ForceIO: Standalone no-CRT C tool for minifilter-bypass file operations (delete/move/copy) on Windows 11. Routes kernel I/O below WdFilter.sys via WHCP-signed IObitUnlocker.sys. Atomic ephemeral SCM sessions, FDI/LZX in-memory decompression from application icon, build-time PE overlay checksum bypass. Full RE writeup with source and binaries
reverse-engineering windows-kernel infosec kernel-driver ioctl file-operations security-research windows-defender deviceiocontrol windows-11 no-crt byovd signed-driver scm-service minifilter-bypass wdfilter whcp pe-checksum driver-validation cabinet-api
-
Updated
Jun 25, 2026 - C