VoidSec/DriverBuddyReloaded

[BUG] WDF Structures

VoidSec opened this issue · 4 comments

In commit 43eba17 I've finished updating IDA's APIs and fixing breaking code changes.

Unfortunately, despite the script is not breaking anymore, it seems that it still fails this condition at:

if ida_bytes.create_struct(wdf_func, size, id) and idc.set_name(wdf_func, 'WdfFunctions', 0):

for a reason that, at the moment, is unknown. The logic behind https://github.com/VoidSec/DriverBuddyReloaded/blob/main/DriverBuddyReloaded/wdf.py is pretty "hacky" and somewhat "obscure". In addition to that, I'm not sure that the logic detecting the WDF version at

version = int(str(idc.get_wide_dword(addr + ptr_size + 0x4)))
makes complete sense.

We should also update the WDF structures in order to include updated ones and keep them updated as I'm pretty sure the latest WDF version is >= 1.13.

@harelon / @eranzim do you think you could give it a try and try to understand and fix that?

Working on it

@harelon thank you! I've seen your pull request; I'll test it this weekend and merge it consequently :D

fixed in #24