TDL, or Turla Driver Loader, is an archived Windows research utility focused on unconventional kernel driver loading. It was developed for 64-bit versions of Windows 7, Windows 8, Windows 8.1, and Windows 10. The project demonstrates a method of loading specially prepared kernel drivers outside the standard Windows driver-loading process. Its design was closely related to research into Driver Signature Enforcement and techniques observed in the Turla malware family. Administrative privileges are required, and loaded drivers must meet specific structural limitations. The repository has been read-only since 2019 and is primarily relevant as historical Windows kernel security research rather than a maintained deployment tool.
Features
- Alternative kernel driver loading research
- Windows x64 kernel experimentation
- Driver Signature Enforcement research
- Support for specially designed drivers
- Historical Turla technique reference
- Archived source code for security study
Project Samples
