Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CFB — ProcMon-style IRP monitor for Windows drivers. Captures and logs I/O Request Packets via a kernel driver and user-land broker, outputting JSON for analysis and scripting. | Kitploit
Tools/GitHubGitHub/hugsy/cfb
Vulnerability AnalysisDebuggersFuzzing
GitHubhugsy/cfb

CFB

ProcMon-style IRP monitor for Windows drivers. Captures and logs I/O Request Packets via a kernel driver and user-land broker, outputting JSON for analysis and scripting.

View RepositoryWebsite
335682 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

logo

Build main Build dev Discord

What is it?

[!CAUTION] CFB is meant for research and debug purposes, it should never be used on production systems. Also BSoD may happen. You've been warned.

Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver. It operates in 2 parts:

  1. the "Broker" combines both a user-land agent and a self-extractable driver (IrpMonitor.sys) that will install itself on the targeted system. After installing the driver, the broker will expose a TCP port listening (by default, on TCP/1337) and start collecting IRP from hooked drivers. The communication protocol was made to be simple by design (i.e. not secure) allowing any 3rd party tool to dump the driver IRPs from the same Broker easily (via simple JSON messages).

  2. the clients can connect to the broker, and will receive IRPs as a JSON message making it easy to view, or convert to another format.

GUI

CLI

  1. IRPs (metadata, input/output buffers) can be stored to file on disk in the JSON format allowing for easy further scripting.

[!WARNING] Although the CFB driver (IrpMonitor.sys) should not violate patchguard, it however is only self-signed and so requires TestSigning enabled in the BCD

Why the name?

Because I had no idea for the name of this tool, so it was graciously generated by a script of mine.

Kudos

  • processhacker for their phnt header files
  • nlohmann for their json library
Download Tool