Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks
GNU General Public License v3.0
313
stars
46
forks
source link
[BUG] "IOCTL Decode All" is missing some cases #2
Closed
VoidSec closed 2 years ago
In
https://github.com/VoidSec/DriverBuddyReloaded/blob/d272537d6cc9ff7c16eccb5aa04d101401bc203e/DriverBuddyReloaded.py#L179
"IOCTL Decode All" function is missing some cases as can be shown in the following image:![image](https://user-images.githubusercontent.com/5717603/138674497-e0d3917b-011d-4ee4-a16b-73e34bead5a5.png)
The only immediate fix I can think of is reworking the heuristic functionality:
cmp, mov, sub
operationsNTSTATUS
valuesWill probably generate some more false positives but it will cover "switch" cases falling into "default" case and such