few things; number one as evidenced by the comments, it's written via LLM with a little mcp magic (no shade thrown) two: HVCI-protected structures like the IDT etc plus the additional scrubbing of the typical API leak surface by MS a few patches ago, 200 classes checked, no leaks. You cannot get kernel addresses using only this driver with HVCI enabled. The driver's read primitive works fine on regular kernel memory (EPROCESS, etc.) - but you need an initial address. (how do you get it? anyone? ) We're missing a single valid Kernel VA. three: @FAMASoon said he lost the PoC he did have. (sussy baka) something about C2 callback and rootkit activity, which makes sense in the Github issue until you realize this is standard cheat bullshit used to bypass anti-cheat. XOR is not your demon. HID keyboard direct interfaces are only bad if the client exe calls home. (where's the client?) gg - no unpriv exploit achieved. will dig deeper tomorrow. Either they ran some shit as admin, or have some primitive or leak I'm not seeing in this driver. (in either case fill me in) gg to them and good job if indeed the video is legit.