The Drift Corpus: An Open Dataset of Windows Kernel Patch Analyses
The Drift Corpus is an open dataset of Windows kernel patch analyses. It currently contains 200+ entries from 2026, each recording which functions a Microsoft update changed, which of those changes are security relevant, and the vulnerability class they imply.
Microsoft ships fixes for Windows kernel components as binary updates. The accompanying bulletins state that a vulnerability was addressed, but not which code changed or why. Recovering that requires diffing a patched build against its predecessor and separating the changes that carry security weight from the far larger number introduced by the compiler: reordered basic blocks, altered inlining, register allocation churn. The Drift Corpus is our attempt to publish these answers, automatically, and at scale.
Each entry is generated by Drift Agent, an automatic reverse engineering tool that forms part of ByteRay's Argus Cyber Reasoning System. For each update it matches functions across the two builds, computes similarity metrics over the matched blocks, and classifies every modified function as security relevant or cosmetic. Where a change is security relevant, it derives a vulnerability class and the exploit primitives the change implies, such as a kernel pool use after free.
Contents
The corpus currently contains 200+ entries covering 2026 updates. Each entry records:
- binary similarity metrics and matched block counts
- the modified functions, with assembly diffs
- a security relevant or cosmetic classification for each change
- the vulnerability class and the exploit primitives it implies
- WinDbg offsets and the conditions under which a crash reproduces
- summary of the change
The repository contains analysis output in JSON. Each entry records the KB number of the update it was derived from, which is sufficient to retrieve the corresponding binaries through the PatchPair project.
Intended use
The dataset is intended for detection engineering, exploit and vulnerability research, and as training or evaluation material for tools that reason about binary patches. The security relevant and cosmetic labels are separated for that last case in particular, since labelled examples of real kernel changes are difficult to assemble by hand.
Availability
The corpus is available at github.com/ByteRay-AI/drift-corpus and is extended as further updates are analysed. The entries can also be browsed at drift.argus-systems.ai without cloning the repository. Discussion and corrections are welcome on Discord; if a classification is wrong, we would like to know.