DriverShield - Guides: Windows Kernel Driver Security

In-depth guides on Windows kernel driver security: BYOVD attacks, how to analyze a .sys file, code signing and Authenticode, DSE, HVCI, and defending against vulnerable drivers.

Guides on Windows Kernel Driver Security

In-depth, practical guides covering BYOVD attacks, how to analyze a Windows .sys file, driver code signing, and defending against vulnerable drivers.

What Is BYOVD (Bring Your Own Vulnerable Driver)? A Complete Guide - BYOVD explained: how attackers abuse legitimately signed but vulnerable Windows kernel drivers to reach Ring 0, disable EDR, and bypass Secure Boot - and how to defend against it. (8 min read)
How to Analyze a Windows Kernel Driver (.sys File) - A practical guide to analyzing a Windows .sys kernel driver: PE structure, dangerous imports, IOCTL extraction, code signing, YARA, and how to read an automated risk score. (9 min read)
Windows Driver Code Signing: Authenticode, DSE, WHQL, and HVCI Explained - How Windows driver code signing actually works - Authenticode, Driver Signature Enforcement, WHQL certification, and HVCI - and why a valid signature does not mean a driver is safe. (7 min read)

See also the analysis methodology, the security glossary, and the FAQ.