[BUG] WDF/KMDF detection
VoidSec opened this issue · 1 comments
VoidSec commented
Describe the bug
WDF detection library correctly detect a KmdfLibrary but the driver is marked as WSF anyway
To Reproduce
[WDF]: Found KmdfLibrary string at 0x14000f388
[WDF]: Creating struct for KmdfLibrary Functions version 1.11
[WDF]: doStruct (size=0xdb0) at 0x140010430
[WDF]: Success
[+] Driver type detected: WDF
Expected behavior
[+] Driver type detected: KMDF
VoidSec commented
Possible solution:
If there's any import from WDFLDR.sys they are KMDF drivers