of-concept (PoC) code. The seller asserts that each driver allows bypassing HVCI (Hypervisor-Protected Code Integrity)—a Windows mechanism designed to protect the integrity of kernel code. The claimed capabilities include reading and writing to physical and virtual memory, performing low-level operations on the kernel, and terminating protected processes, including those potentially associated with antivirus and EDR systems. According to the seller, all of the drivers offered have a 0/71 score on VirusTotal.