DriverDiscovery
audit · decode · trace
A Windows kernel driver IOCTL auditing tool - statically analyses a .sys driver to enumerate its IOCTL dispatch interface, decode each control code, recover buffer layouts, and map the kernel functions each handler calls.
Free 7-day trial · Windows 10 / 11 · 64-bit
See it in action
Every IOCTL a driver accepts, decoded
One driver analysed: the table lists each control code with its device type, access, method and function, the handler it reaches and how that handler was found, while the detail pane breaks the selected IOCTL down to its buffer layout and disassembly.
Why DriverDiscovery
From a driver on disk to its attack surface
Static analysis of the dispatch routine, arithmetic deobfuscation, runtime tracing for the paths static analysis cannot reach - and a report you can hand over at the end of it.
Static PE analysis
Parses the driver straight off disk and identifies what it is - WDM, WDF, NDIS or a minifilter - then goes after the dispatch routine that serves user mode.
CTL_CODE decode
Every control code is split into its device type,
required access, transfer method and
function number, so a raw 0x8000201C reads as what it
actually is.
Dispatch handler tracing
Follows the dispatch routine through compiler-generated switch tables and hand-written if-else chains alike, and reports the handler each code lands on with its RVA.
Arithmetic deobfuscation
Where a driver mutates its codes before comparing them, the XOR, ADD and AND transforms are reversed to recover the real value a caller has to send.
Buffer layouts recovered
Reads the input and output sizes an IOCTL expects and the way it moves them - buffered, direct or neither - so a request can be built to the right shape first time.
Kernel calls per IOCTL
Records the imports and kernel routines each handler reaches for, turning a list of codes into a map of what the driver will do on your behalf.
Runtime ETW tracing
For dispatch paths that resist static analysis, DriverDiscovery watches the driver live and records the codes that actually arrive - the obfuscated ones included.
HTML report export
Export the whole analysis to a single HTML file that carries the table, the decoded fields and its own in-browser filter - so a result travels as one attachment.
Call templates on demand
Turn any decoded IOCTL into ready-to-compile C or C# calling code, with the control code and buffer sizes already filled in.
Kernel debug host setup
Prepares the analysis machine for kernel debugging from inside the tool, so getting a target ready is not a detour through half a dozen manual steps.