BYOVD — BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, CVE-2026-8501). | Kitploit

EnPortv-Killer

PoC for vulnerability in EnPortv driver from EnCase
As of 2026-07-10, the driver is listed on LOLDDrivers but remains absent from Microsoft's recommended driver block rules as of 2026-07-10

Built on byovd-lib -- implements the DriverConfig trait and delegates the full BYOVD flow to the shared library.

Driver hashes:

EnPortv.sys SHA256: d42f1b420747b82533e33107c710c45c29ff20aa5da3d1c8498b7bed7f9ebc81

Usage

Place EnPortv.sys in the same directory as the executable.

PS C:\Users\User\Desktop> .\EnPortv-Killer.exe -h
BYOVD process killer using ardrv driver

Usage: EnPortv-Killer.exe --name <PROCESS_NAME>

Options:
  -n, --name <PROCESS_NAME>  Target process name (e.g., notepad.exe)
  -h, --help                 Print help
  -V, --version              Print version

# Build
cargo build --release -p EnPortv-Killer

# Run
.\EnPortv-Killer.exe -n notepad.exe