Open-source DeepZero hands an LLM the signed Windows drivers missing from loldrivers.io

The loldrivers exclusion at stage three is there for pipeline economics ^[7]. Headless Ghidra runs and model calls cost time and tokens, and a driver already published as vulnerable has already been researched. It has a second effect. Every driver that reaches the model is one missing from the public blocklist at the time of the run ^[15]. Defenders who gate kernel drivers by deny list work from the set of drivers someone already reported ^[8]; this pipeline begins by subtracting that set ^[9].

Six of the seven stages run before the model is asked anything ^[14]. They are PE header parsing, a filter that keeps only kernel-mode drivers exposing IOCTL surfaces, the loldrivers exclusion, headless Ghidra, Semgrep rules over the exported C source, and a reduce step called pick_top_10 ^[7]. "The AI evaluation step is placed at the end so that the earlier stages can gather context (such as binary decompilation, filtering out pre-known vulnerable drivers or unsupported/32-bit binaries from the pipeline) which will be evaluated by the AI step in the end," Ahmadzai told Help Net Security ^[10].

Some findings take more than a spare VM to check. Many drivers create their device object only once their hardware is enumerated. On a machine without that device the path never opens, and from the report alone that looks identical to a driver with nothing wrong with it ^[11]. The decompile stage separates the two by recording which function calls IoCreateDevice and whether that function is DriverEntry or something DriverEntry calls ^[12]. A true value means the device appears on any machine that will load the driver, so the finding can be confirmed; false usually means a plug-and-play callback creates it, and confirming takes the hardware ^[12]. When IoCreateDevice is not found at all, the stage records neither value ^[12].

The code is Python 3.11 and up with pipelines written in YAML, and it is free on GitHub ^[2][3]. So the cost of a pass over a driver bundle is compute plus a model bill. The report does not say how many drivers the Snappy Driver Installer run covered or how many bugs were verified ^[16]. The engine is public, while the findings stay held back: Ahmadzai says some are still in disclosure ^[5].

The bundled pipeline is aimed at Windows kernel drivers, but the maintainer describes the layer underneath it as reusable. "DeepZero's underlying engine is already built as a target-agnostic pipeline orchestrator. While the included loldrivers research pipeline is specifically tailored for Windows kernel drivers, the framework itself is not restricted to a single architecture or binary type," Ahmadzai said ^[13].