Update README, deploy workflow, and site metadata for overhaul

- README: update stats (156 CVEs, 64 drivers, 57 ITW), add dashboard
  and project structure sections, document build_dashboard_data.py step
- Deploy workflow: add dashboard data generation step before mkdocs build
- mkdocs.yml: update site description with current corpus stats
- overview.md: update CVE count from 147 to 156

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: splintersfury

.github/workflows/deploy-pages.yml

@@ -24,7 +24,10 @@ jobs:
         with:
           python-version: "3.12"
 
-      - run: pip install mkdocs-material
+      - run: pip install mkdocs-material pyyaml
+
+      - name: Generate dashboard data
+        run: python scripts/build_dashboard_data.py
 
       - run: mkdocs build
 

README.md

@@ -1,33 +1,38 @@
-# KernelSight — Windows Kernel Driver Exploitation Knowledge Base
+# KernelSight
 
 [![GitHub Pages](https://img.shields.io/badge/Browse-Knowledge%20Base-blue)](https://splintersfury.github.io/KernelSight/)
-[![CVEs](https://img.shields.io/badge/CVEs-134-red)](https://splintersfury.github.io/KernelSight/case-studies/)
-[![Drivers](https://img.shields.io/badge/Drivers-62-orange)](https://splintersfury.github.io/KernelSight/driver-types/)
-[![ITW](https://img.shields.io/badge/Exploited%20ITW-52-critical)](https://splintersfury.github.io/KernelSight/guides/corpus-analytics/)
+[![CVEs](https://img.shields.io/badge/CVEs-156-red)](https://splintersfury.github.io/KernelSight/case-studies/)
+[![Drivers](https://img.shields.io/badge/Drivers-64-orange)](https://splintersfury.github.io/KernelSight/driver-types/)
+[![ITW](https://img.shields.io/badge/Exploited%20ITW-57-critical)](https://splintersfury.github.io/KernelSight/guides/corpus-analytics/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green)](LICENSE)
 
-A structured knowledge base for **Windows kernel driver exploitation** -- covering vulnerability classes, exploitation primitives, BYOVD campaigns, exploit chain patterns, and kernel mitigations. Every entry is grounded in real CVEs with driver names, vulnerable/fixed builds, and patch analysis.
+The exploitation pipeline for Windows kernel drivers, from attack surface to privilege escalation. Every entry is grounded in real CVEs with driver names, vulnerable/fixed builds, patch analysis, and detection rules.
 
 **[Browse the Knowledge Base →](https://splintersfury.github.io/KernelSight/)**
 
 ---
 
+## What is KernelSight?
+
+KernelSight is an interactive knowledge base that maps how Windows kernel drivers get exploited. It tracks 156 CVEs across 64 drivers, organized as a pipeline that mirrors how exploitation actually works: identify a driver, find its attack surface, classify the bug, convert it into a primitive, and escalate to SYSTEM.
+
+The landing page is an interactive threat intelligence dashboard with a driver-by-vuln-class heat matrix, searchable CVE explorer, and export functionality. The knowledge base behind it contains 241 pages of narrative-driven technical content covering vulnerability classes, exploitation primitives, kernel mitigations, and real-world case studies.
+
 ## Corpus
 
 | Metric | Count |
 |--------|-------|
-| CVE case studies | **134** |
-| Unique drivers analysed | **62** |
-| Exploited in the wild | **52** |
+| CVE case studies | **156** |
+| Unique drivers analysed | **64** |
+| Exploited in the wild | **57** |
 | Remotely exploitable | **2** |
 | BYOVD drivers | **41** |
 | Driver type categories | **12** |
 | Exploitation technique pages | **57** |
 | AutoPiff detection rules | **80+** |
+| LOLDrivers analysed | **1,775** |
 
-## What's Inside
-
-### The Exploitation Pipeline
+## The Exploitation Pipeline
 
 KernelSight is organized as a pipeline from driver identification through privilege escalation:
 
@@ -39,43 +44,45 @@ With **[Mitigations](https://splintersfury.github.io/KernelSight/mitigations/)**
 
 | Driver Type | Example Drivers | CVEs | Key Pattern |
 |---|---|---|---|
-| **File System** | ntfs.sys, fastfat.sys, refs.sys | 7 | VHD mount gives unprivileged access to on-disk parsing |
+| **File System** | ntfs.sys, fastfat.sys | 7 | VHD mount gives unprivileged access to on-disk parsing |
 | **Minifilters** | cldflt.sys | 8 | Reparse data and cloud file callbacks |
-| **Log / Transaction** | clfs.sys | 12 | Most exploited single driver -- on-disk metadata corruption |
+| **Log / Transaction** | clfs.sys | 15 | Most exploited single driver, on-disk metadata corruption |
 | **Network Stack** | tcpip.sys, afd.sys, http.sys | 13 | Includes 2 remotely exploitable bugs (IPv6 RCE, HTTP RCE) |
-| **Kernel Streaming** | ks.sys, mskssrv.sys, ksthunk.sys | 12 | IOCTL handlers, MDL mapping, type confusion |
+| **Kernel Streaming** | ks.sys, mskssrv.sys, ksthunk.sys | 14 | IOCTL handlers, MDL mapping, type confusion |
 | **Win32k** | win32k.sys, win32kbase.sys, win32kfull.sys | 12 | Callback reentrancy, window object races |
-| **Core Kernel** | ntoskrnl.exe | 9 | Token races, secure-mode bypasses, highest impact |
+| **Core Kernel** | ntoskrnl.exe | 13 | Token races, secure-mode bypasses, highest impact |
 | **Security / Policy** | appid.sys, ci.dll | 2 | Missing IOCTL access checks |
 | **Storage / Caching** | csc.sys, storvsp.sys | 2 | Logic bugs, PreviousMode manipulation |
-| **Vendor Utility** | RTCore64.sys, DBUtil_2_3.sys | 15+ | Physical memory mapping, MSR access -- BYOVD weapons |
+| **Vendor Utility** | RTCore64.sys, DBUtil_2_3.sys | 15+ | Physical memory mapping, MSR access, BYOVD weapons |
 | **Performance & GPU** | dxgkrnl.sys, dwmcore.dll | 8+ | DMA, shared memory, kernel streaming |
 | **Third-Party Security** | Truesight.sys, amsdk.sys | 5+ | EDR bypass, process termination primitives |
 
 ### Guides
 
 - **[Why Kernel Drivers?](https://splintersfury.github.io/KernelSight/guides/why-kernel-drivers/)** -- what hardware enforces, what only Ring 0 can do, user-mode alternatives
 - **[Anatomy of a Secure Driver](https://splintersfury.github.io/KernelSight/guides/secure-driver-anatomy/)** -- the 6 anti-patterns behind most kernel driver CVEs
-- **[Corpus Analytics](https://splintersfury.github.io/KernelSight/guides/corpus-analytics/)** -- visual breakdown of 134 CVEs by driver, year, vulnerability class
+- **[Corpus Analytics](https://splintersfury.github.io/KernelSight/guides/corpus-analytics/)** -- visual breakdown of 156 CVEs by driver, year, vulnerability class
 - **[Exploit Chain Patterns](https://splintersfury.github.io/KernelSight/guides/exploit-chain-patterns/)** -- the 5 recurring exploit chain shapes
 - **[Patch Patterns](https://splintersfury.github.io/KernelSight/guides/patch-patterns/)** -- what Microsoft's fixes look like for each bug class
 - **[Mitigation Timeline](https://splintersfury.github.io/KernelSight/guides/mitigation-timeline/)** -- when each kernel defence landed
 
 ### Deep Dives
 
-- **[CLFS Deep-Dive](https://splintersfury.github.io/KernelSight/case-studies/clfs-deep-dive/)** -- 12 CVEs, 3 exploited in the wild
-- **[AFD Deep-Dive](https://splintersfury.github.io/KernelSight/case-studies/afd-deep-dive/)** -- 13 CVEs, socket teardown races
-- **[Win32k Deep-Dive](https://splintersfury.github.io/KernelSight/case-studies/win32k-deep-dive/)** -- 12 CVEs, callback reentrancy
+- **[CLFS Deep-Dive](https://splintersfury.github.io/KernelSight/case-studies/clfs-deep-dive/)** -- 15 CVEs, the most exploited Windows kernel attack surface
+- **[AFD Deep-Dive](https://splintersfury.github.io/KernelSight/case-studies/afd-deep-dive/)** -- 13 CVEs, socket teardown races and Lazarus Group campaigns
+- **[Win32k Deep-Dive](https://splintersfury.github.io/KernelSight/case-studies/win32k-deep-dive/)** -- 12 CVEs, callback reentrancy and the evolution of exploitation
 - **[NTFS Deep-Dive](https://splintersfury.github.io/KernelSight/case-studies/ntfs-deep-dive/)** -- 7 CVEs, crafted VHD exploitation
 
 ### Additional Sections
 
+- **[Dashboard](https://splintersfury.github.io/KernelSight/)** -- interactive threat matrix, searchable CVE explorer, CSV/JSON export
 - **[Attack Surfaces](https://splintersfury.github.io/KernelSight/attack-surfaces/)** (9) -- IOCTL handlers, filesystem IRPs, NDIS/network, ALPC, shared memory, WMI/ETW
 - **[Vulnerability Classes](https://splintersfury.github.io/KernelSight/vuln-classes/)** (10) -- buffer overflow, UAF, type confusion, TOCTOU, race conditions, integer overflow
-- **[Exploitation Primitives](https://splintersfury.github.io/KernelSight/primitives/)** (19) -- arbitrary R/W families + exploitation building blocks (pool spray, I/O Ring, WNF, token swap, PreviousMode)
+- **[Exploitation Primitives](https://splintersfury.github.io/KernelSight/primitives/)** (19) -- arbitrary R/W families + exploitation building blocks
 - **[Mitigations](https://splintersfury.github.io/KernelSight/mitigations/)** (9) -- SMEP/SMAP, kCFG/kCET, VBS/HVCI, KDP, pool hardening, KASLR
 - **[BYOVD](https://splintersfury.github.io/KernelSight/reference/byovd/)** -- Bring Your Own Vulnerable Driver attack pattern
 - **[Tooling](https://splintersfury.github.io/KernelSight/tooling/)** -- static analysis, fuzzing, debugging, patch diffing, AutoPiff integration
+- **[LOLDrivers Analysis](https://splintersfury.github.io/KernelSight/reference/loldrivers-analysis/)** -- 1,775 drivers analysed with automated Ghidra decompilation
 
 ## Quick Start
 
@@ -88,9 +95,37 @@ Visit **[splintersfury.github.io/KernelSight](https://splintersfury.github.io/Ke
 ```bash
 git clone https://github.com/splintersfury/KernelSight.git
 cd KernelSight
-pip install mkdocs-material
-mkdocs serve
-# Open http://localhost:8000
+pip install mkdocs-material pyyaml
+python scripts/build_dashboard_data.py   # generate dashboard data
+mkdocs serve                              # open http://localhost:8000
+```
+
+### Project Structure
+
+```
+KernelSight/
+├── docs/                    # MkDocs source (241 markdown pages)
+│   ├── index.md             # Dashboard landing page (custom template)
+│   ├── overview.md          # Pipeline overview page
+│   ├── driver-types/        # 12 driver categories
+│   ├── attack-surfaces/     # 9 attack vectors
+│   ├── vuln-classes/        # 10 vulnerability classes
+│   ├── primitives/          # 19 exploitation techniques
+│   ├── case-studies/        # 161 CVE case studies + 4 deep dives
+│   ├── mitigations/         # 9 kernel defences
+│   ├── guides/              # 6 synthesis essays
+│   ├── tooling/             # 5 tool guides
+│   ├── reference/           # BYOVD, LOLDrivers, KDU, resources
+│   ├── overrides/           # Custom dashboard HTML template
+│   └── assets/              # Dashboard JS, data JSON
+├── index/                   # YAML data indices
+│   ├── cve_index.yaml       # 156 CVE definitions
+│   ├── driver_index.yaml    # Driver metadata
+│   ├── techniques.yaml      # Technique registry
+│   └── autopiff_rule_map.yaml
+├── collector/               # Automated CVE data collector (Docker)
+├── scripts/                 # Build scripts
+└── mkdocs.yml               # Site configuration
 ```
 
 ## Related Projects
@@ -100,12 +135,13 @@ mkdocs serve
 
 ## Contributing
 
-Contributions welcome -- whether adding a case study, documenting a new technique, or improving existing entries.
+Contributions welcome, whether adding a case study, documenting a new technique, or improving existing entries.
 
 1. Use the templates in `templates/` as a starting point
 2. Follow the schema in `index/techniques.yaml`
 3. Cross-reference CVEs to techniques, techniques to mitigations
-4. Open a PR
+4. Run `python scripts/build_dashboard_data.py` to regenerate dashboard data
+5. Open a PR
 
 ## License
 

docs/overview.md

@@ -1,13 +1,13 @@
 ---
 hide:
   - toc
-description: "Windows kernel driver exploitation knowledge base — 147 CVEs across 64 drivers, exploit chain patterns, BYOVD analysis, mitigations, and exploitation primitives."
+description: "Windows kernel driver exploitation knowledge base — 156 CVEs across 64 drivers, exploit chain patterns, BYOVD analysis, mitigations, and exploitation primitives."
 ---
 
 <div class="ks-hero-title" markdown>KernelSight</div>
 
 <p class="ks-hero-subtitle">
-A structured knowledge base for Windows kernel driver exploitation, organized as a pipeline from driver identification through privilege escalation. Covers 147 real CVEs across Microsoft inbox and third-party BYOVD drivers.
+A structured knowledge base for Windows kernel driver exploitation, organized as a pipeline from driver identification through privilege escalation. Covers 156 real CVEs across Microsoft inbox and third-party BYOVD drivers.
 </p>
 
 ## Recent Updates
@@ -127,7 +127,7 @@ A structured knowledge base for Windows kernel driver exploitation, organized as
 ## Corpus
 
 <div class="ks-stats-box" markdown>
-<span class="ks-stat-num">147</span> CVE case studies &nbsp;&middot;&nbsp;
+<span class="ks-stat-num">156</span> CVE case studies &nbsp;&middot;&nbsp;
 <span class="ks-stat-num">64</span> unique drivers &nbsp;&middot;&nbsp;
 <span class="ks-stat-num">57</span> exploited in the wild &nbsp;&middot;&nbsp;
 <span class="ks-stat-num">2</span> remotely exploitable<br>

mkdocs.yml

@@ -1,5 +1,5 @@
 site_name: KernelSight
-site_description: Windows kernel driver exploitation knowledge base — 134 CVEs, 62 drivers, exploit chains, mitigations, and BYOVD analysis.
+site_description: Windows kernel driver exploitation knowledge base — 156 CVEs, 64 drivers, exploit chains, mitigations, and BYOVD analysis.
 repo_url: https://github.com/splintersfury/KernelSight
 site_url: https://splintersfury.github.io/KernelSight/