Driver Vuln Analyzer

October 12, 2025 · View on GitHub

Static triage for Windows drivers: heuristically extracts & decodes IOCTLs, highlights suspicious APIs, surfaces device names, and writes a JSON report. Works as:

  • IDA plugin/script (driver_vuln_analyzer_ida.py)
  • (Optional) Ghidra script counterpart if you add it later

Features

  • IOCTL discovery from immediates and CTL_CODE decoding (DeviceType, Function, Method, Access)
  • Flags METHOD_NEITHER occurrences (pointer/buffer validation risk)
  • Highlights sensitive kernel APIs (e.g., RtlCopyMemory, ProbeForRead/Write, MmMapIoSpace, ZwMapViewOfSection, …)
  • Collects device/interface strings (\Device\..., \DosDevices\..., \??\...)
  • Exports consolidated JSON report

Folder structure

driver-vuln-analyzer/
├─ ida-plugin.json
├─ driver_vuln_analyzer_ida.py
└─ assets/
   └─ logo.png

Requirements

  • IDA 9.0+ (Python 3)
  • No external Python deps required for the basic flow

Install (IDA)

  1. Copy the folder to your IDA user plugins dir, e.g.

    • Windows: C:\Users\<you>\AppData\Roaming\Hex-Rays\IDA Pro\plugins\driver-vuln-analyzer\
    • Linux/macOS: ~/.idapro/plugins/driver-vuln-analyzer/

  2. Ensure ida-plugin.json and driver_vuln_analyzer_ida.py are side by side.

  3. Restart IDA.

Usage (IDA)

  • Open the target .sys in IDA and let analysis finish.

  • Run via Edit → Plugins → Driver Vuln Analyzer.

  • A summary prints to the IDA output; a JSON report is written to your IDA user folder:

    driver_vuln_report_<input-filename>.json

Printscreen

image image

Hotkeys

  • (Registered in menu action) Suggested: Ctrl+Alt+9 to start via menu binding.
  • You can also run the script directly: File → Script file… (Alt+F7).

Output

  • driver_vuln_report_<file>.json includes:

    • device_strings: discovered device/interface strings
    • functions: per-function IOCTLs, call sites, suspicious API hits, red flags
    • ioctls_flat: unique IOCTLs with frequency and where they appear
    • summary: counts and METHOD_NEITHER presence

Notes & heuristics

  • IOCTL enumeration is heuristic (immediate values in code). For precise control-flow mapping of dispatchers, integrate with deeper analysis (e.g., identify IRP_MJ_DEVICE_CONTROL handlers).
  • “Suspicious” APIs are hints, not proof of a vulnerability.

Roadmap (ideas)

  • Lightweight dataflow for IRP buffers
  • Automatic detection of DriverObject->MajorFunction assignments
  • HTML/CSV report export
  • Risk scoring

Credits

Inspired by community work around Windows driver analysis and IOCTL decoding (e.g., DriverBuddy-style workflows).