CVE-2017-11882-Blocker

A Windows driver that neutralizes CVE-2017-11882 : )

How it works

This project is split into a kernel driver and a user-mode notification component that talk over a custom device using the inverted call model.

Kernel driver

1. Process callback - DriverEntry registers a PsSetCreateProcessNotifyRoutineEx callback so the driver is invoked synchronously on every process creation system wide, before the new process begins executing.
2. Parent inspection - Inside the callback, the driver opens the parent process via ZwOpenProcess and queries ProcessImageFileName to retrieve the full NT path. A trailing-suffix RtlCompareUnicodeString against eqnedt32.exe decides whether this is an exploitation attempt.
3. Prevention - On a match, the driver sets CreateInfo->CreationStatus = STATUS_ACCESS_DENIED. This is the documented way to abort a process launch from the callback.

User-mode agent

The agent uses two threads: an I/O dispatcher running the inverted-call loop with WaitForSingleObject + GetOverlappedResult, and a UI worker that pops alerts and renders them with MessageBoxW. Handles are managed by a small RAII AutoHandle wrapper.

A note on PPID spoofing

The whole detection relies on the kernel-reported parent PID. An attacker calling NtCreateUserProcess with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS can re-parent the payload to explorer.exe and avoid detection : )

Limitations

This solution does not detect advanced exploits which perform process injection or in-memory code execution. It only detects the common exploit for this CVE, which spawns a new (malicious) process.