byteray-ai/drift-corpus — explained in plain English
Analysis updated 2026-05-18
Study how a specific Windows kernel vulnerability was patched and why.
Use provided WinDbg breakpoints to reproduce a known kernel bug.
Feed structured vulnerability data into further security research or AI training.
Cross-reference a KB number with PatchPair to rebuild the actual patched binaries.
| byteray-ai/drift-corpus | gaearon/sc-bug-repro | sdras/webmcp-demo | |
|---|---|---|---|
| Stars | 14 | 14 | 14 |
| Language | CSS | CSS | CSS |
| Last pushed | — | 2022-05-23 | — |
| Maintenance | — | Dormant | — |
| Setup difficulty | easy | easy | easy |
| Complexity | 2/5 | 1/5 | 1/5 |
| Audience | researcher | developer | developer |
Figures from each repo's GitHub metadata at analysis time.
It is a static dataset, no build steps, but reconstructing actual binaries needs the separate PatchPair tool.
Drift Corpus is a dataset, not a piece of software you run. It collects analysis of security patches Microsoft has released for the Windows kernel, the core part of the operating system, and organizes that analysis into a searchable, structured archive. The data is generated by a tool called Drift Agent, an automatic reverse engineering engine built by ByteRay as part of their Argus-Systems platform. As of this writing the corpus covers 248 entries from 2026, with more being added over time. Each patched vulnerability gets its own folder containing a single JSON file with a consistent structure. That file records which binary files were compared and how similar they are, a detailed breakdown of exactly which functions changed and whether each change matters for security or is just cosmetic, an analysis of the vulnerability itself including its class and the conditions needed to trigger it, ready-made debugger breakpoints and memory watch targets to help reproduce the issue, and a plain-language summary of the patch and its root cause. Importantly, this repository does not include any of Microsoft's actual binary files. It only holds the metadata, analysis, and assembly-level diffs. Anyone who wants to reconstruct the full binaries referenced in an entry needs to fetch them separately using a companion project called PatchPair, referencing the Microsoft KB number stored in each entry's metadata. The README frames this as raw research material rather than finished exploits. It points to a Discord community for people doing further proof-of-concept and exploit development work on top of the corpus, and it asks that anyone using the data in research papers, academic work, or AI training sets cite ByteRay and the Drift engine using the provided citation formats.
A dataset of analyzed Windows kernel security patches, generated by an automatic reverse engineering tool.
Mainly CSS. The stack also includes JSON, WinDbg.
Setup difficulty is rated easy, with roughly 5min to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
double-check against the repo, no cap.