# IOCTLance | A Tool That Is Used To Hunt Vulnerabilities In X64 WDM Drivers

**URL:** <https://onehack.st/t/ioctlance-a-tool-that-is-used-to-hunt-vulnerabilities-in-x64-wdm-drivers/282577>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies\
**Created:** [May 9, 2024, 7:44pm UTC](https://onehack.st/t/ioctlance-a-tool-that-is-used-to-hunt-vulnerabilities-in-x64-wdm-drivers/282577 "2024-05-09T19:44:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [May 9, 2024, 7:44pm UTC](https://onehack.st/t/ioctlance-a-tool-that-is-used-to-hunt-vulnerabilities-in-x64-wdm-drivers/282577/1 "2024-05-09T19:44:19Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/5/2/52118262a1ef808cc40df516a7e1a5f33c006066.png)

## Description

Presented at [CODE BLUE 2023](https://codeblue.jp/2023/en/), this project titled [Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis](https://drive.google.com/file/d/1lEegyJ1SBB_lDts6F3W3JPySucM3nugR/view?usp=sharing) introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model (WDM) drivers. In a comprehensive evaluation involving 104 known vulnerable WDM drivers and 328 unknown ones, IOCTLance successfully unveiled 117 previously unidentified vulnerabilities within 26 distinct drivers. As a result, 41 CVEs were reported, encompassing 25 cases of denial of service, 5 instances of insufficient access control, and 11 examples of elevation of privilege.

## Features

### Target Vulnerability Types

- map physical memory
- controllable process handle
- buffer overflow
- null pointer dereference
- read/write controllable address
- arbitrary shellcode execution
- arbitrary wrmsr
- arbitrary out
- dangerous file operation

### Optional Customizations

- length limit
- loop bound
- total timeout
- IoControlCode timeout
- recursion
- symbolize data section

## Build

### Docker (Recommand)

```auto
docker build .

```

### Local

```auto
dpkg --add-architecture i386
apt-get update
apt-get install git build-essential python3 python3-pip python3-dev htop vim sudo \
                openjdk-8-jdk zlib1g:i386 libtinfo5:i386 libstdc++6:i386 libgcc1:i386 \
                libc6:i386 libssl-dev nasm binutils-multiarch qtdeclarative5-dev libpixman-1-dev \
                libglib2.0-dev debian-archive-keyring debootstrap libtool libreadline-dev cmake \
                libffi-dev libxslt1-dev libxml2-dev

pip install angr==9.2.18 ipython==8.5.0 ipdb==0.13.9

```

## Analysis

```auto
# python3 analysis/ioctlance.py -h
usage: ioctlance.py [-h] [-i IOCTLCODE] [-T TOTAL_TIMEOUT] [-t TIMEOUT] [-l LENGTH] [-b BOUND]
                    [-g GLOBAL_VAR] [-a ADDRESS] [-e EXCLUDE] [-o] [-r] [-c] [-d]
                    path

positional arguments:
  path dir (including subdirectory) or file path to the driver(s) to analyze

optional arguments:
  -h, --help show this help message and exit
  -i IOCTLCODE, --ioctlcode IOCTLCODE
                        analyze specified IoControlCode (e.g. 22201c)
  -T TOTAL_TIMEOUT, --total_timeout TOTAL_TIMEOUT
                        total timeout for the whole symbolic execution (default 1200, 0 to unlimited)
  -t TIMEOUT, --timeout TIMEOUT
                        timeout for analyze each IoControlCode (default 40, 0 to unlimited)
  -l LENGTH, --length LENGTH
                        the limit of number of instructions for technique LengthLimiter (default 0, 0
                        to unlimited)
  -b BOUND, --bound BOUND
                        the bound for technique LoopSeer (default 0, 0 to unlimited)
  -g GLOBAL_VAR, --global_var GLOBAL_VAR
                        symbolize how many bytes in .data section (default 0 hex)
  -a ADDRESS, --address ADDRESS
                        address of ioctl handler to directly start hunting with blank state (e.g.
                        140005c20)
  -e EXCLUDE, --exclude EXCLUDE
                        exclude function address split with , (e.g. 140005c20,140006c20)
  -o, --overwrite overwrite x.sys.json if x.sys has been analyzed (default False)
  -r, --recursion do not kill state if detecting recursion (default False)
  -c, --complete get complete base state (default False)
  -d, --debug print debug info while analyzing (default False)

```

## Evaluation

```auto
# python3 evaluation/statistics.py -h
usage: statistics.py [-h] [-w] path

positional arguments:
  path target dir or file path

optional arguments:
  -h, --help show this help message and exit
  -w, --wdm copy the wdm drivers into <path>/wdm

```

## Test

1. Compile the testing examples in [test](https://github.com/zeze-zeze/ioctlance/blob/main/test) to generate testing driver files.
2. Run IOCTLance against the drvier files.

## Reference

- [ucsb-seclab/popkorn-artifact](https://github.com/ucsb-seclab/popkorn-artifact)
- [eclypsium/Screwed-Drivers](https://github.com/eclypsium/Screwed-Drivers)
- [koutto/ioctlbf](https://github.com/koutto/ioctlbf)
- [Living Off The Land Drivers](https://www.loldrivers.io/)

## GitHub:

> **[GitHub - zeze-zeze/ioctlance: A tool that is used to hunt vulnerabilities in x64...](https://github.com/zeze-zeze/ioctlance)**
>
> A tool that is used to hunt vulnerabilities in x64 WDM drivers