[BUG] "IOCTL Decode All" pick-up NTSTATUS values

VoidSec / DriverBuddyReloaded

Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks

https://voidsec.com/driver-buddy-reloaded

GNU General Public License v3.0

313 stars 46 forks source link

Closed VoidSec closed 2 years ago

VoidSec commented 2 years ago

decoding suspected IOCTL codes sometimes "pick-up" NTSTATUS values.

[x] the fix I can think of is comparing the suspected IOCTL code vs a known set of NTSTATUS values and discarding it if matching.