ioctlpus's Introduction

IOCTLpus

IOCTLpus can be used to make DeviceIoControl requests with arbitrary inputs (with functionality somewhat similar to Burp Repeater).

Here is an example of a communication with a driver:

If no arguments is passed to IOCTLpus, it will run in GUI mode; if the --cli argument is passed it will run in CLI mode.

Example: --cli --guid \\.\PhysicalDrive0 --ioctl 70000 -i 32 -o 32 --input 0000000000000000000000000000000000000000000000000000000000000000

CLI Usage:

  --cli                Run IOCTLpus in CLI mode.

  --guid               Path/GUID of the driver to interact with.

  --ioctl              IOCTL code.

  -i, --input-size     (Default: 32) Input Size (decimal).

  -o, --output-size    (Default: 32) Output Size (decimal).

  --input              Input buffer.

  -r, --repeat         (Default: 0) # of times to repeat the IOCTL request.

  --access-mask        (Default: 20000000) Access Mask.

  --help               Display this help screen.

  --version            Display version information.

Tentative Roadmap

Create handles using Device Interface GUIDs in addition to symbolic links. [GIF]
Persist requests to SQLite databases.
Apply filters to request history.
Integrate Kaitai Struct to define and view buffer structures (inspired by).
Develop an API to use the tool headlessly (e.g. for fuzzing).
Design a cool logo.

Similar Tools

Developers

Developed in 2017 by Jackson Thuraisamy @Jackson_T
Updated in 2021 by Paolo Stagno @Void_Sec

Licence

GPLv3

ioctlpus's People

Contributors

Stargazers

Watchers

ioctlpus's Issues

Copy & Paste from buffer textarea

Remove default admin privileges

`nudInputSize/nudOutputSize` does not reflect the actual buffer size

Updating nudInputSize/nudOutputSize will add/remove bytes to the actual buffer, matching the right size while directly updating the hbInput/hbOutput buffer byte view don't update back the nudInputSize/nudOutputSize value

Check Access Mask MAXIMUM_ALLOWED

MAXIMUM_ALLOWED (0x02000000)

Restore `Costura.Fody`

Embedding DLLs in a compiled executable

Add `repeat` functionality to the GUI

Requires a bit of refactoring on how we handle btnSend_Click function

Make access mask equal to generic_read|generic_write

Add `repeat` functonality o both GUI and CMD

Make buffer area to fixed 8 bytes length

Fix buffer size area based on size

Additional non-parsable characters are at the end of the line

See the end of this message for details on invoking 
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.FormatException: Additional non-parsable characters are at the end of the string.
   at System.ParseNumbers.StringToInt(String s, Int32 radix, Int32 flags, Int32* currPos)
   at System.Convert.ToUInt32(String value, Int32 fromBase)
   at ioctlpus.MainForm.btnSend_Click(Object sender, EventArgs e) in C:\Users\user\Documents\GitHub\ioctlpus\ioctlpus\MainForm.cs:line 181
   at System.Windows.Forms.Control.OnClick(EventArgs e)
   at System.Windows.Forms.Button.OnClick(EventArgs e)
   at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
   at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
   at System.Windows.Forms.Control.WndProc(Message& m)
   at System.Windows.Forms.ButtonBase.WndProc(Message& m)
   at System.Windows.Forms.Button.WndProc(Message& m)
   at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
   at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
   at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


************** Loaded Assemblies **************
mscorlib
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.3752.0 built by: NET48REL1
    CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll
----------------------------------------
IOCTLpus
    Assembly Version: 0.2.1.0
    Win32 Version: 0.2.1.0
    CodeBase: file:///C:/Users/Contoso/Desktop/Release/IOCTLpus.exe
----------------------------------------
CommandLine
    Assembly Version: 2.8.0.0
    Win32 Version: 2.8.0.0
    CodeBase: file:///C:/Users/Contoso/Desktop/Release/CommandLine.DLL
----------------------------------------
System.Core
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.3752.0 built by: NET48REL1
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll
----------------------------------------
System
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.3752.0 built by: NET48REL1
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Windows.Forms
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.3752.0 built by: NET48REL1
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.3752.0 built by: NET48REL1
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
Be.Windows.Forms.HexBox
    Assembly Version: 1.6.1.0
    Win32 Version: 1.6.1.0
    CodeBase: file:///C:/Users/Contoso/Desktop/Release/Be.Windows.Forms.HexBox.DLL
----------------------------------------
System.Configuration
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.3752.0 built by: NET48REL1
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
----------------------------------------
System.Xml
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.3752.0 built by: NET48REL1
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll
----------------------------------------
ObjectListView
    Assembly Version: 2.7.1.31255
    Win32 Version: 2.7.1.0
    CodeBase: file:///C:/Users/Contoso/Desktop/Release/ObjectListView.DLL
----------------------------------------

************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
    <system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.

voidsec / ioctlpus Goto Github PK