VoidSec/DriverBuddyReloaded

[BUG] "IOCTL Decode All" pick-up NTSTATUS values

VoidSec opened this issue 3 years ago · 0 comments

VoidSec commented 3 years ago

In

DriverBuddyReloaded/DriverBuddyReloaded.py

Line 185 in d272537

if digits == 10:
DriverBuddyReloaded/DriverBuddyReloaded.py

Line 230 in d272537

if digits == 10:

decoding suspected IOCTL codes sometimes "pick-up" NTSTATUS values.

the fix I can think of is comparing the suspected IOCTL code vs a known set of NTSTATUS values and discarding it if matching.