OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Tuesday, December 21 2010 05:04.33 CST

Direct Link, View / Make / Edit Comments

IOCTL Fuzzer

Author:

dolex

# Views: 5857

I released a new version of IOCTLFuzzer - tool, that has been designed to automate the task of searching vulnerabilities in Windows kernel drivers by performing fuzz tests on them. Also, it can be used for passive IOCTL's and exceptions monitoring.

The fuzzers own driver hooks nt!NtDeviceIoControlFile() in order to take control of all IOCTL requests throughout the system.

While processing IOCTLs, the fuzzer will spoof those IOCTLs conforming to conditions specified in the configuration file. A spoofed IOCTL is identical to the original IRP in all respects except the input data, which is changed to randomly generated fuzz.

Features:

- Windows 7 support
- Full support of 64-bit versions of Windows
- Exceptions monitoring
- "Fair Fuzzing" feature
- Different data generation modes
- Boot fuzzing (during OS initialization)

Exceptions monitoring based on nt!KiDispatchException() hooking.
IOCTLFuzzer obtains it's address from kernel PDB symbols, so, it can work on any version of Windows.

Program page:
http://code.google.com/p/ioctlfuzzer/

Readme:
http://code.google.com/p/ioctlfuzzer/source/browse/trunk/README.TXT

Download link:
http://ioctlfuzzer.googlecode.com/files/ioctl_fuzzer-1.2.zip

Archived Entries for dolex

Subject	# Views	Created On
No archived blog entries found.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit