Orchestrating LLMs to audit Windows kernel drivers

What it does DeepZero is a Python pipeline engine that automates vulnerability research workflows. You define stages in YAML—ingest, filter, transform, and LLM-assess—and the engine orchestrates execution across a file corpus with parallelism and fault tolerance. The shipped loldrivers pipeline shows the intended use: parsing Windows driver metadata, decompiling binaries with headless Ghidra, filtering known hashes, scanning with Semgrep, and prompting an LLM via LiteLLM to identify exploitable IOCTLs.

The interesting bit The resumable state is the quiet killer feature. Atomic per-sample state on disk means a mid-run interruption does not waste hours of decompilation; you simply resume. That matters when you are processing thousands of kernel drivers and paying for LLM tokens.

Key highlights

• Declarative YAML pipelines chain custom Python processors (ingest, map, reduce, bulk map).
• Built-in integrations with headless Ghidra, Semgrep, and LiteLLM via Jinja2 prompt templates.
• ThreadPoolExecutor handles per-stage concurrency, and runs survive crashes or interruptions.
• Extensible architecture: drop in custom processor classes and reference them by module path.
• Cross-platform support for Windows and Linux, though the target corpus is Windows drivers.

Caveats

• The REST API is explicitly marked experimental and incomplete.
• The README frames DeepZero as a general engine, but the only shipped example pipeline targets Windows kernel drivers; other domains require writing your own processors.

Verdict Security researchers automating Windows driver audits get the most value today. Everyone else is looking at a capable but sparsely populated workflow framework.