BYOVD (Vulnerable Driver) × Microsoft Windows HVCI (Hypervisor-protected Code Integrity)

BusterCall is a proof-of-concept tool demonstrating a technique to bypass Windows Hypervisor-protected Code Integrity (HVCI)

The attack identifies a target read-only kernel code page (e.g., SSDT) and a writable donor page (e.g., from a driver's .data section). It copies the target page content to the donor's physical memory, modifies the copy (e.g., altering a syscall entry), then swaps the PFN in the target's page table entry to point to the donor's physical page. Since HVCI only checks the PTE attributes (which remain read-only), the modified code executes without triggering HVCI violations.

Monitor for loading of vulnerable or unsigned kernel drivers using Sysmon Event ID 6 (driver loaded) and Windows Event ID 7045 (service creation). Enforce driver blocklist policies (e.g., WDAC) and enable HVCI with secure boot to prevent unauthorized kernel code modification.