PoisonX

PP/PPL Process Termination via GUID Device Driver

Overview

PoisonX is a Bring Your Own Vulnerable Driver (BYOVD) research tool that leverages a signed Microsoft kernel driver to terminate any Windows process — including PP (Protected Processes) and PPL (Protected Process Light) processes such as EDR/AV services (e.g. CrowdStrike Falcon).

The driver exposes an IOCTL interface reachable via a fixed GUID device path. Because the driver carries a valid Microsoft signature, it loads without triggering standard code-integrity checks.

Property	Value
Device path	`\\.\{F8284233-48F4-4680-ADDD-F8284233}`
IOCTL code	`0x22E010`
Signer	Microsoft Windows Hardware Compatibility Publisher
Sign date	2025-03-25

How It Works

PoisonX.exe
    ?
    ?? Checks administrator privileges
    ?? Enables SeDebugPrivilege (best-effort)
    ?
    ?? [--extract]            Drops embedded .sys driver next to the .exe
    ?? [--driver-install]     Registers & starts the driver as a kernel service (SCM)
    ?? [--driver-uninstall]   Stops, deletes the service, removes the .sys file
    ?? [--pid-list]           Enumerates all running processes with PP/PPL status
    ?? [--poison-pid]         Sends IOCTL_KILL to the driver ? process is terminated

When --poison-pid is used without a pre-installed driver, PoisonX performs automatic driver deployment:

Iterates over up to 18 embedded driver variants (PoisonX1.sys … PoisonX18.sys).
Extracts the first available variant next to the executable.
Installs it as a kernel-mode service via the Service Control Manager.
Sends IOCTL_KILL with the target PID as an ASCII payload.

Architecture

PoisinX/
??? PoisinX.cpp        – Entry point, CLI argument parsing, command dispatch
??? poison.cpp/.h      – IOCTL_KILL dispatch: opens device, sends PID payload
??? service.cpp/.h     – Kernel driver install / uninstall via SCM
??? extract.cpp/.h     – Embedded resource extraction (up to 18 driver variants)
??? proclist.cpp/.h    – Process enumeration with PP/PPL protection level display
??? admin.cpp/.h       – Admin privilege check + SeDebugPrivilege acquisition
??? banner.cpp/.h      – Colored console banner
??? log.cpp/.h         – Levelled logging (console + optional UTF-8 file)
??? resource.h         – Resource ID definitions (IDR_INFO1 … IDR_INFO18)
??? resources.rc       – Binary resource manifest embedding the .sys files

Module Descriptions

Module	Responsibility
`poison`	Opens `\\.\{F8284233-48F4-4680-ADDD-F8284233}`, converts PID to ASCII, calls `DeviceIoControl(IOCTL_KILL)`
`service`	Wraps SCM calls: `CreateServiceW` (kernel driver, demand-start), `StartServiceW`, `ControlService(STOP)`, `DeleteService`
`extract`	Locates Win32 resources (type `TEXTFILE`, IDs 101–118), writes them to the exe directory
`proclist`	Snapshots all processes via `TlHelp32`, queries `NtQueryInformationProcess` for protection attributes, pretty-prints PP/PPL type and signer
`admin`	Checks the token for the Administrators SID; enables `SeDebugPrivilege` via `AdjustTokenPrivileges`
`log`	Thread-safe levelled logger — `MINIMAL(0)`, `INFO(1)`, `ERROR(2)`, `VERBOSE(3)` — with optional UTF-8 file mirror

Usage

PoisonX.exe --driver-install   <driver_name>     [options]
PoisonX.exe --driver-uninstall <driver_name>     [options]
PoisonX.exe --extract          <resource_number> [options]
PoisonX.exe --pid-list                           [options]
PoisonX.exe --poison-pid       <pid>             [options]

Options

Flag	Description
`--log-level <0-3>`	`0` = minimal · `1` = info (default) · `2` = errors · `3` = verbose
`--write-log <file>`	Mirror all output to a UTF-8 log file

Examples

:: List all running processes and their protection level
PoisonX.exe --pid-list

:: Kill process with PID 1234 (auto-deploys driver if not present)
PoisonX.exe --poison-pid 1234

:: Extract driver variant #1 next to the exe
PoisonX.exe --extract 1

:: Manually install / uninstall a driver variant
PoisonX.exe --driver-install   PoisonX1
PoisonX.exe --driver-uninstall PoisonX1

:: Kill a process with verbose output and log to file
PoisonX.exe --poison-pid 1234 --log-level 3 --write-log C:\Temp\poisonx.log

Building

Requirement	Version
Visual Studio	2019 or later
Platform Toolset	v143 (or later)
C++ Standard	C++14
Target Platforms	x64

Open PoisinX\PoisinX.vcxproj in Visual Studio and build in Release configuration.

The embedded driver binaries must be present as Win32 resources (type TEXTFILE, IDs 101–118) in resources.rc before building.

Log Levels

Level	Flag	Output
0	`MINIMAL`	Key results only (default quiet mode)
1	`INFO`	Operational steps (default)
2	`ERROR`	Win32 errors with `GetLastError()` codes
3	`VERBOSE`	Full internal trace including device I/O details

Disclaimer

This project is provided strictly for security research and educational purposes.
Using this tool against systems or processes without explicit authorization is illegal.
The authors accept no responsibility for misuse.

Author

Eleven Red Pandas
GitHub: https://github.com/oxfemale
X: https://x.com/bytecodevm

5.6 KiB Raw Permalink Blame History Unescape Escape