Gray Hat Python

Building a Driver Fuzzer

The first step is to create our IOCTL-dumping PyCommand to run inside Immunity Debugger. Crack open a new Python file, name it ioctl_dump.py, and enter the following code.

ioctl_dump.py

ioctl_dump.py

  import pickle
  import driverlib
  from immlib import *

  def main( args ):
      ioctl_list  = []
      device_list = []

      imm    = Debugger()
      driver = driverlib.Driver()

      # Grab the list of IOCTL codes and device names
      ioctl_list  = driver.getIOCTLCodes()
       if not len(ioctl_list):
           return "[*] ERROR! Couldn't find any IOCTL codes."

 device_list = driver.getDeviceNames() ...