RingKiller
RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminateProcess. EDR/AV termination primitive. Lab only.
Details
- External ID
- 1367076964
- Source
- GITHUB
- Company
- —
- Product
- RingKiller
- Website domain
- ninjas.zip
- Launched
- Sept. 12, 2026
- Cohort
- —
- Upvotes
- 22
- Upvotes percentile
- 0.6369459390212657
- Tags
- av-bypass, av-killer, byovd, edr-bypass, edr-killer, evasion, kernel-exploitation, offensive-security, process-termination, red-team, vulnerable-drivers, windows-kernel
- Fetched at
- Sept. 16, 2026, 5:02 p.m.
- Updated at
- Sept. 16, 2026, 5:02 p.m.
Enrichment
- Theme
- security exploits and system hacking tools
- Vertical
- Security
- Function
- Dev tools
- Audience
- Developer
- AI stance
- Not AI
- Project type
- Hobby / open-source project
- Normalized one-liner
- vulnerable driver exploit proof of concept for security researchers
- Manually corrected
- False
Could you build this?
No Developing a BYOVD (Bring Your Own Vulnerable Driver) exploit PoC to terminate protected EDR processes requires specialized offensive security research and Windows kernel-mode exploitation expertise.
What it would actually take: The architecture requires C/C++ user-mode code communicating with kernel space via DeviceIoControl, exploiting an undocumented IOCTL dispatch in a signed, vulnerable third-party driver to call unexported or restricted kernel routines (e.g., ZwTerminateProcess from Ring 0). Hard parts include kernel debugging (WinDbg), reversing driver binaries to find arbitrary execution/write primitives, bypassing Driver Signature Enforcement (DSE), and handling kernel mitigations without triggering BugChecks. This requires dedicated vulnerability research and Windows internals expertise.
Competitors
Other products that read as similar to this one — 59 launches clear the similarity bar, closest 8 shown.
Attention rank: #26 of 60 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 291 days after the earliest competitor.
- CVE-2026-88772 · github · 2026-09-27 · 13 upvotes · similarity 0.46
- CVE-2026-28695 · github · 2026-09-27 · 13 upvotes · similarity 0.45
- 0xCr0ssCrush · github · 2026-09-14 · 21 upvotes · similarity 0.45
- cve-2026-85706 · github · 2026-09-11 · 33 upvotes · similarity 0.44
- CVE-2026-84543 · github · 2026-09-24 · 37 upvotes · similarity 0.43
- humane-aipin-ghostlock · github · 2026-09-20 · 11 upvotes · similarity 0.43
- wp2shell-PoC · github · 2026-09-18 · 563 upvotes · similarity 0.42
- CVE-2026-43786 · github · 2026-09-21 · 24 upvotes · similarity 0.41
Other launches for this product
- No other launches for this product.
Same idea, different domain
Nobody's really built a dev tools tool for Sales yet.