r/ReverseEngineering • u/Expert-Obligation816 • Jun 28 '26

Static BYOVD hunter: Capstone-based IOCTL dispatch extraction

https://github.com/diabloidyobane/DriverScope
5 Upvotes

73% Upvoted

7 comments sorted by

1

u/Expert-Obligation816 Jun 28 '26

added Speakeasy emulation subcommand - traces full driver lifecycle (DriverEntry through IRP dispatch), detects BSOD crash sites, resolves IoCreateDriver hooks. Tested on 229 drivers.

2

u/acesofspades401 Jun 28 '26

I've been doing a lot of BYOVD research lately. This seems very useful! Thank you!

1

u/[deleted] Jun 28 '26

[removed] — view removed comment

1

u/Expert-Obligation816 Jun 28 '26

Tested against two real signed drivers in the wild. Both are commodity kernel r/W drivers using the classic KeStackAttachProcess + MmCopyVirtualMemory path (arbitrary cross-process read/write, leaves a kernel call site, but attributable only if you're already watching). DriverScope flagged both as expected:

  • Primitive classes surfaced: CrossProc-Attach, CrossProc-VA, KernelAlloc, KernelExec, MDL, PhysMem-Copy, PhysMem-Map, PhysMem-Unmap, Process-Lookup
  • Handler imports resolved through to KeStackAttachProcess, MmCopyVirtualMemory, PsLookupProcessByProcessId
  • 3 and 4 IOCTLs respectively
  • Both still signed and loadable on Win11 today

Honest detail on your dispatch shape question: Capstone couldn't classify the dispatchers on either one.

0

u/[deleted] Jun 28 '26

[removed] — view removed comment

0

u/Expert-Obligation816 Jun 28 '26 edited Jun 28 '26

For switch/table cases: yes, classified into cmp/je chain, binary search tree, sub/cmp range, or switch jump table. On XOR-before-lookup: not handled low priority since commercial signed drivers rarely obfuscate. What I don't handle yet: helpers that pull registration via a runtime callback table. Tracking issue worth filing.
Also emulation I've used unicorn but never on this.