GoFly Killer: Abusing a Vulnerable Kernel Driver to Terminate Protected Processes from User Mode

Reverse engineering the GoFly driver to discover an unprotected IOCTL that allows any user-mode process to kill AV/EDR ,no exploits, no…