Windows 驱动 IOCTL 工具套件。
该工具包含两个不同的功能。它会猜测驱动程序接受的 IOCTL 值及其有效的长度限制，并将结果存储在文件中以便将来重用。第二个功能由 3 个简单模糊测试器组成：一个纯随机模糊测试器、一个滑动 DWORD 模糊测试器和一个异步模糊测试器。你可以按顺序运行这 3 种模糊测试器的任意组合，并可为每次模糊测试运行设置时间限制。同步模糊测试器还会在连续失败请求过多时发出警告（表示继续模糊测试可能毫无意义，例如由于权限不足），而异步模糊测试器允许你设置尝试取消的请求百分比以及并发级别（同时挂起的请求数）。其他功能包括控制详细程度，以及通过 Ctrl-C 干净地停止任何模糊测试运行的能力。每次模糊测试运行完成后，将显示累计统计数据。
dibf.exe <options> <device name>
Options:
-h You're looking at it
-i Ignore previous logfile - THIS WILL OVERWRITE IT
-l Specify custom logfile name to read from/write to (default dibf-bf-results.txt)
-d Deep IOCTL bruteforce (8-9 times slower)
-v [0-3] Verbosity level
-s [ioctl] Start IOCTL value
-e [ioctl] End IOCTL value
-t [d1,d2,d4] Timeout for each fuzzer in seconds -- no spaces and decimal input ONLY
-p [max requests] Max number of async pending requests (loosely enforced, default 64)
-a [max threads] Max number of threads, default is 2xNbOfProcessors, max is 128
-c [% cancelation] Async cancelation attempt percent rate (default 15)
-f [0-7] Fuzz flag. OR values together to run multiple
fuzzer stages. If left out, it defaults to all
stages.
0 = Brute-force IOCTLs only
1 = Sliding DWORD (sync)
2 = Random (async)
4 = Named Pipe (async)
Examples:
dibf \\.\MyDevice
dibf -v -d -s 0x10000000 \\.\MyDevice
dibf -f 0x3 \\.\MyDevice
Notes:
- The bruteforce stage will generate a file named "dibf-bf-results.txt"
in the same directory as the executable. If dibf is started with no
arguments, it will look for this file and start the fuzzer with the values
from it The -l flag can be used to specify a custom results file name.
- If not specified otherwise, command line arguments can be passed as decimal or hex (prefix with "0x")
- CTRL-C interrupts the current stage and moves to the next if any. Current statistics will be displayed.
- The statistics are cumulative.
- The command-line flags are case-insensitive.
为了向命名管道模糊测试器提供模糊测试数据包，请以 PIPE_TYPE_MESSAGE 模式连接到 \\.\pipe\dibf_pipe 并发送模糊测试数据。数据包的最后 4 个字节将被解释为 IOCTL 代码。此外，命名管道 Peach 发布器可用于在 DIBF 范围之外对命名管道端点进行模糊测试。
提供的 Peach 发布器可用于将 Peach 连接到 DIBF 的命名管道模糊测试提供器。可在 PeachNamedPipePublisher 文件夹下找到使用该提供器的示例 Peach XML 文件 peach_np.xml：
<?xml version="1.0" encoding="utf-8"?>
<Peach xmlns="http://peachfuzzer.com/2012/Peach" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://peachfuzzer.com/2012/Peach ../peach.xsd">
<!-- DataModel containing a single string -->
<DataModel name="TheDataModel">
<String value="Hello World!" />
<Number name="IOCTL0" value="EFBEADDE" valueType="hex" size="32" mutable="false" />
</DataModel>
<!-- StateModel referencing data model above -->
<StateModel name="DibfState" initialState="DibfState0">
<State name="DibfState0">
<Action type="output">
<DataModel ref="TheDataModel"/>
</Action>
</State>
</StateModel>
<!-- The test with pipe publisher -->
<Test name="Default">
<StateModel ref="DibfState"/>
<Publisher class="NamedPipe">
<Param name="host" value="." />
<Param name="pipeName" value="dibf_pipe" />
<Param name="impersonationLevel" value="1" />
</Publisher>
</Test>
</Peach>
<!-- end -->
<<<< RUNNING RANDOM FUZZER >>>>
RUN STARTED: 3/17/2014 4:14 PM
---------------------------------------
Sent Requests : 4233
Completed Requests : 4233 (4233 sync, 0 async)
SuccessfulRequests : 1254
FailedRequests : 2979
CanceledRequests : 0
RUN ENDED: 3/17/2014 4:14 PM
---------------------------------------
<<<< RUNNING SLIDING DWORD FUZZER >>>>
RUN STARTED: 3/17/2014 4:14 PM
---------------------------------------
Sent Requests : 6339
Completed Requests : 6339 (6339 sync, 0 async)
SuccessfulRequests : 1254
FailedRequests : 5085
CanceledRequests : 0
RUN ENDED: 3/17/2014 4:14 PM
---------------------------------------
<<<< RUNNING ASYNC FUZZER >>>>
RUN STARTED: 3/17/2014 4:14 PM
---------------------------------------
Sent Requests : 8272
Completed Requests : 8272 (6339 sync, 1933 async)
SuccessfulRequests : 1738
FailedRequests : 6414
CanceledRequests : 120
RUN ENDED: 3/17/2014 4:14 PM
---------------------------------------
这个非常简单的工具可对 Windows IOCTL 控制码进行编码和解码。它提供了一种用户友好的方式来处理设备类型、功能号、传输方法和访问类型的 IO 编码。
iocode.exe [IOCODE] or iocode.exe [DEVICE_TYPE] [FUNCTION] [METHOD] [ACCESS]
这是一个用于验证漏洞的工具，旨在与十六进制编辑器配合使用。一旦在其中构造好感兴趣的请求，该工具将使用命令行参数将其发送给驱动程序。响应将发送到 stdout。任意地址也可用作输入和输出缓冲区地址。
iosend [Device] [IOCODE] [InputBufFilePath|InputAdress] [InputLen] [[OutputAddress]] [OutputLen] > [Output file]
Notes:
- This utility prints error/status messages to stderr
- Input can be provided as an arbitrary address or a file name
- An output buffer is allocated and its contents eventually written to stdout unless the optional OutputAddress parameter is provided
GPLv2