cthaeh - 🌳 Automated triage scanner for Windows kernel driv

项目说明

Cthaeh

> [!IMPORTANT]
> Archi prototype. Cthaeh is not maintained and has not
> been as a reliable end-to-end dri system. This
> repository remains public as a research artifact. Its heuristics are search
> hints, not findings or e of exploitability.

Ghidra powered triage scanner for Windows kernel drivers. Cthaeh scores .sys
files across 97 heuristics so researchers can decide
which drivers deser reverse engineering first.

Cthaeh is not a finder and does not generate exploits. It is a
ranking and e collection tool for dri surface, dangerous
kernel primitives, gaps, BYO, context, and prior
C.

Sample Output

Quick Start

Set GHIDRA_HOME to avoid passing --ghidra each time. Pre-filtering, parallel
workers, JSON output, and markdown reporting are enabled by default.

For repeatable DTA setup, pin the Talos archive hash:

You can also set CTHAEH_DTA_SHA256 in the en.

Research Workflow

1. Extract a candidate corpus from Dri.
2. Run the pre-filter to keep obvious low-signal drivers out of Ghidra.
3. Run Ghidra headless analysis in parallel.
4. Review HIGH and CRITICAL drivers first.
5. Use --explain to inspect why a dri highly.
6. device accessibility and hardware presence when relevant.
7. Record completed work in in.json so known results are skipped.

Priority Tiers

| Tier | Threshold | Action |
|------|-----------|--------|
| CRITICAL | >= 250 | Analyze immediately |
| HIGH | >= 150 | In soon |
| MEDIUM | >= 75 | Worth a look |
| LOW | >= 30 | Park unless new context appears |
| SKIP | < 30 | Deprioritize |

Thresholds and weights live in scoring_rules.yaml. Treat threshold changes as
calibration events, not one-off edits.

Useful Commands

See ROADMAP.md for the outcome-metric contract
and the recalibration loop.

In Drivers

Already analyzed drivers go in in.json and are skipped on future
scans. skipping is supported: if a dri changes, Cthaeh
will re-scan it.

disposition classifies the entry for calibration: confirmed_vuln (should
score HIGH+ when scanned), false_positive (scored high but not exploitable,
must rank below HIGH), or in (analyzed, no calibration assertion).
calibrate_scoring.py only flags false_positive drivers that still rank
HIGH+, so confirmed vulns are no longer mistaken for false positives.

Requirements

See REFERENCE.md for the full technical reference, CLI flags,
en , and heuristic categories.

Review Artifacts

Acknowledgments

License

MIT

项目信息

开发语言：Python

Star 数：17

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🌳 Automated triage scanner for Windows kernel driver vulnerabilities. Ghidra headless + heuristic scoring.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。