DeepZero: Open-source hunting for vulnerable Windows drivers

The open-source engine DeepZero has been released, automating the search for exploitable Windows kernel drivers. It filters binaries by PE headers, IOCTL, and the loldrivers.io database, then analyzes the remainder via Ghidra, Semgrep, and a language model. The project author has already found several confirmed vulnerabilities in the Snappy Driver Installer corpus.

• Pipelines described in YAML, code in Python 3.11+
• Seven stages: from PE parsing to AI exploitability assessment
• Goal: BYOVD attacks via legitimately signed drivers
• Confirmed vulnerabilities found in Snappy Driver Installer corpus