KDMapper is a kernel driver injection tool that exploits the iqvw64e.sys Intel driver to manually map unsigned drivers into kernel memory on Windows systems.
The tool solves the problem of loading unsigned kernel drivers by leveraging a vulnerability in the Intel driver to bypass signature verification. It works by hooking NtAddAtom, clearing kernel data structures that track loaded drivers (MmUnloadedDrivers, PiDDBCacheTable, g_KernelHashBucketList), and using NtLoadDriver and NtUnloadDriver to minimize forensic traces. The approach includes features like header section skipping during driver copying, support for drivers compiled with /GS-, and the ability to modify driver parameters before execution. An optional PDB-based offset system allows the tool to adapt to Windows updates by parsing symbol files rather than relying on hardcoded offsets.
This tool is intended for security researchers and developers working on low-level Windows internals who need to load custom unsigned drivers. It suits scenarios where standard driver loading mechanisms are unavailable or undesirable. The project requires careful driver development practices: entry points must return quickly to avoid triggering Patch Guard, and infinite loops in DriverEntry will cause crashes. Users must be aware that DriverObject and RegistryPath parameters are NULL in manually mapped drivers, differing from normal driver loading procedures. The vulnerable driver blocklist should be disabled if enabled on the target system.
Development activity shows consistent maintenance across a wide range of Windows versions from Windows 10 through Windows 11. The project includes tooling for symbol parsing through the SymbolsFromPDB utility, indicating an effort to maintain compatibility as Windows evolves. Documentation covers common failure modes and troubleshooting steps, suggesting active engagement with user issues.
