Neura Market
hfiref0x/TDL logo

hfiref0x/TDL

Free

Driver loader for bypassing Windows x64 Driver Signature Enforcement

FreeFree tier
Type
Open Source
Visit Website GitHub (38 stars)

About hfiref0x/TDL

TDL (Turla Driver Loader) is an open-source tool designed to bypass Windows x64 Driver Signature Enforcement (DSE) by exploiting a VirtualBox kernel mode vulnerability (WinNT/Turla). Unlike DSEFix, it avoids patching kernel variables, making it compatible with PatchGuard on modern Windows versions. TDL uses custom bootstrap shellcode to map a specially designed 'driverless' driver into kernel memory without involving the Windows loader. It supports x64 Windows 7, 8, 8.1, and 10. The repository includes full source code, dummy driver examples, and build instructions for Microsoft Visual Studio 2015+ and WDK 8.1+.

Key Features

Bypasses Windows x64 Driver Signature Enforcement (DSE) without patching kernel variables
Uses WinNT/Turla VirtualBox kernel exploit technique for code injection
Custom bootstrap shellcode maps specially designed drivers to kernel mode
Does not trigger PatchGuard (KPP) on Windows 8+
Supports x64 Windows 7/8/8.1/10
Full source code provided with build prerequisites (Visual Studio 2015+, WDK 8.1+)
Includes dummy driver examples for testing

Pros & Cons

Pros
  • Non-invasive DSE bypass – does not modify kernel variables, safe from PatchGuard
  • Open source with fully available source code and build instructions
  • Comes with example dummy drivers to help users get started
  • Works across multiple Windows versions (7 to 10)
Cons
  • Archived and read-only since August 2019 – no longer maintained or updated
  • Requires drivers to be specially designed as 'driverless' – incompatible with standard signed drivers
  • No driver unloading capability – loaded drivers cannot be removed without reboot
  • Only ntoskrnl import is resolved; all other imports must be handled manually
  • DriverEntry parameters are invalid and must not be used
  • No Structured Exception Handling (SEH) support for target drivers

Best For

Loading unsigned or self-signed kernel drivers on x64 Windows for testing or researchDeveloping and debugging driverless kernel drivers without proper signing certificatesEducational purposes – understanding kernel exploitation and DSE bypass techniques

FAQ

What Windows versions are supported by TDL?
TDL supports x64 Windows 7, 8, 8.1, and 10. Windows Vista is not supported as it is considered obsolete.
Does TDL require administrative privileges?
Yes, administrative privilege is required to run the loader.
What are the limitations compared to DSEFix?
TDL does not patch kernel variables, so it is friendly to PatchGuard on Windows 8+. However, drivers must be specially designed as 'driverless' and cannot use the Windows loader. There is no driver unloading, no SEH support, and only ntoskrnl imports are resolved.
Is TDL still actively maintained?
No, the repository was archived by the owner on August 16, 2019, and is now read-only.