Reversing Windows Defender Vulnerable Driver: KslD.sys

Title: Reversing Windows Defender Vulnerable Driver: KslD.sys

URL Source: https://medium.com/@s12deff/reversing-windows-defender-vulnerable-driver-ksld-sys-d64a485ee8e8?source=rss------cybersecurity-5

Published Time: 2026-04-26T21:08:50Z

Markdown Content:
# Reversing Windows Defender Vulnerable Driver: KslD.sys | by S12 - 0x12Dark Development | Apr, 2026 | Medium

[Sitemap](https://medium.com/sitemap/sitemap.xml)

[Open in app](https://play.google.com/store/apps/details?id=com.medium.reader&referrer=utm_source%3DmobileNavBar&source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2F%40s12deff%2Freversing-windows-defender-vulnerable-driver-ksld-sys-d64a485ee8e8&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

[](https://medium.com/?source=post_page---top_nav_layout_nav-----------------------------------------)

Get app

[Write](https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------)

[Search](https://medium.com/search?source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2F%40s12deff%2Freversing-windows-defender-vulnerable-driver-ksld-sys-d64a485ee8e8&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)


# Reversing Windows Defender Vulnerable Driver: KslD.sys

[](https://medium.com/@s12deff?source=post_page---byline--d64a485ee8e8---------------------------------------)

[S12 - 0x12Dark Development](https://medium.com/@s12deff?source=post_page---byline--d64a485ee8e8---------------------------------------)

Follow

9 min read

·

Just now

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2Fd64a485ee8e8&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40s12deff%2Freversing-windows-defender-vulnerable-driver-ksld-sys-d64a485ee8e8&user=S12+-+0x12Dark+Development&userId=40bfd1206679&source=---header_actions--d64a485ee8e8---------------------clap_footer------------------)

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fd64a485ee8e8&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40s12deff%2Freversing-windows-defender-vulnerable-driver-ksld-sys-d64a485ee8e8&source=---header_actions--d64a485ee8e8---------------------bookmark_footer------------------)

[Listen](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2Fplans%3Fdimension%3Dpost_audio_button%26postId%3Dd64a485ee8e8&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40s12deff%2Freversing-windows-defender-vulnerable-driver-ksld-sys-d64a485ee8e8&source=---header_actions--d64a485ee8e8---------------------post_audio_button------------------)

Share

Welcome to a new Medium post! In this one, I’ll walk you through my reverse engineering process for the vulnerable `KslD.sys` driver. To be clear, I didn't discover this vulnerability myself; I'm simply reverse engineering the driver already knowing that it contains an arbitrary Kernel Read/Write vulnerability.

The vulnerability itself is only half the story. The real issue is that this driver is still part of the default Windows installation. Despite a patched version being available, the vulnerable driver persists on many systems, essentially providing a pre-installed backdoor

If you use Windows 11, is so probable you will find the vulnerable version of this driver in:

C:\Windows\System32\drivers\KslD.sys
The patched version resides in:

C:\Windows\System32\drivers\wd\KslD.sys
To make sure,