What is drift-corpus?

Drift Corpus is a dataset, not a piece of software you run. It collects analysis of security patches Microsoft has released for the Windows kernel, the core part of the operating system, and organizes that analysis into a searchable, structured archive. The data is generated by a tool called Drift Agent, an automatic reverse engineering engine built by ByteRay as part of their Argus-Systems platform. As of this writing the corpus covers 248 entries from 2026, with more being added over time. Each patched vulnerability gets its own folder containing a single JSON file with a consistent structure. That file records which binary files were compared and how similar they are, a detailed breakdown of exactly which functions changed and whether each change matters for security or is just cosmetic, an analysis of the vulnerability itself including its class and the conditions needed to trigger it, ready-made debugger breakpoints and memory watch targets to help reproduce the issue, and a plain-language summary of the patch and its root cause. Importantly, this repository does not include any of Microsoft's actual binary files. It only holds the metadata, analysis, and assembly-level diffs. Anyone who wants to reconstruct the full binaries referenced in an entry needs to fetch them separately using a companion project called PatchPair, referencing the Microsoft KB number stored in each entry's metadata. The README frames this as raw research material rather than finished exploits. It points to a Discord community for people doing further proof-of-concept and exploit development work on top of the corpus, and it asks that anyone using the data in research papers, academic work, or AI training sets cite ByteRay and the Drift engine using the provided citation formats.