Kdmapper.exe [exclusive]

kdmapper.exe is an open-source utility designed to manually map unsigned kernel drivers into Windows memory. It is primarily used by developers and security researchers to bypass Driver Signature Enforcement (DSE), a Windows security feature that prevents the loading of drivers that haven't been digitally signed by Microsoft. Core Mechanism: BYOVD

KDMapper operates using a technique known as Bring Your Own Vulnerable Driver (BYOVD).

Vulnerable Driver Loading: It loads a legitimate, digitally signed driver that contains a known security vulnerability (most commonly the intel iQVW64.sys driver, associated with CVE-2015-2291).

Exploitation: It leverages exposed IOCTLs (Input/Output Control) of the vulnerable driver to gain arbitrary read/write access to kernel memory.

Manual Mapping: KDMapper then manually "maps" your unsigned driver into kernel space by copying its sections and resolving its imports/relocations, effectively bypassing the standard Windows loader. Key Features

Signature Bypass: Allows execution of custom code at Ring-0 (kernel level) without an EV certificate.

Clears PiDDB Cache: Often includes functionality to clear traces of the vulnerable driver from the PiDDBCacheTable, helping it stay hidden from some detection methods. kdmapper.exe

Command-Line Interface: Typically used via commands like kdmapper.exe your_driver.sys. Common Use Cases

Game Cheating: Frequently used to load "kernel-mode cheats" that attempt to hide from anti-cheat software (like Vanguard or BattlEye) by operating at the same privilege level.

Malware Development: Used by sophisticated threat actors, such as the Lazarus Group, to deploy rootkits and evade Endpoint Detection and Response (EDR) systems.

Security Research: Testing how kernel-level defenses respond to unauthorized driver mapping. Risks and Detection

While effective, KDMapper is widely known to security software.

Windows 11 22H2 - ./kdmapper.exe valthrun-driver ... - GitHub kdmapper

Steps to reproduce the behavior: * open powershell as administrator. * Compiling kdmapper by myself. * installing valthrun-driver. GitHub

Step 1: Obtain a Legitimate, Signed Vulnerable Driver

The user provides kdmapper with a .sys file that:

Is digitally signed by a Microsoft-trusted vendor (e.g., Intel, ASUS).
Contains a critical vulnerability — usually a "write-what-where" primitive or an arbitrary MSR (Model Specific Register) write.

Common examples include:

gdrv.sys (Gigabyte) – allows any user to write to any physical memory.
RTCore64.sys (MSI) – exposes unrestricted physical memory access.
iqvw64e.sys (Intel) – contains vulnerable IOCTL handlers.

Detecting kdmapper Activity

For defenders (blue teams, EDR vendors, system administrators), detecting kdmapper is critical. Here are the key indicators:

Uses of kdmapper.exe

Kernel Debugging: The tool is used to facilitate kernel-mode debugging. This involves debugging the Windows kernel or drivers that run in kernel mode. Kernel debugging is crucial for driver developers and system programmers working on low-level system software.
Changing Debugger Connections: kdmapper.exe allows users to change the debugger connection settings. For example, if you are using a serial cable for kernel debugging and want to switch to a network connection (such as TCP/IP), you can use kdmapper.exe to map or change the connection. Is digitally signed by a Microsoft-trusted vendor (e
Remote Debugging: It facilitates remote kernel debugging. By running kdmapper.exe on the target machine (the one being debugged), you can connect to a kernel debugger running on a different machine over a network.

The Controversy: Gaming and Anti-Cheat

kdmapper is infamous in the gaming community. It is the primary method used to load game cheats (aimbots, wallhacks, etc.) that operate in kernel mode.

Modern anti-cheat software (like BattlEye or EasyAntiCheat) runs at the kernel level to detect cheats. To bypass these sophisticated anti-cheats, cheat developers write kernel-level cheats and use kdmapper to load them.

This has created an "arms race." Anti-cheat vendors now aggressively scan for the artifacts left behind by kdmapper, such as specific memory patterns or the residue of the vulnerable Intel driver.

Common Uses of kdmapper.exe

Because kdmapper is a tool, its morality and legality depend entirely on intent. It is used in four main scenarios: