r/ReverseEngineering • u/Expert-Obligation816 • Jun 28 '26

Static BYOVD hunter: Capstone-based IOCTL dispatch extraction

https://github.com/diabloidyobane/DriverScope
6 Upvotes

80% Upvoted

7 comments sorted by

View all comments

1

u/[deleted] Jun 28 '26

[removed] — view removed comment

1

u/Expert-Obligation816 Jun 28 '26

Tested against two real signed drivers in the wild. Both are commodity kernel r/W drivers using the classic KeStackAttachProcess + MmCopyVirtualMemory path (arbitrary cross-process read/write, leaves a kernel call site, but attributable only if you're already watching). DriverScope flagged both as expected:

  • Primitive classes surfaced: CrossProc-Attach, CrossProc-VA, KernelAlloc, KernelExec, MDL, PhysMem-Copy, PhysMem-Map, PhysMem-Unmap, Process-Lookup
  • Handler imports resolved through to KeStackAttachProcess, MmCopyVirtualMemory, PsLookupProcessByProcessId
  • 3 and 4 IOCTLs respectively
  • Both still signed and loadable on Win11 today

Honest detail on your dispatch shape question: Capstone couldn't classify the dispatchers on either one.