koutto / ioctlbf Goto Github PK

           cont = TRUE;
	if(SetConsoleCtrlHandler((PHANDLER_ROUTINE) CtrlHandler, TRUE)) {
		// Fill the buffer with data from FuzzConstants (1 DWORD after 1)
		memset(bufInput, 0x00, MAX_BUFSIZE);
		for(i=0; cont && i<posListIoctls->maxBufferLength; i=i+4) {
		
			printf("Fuzzing DWORD %d/%d\n", 
				   i/4+1, posListIoctls->maxBufferLength/4);
			
			// Fill the whole buffer with random data...
			for(j=0; cont && j<posListIoctls->maxBufferLength; j++) {
				bufInput[j] = (BYTE)getrand(0x00, 0xff);
			}
			
			// ...and put a DWORD from FuzzConstants at the i_th position
			for(j=0; cont && j<(sizeof(FuzzConstants)/4); j++) {
				fuzzData = FuzzConstants[j];
				
				/*
				printf("Fuzzing DWORD %d/%d with 0x%08x (%d/%d)\n", 
					   i/4+1, posListIoctls->maxBufferLength/4, 
					   fuzzData, j+1, sizeof(FuzzConstants)/4);
				*/
												
				// Choose a random element into FuzzConstants
				bufInput[i]   = fuzzData & 0x000000ff;
				bufInput[i+1] = (fuzzData & 0x0000ff00) >> 8;
				bufInput[i+2] = (fuzzData & 0x00ff0000) >> 16;
				bufInput[i+3] = (fuzzData & 0xff000000) >> 24;
				
				if(!quietflg) {
					Hexdump(bufInput, posListIoctls->maxBufferLength);
					printf("Fuzzing DWORD %d/%d with 0x%08x (%d/%d)\n", 
					       i/4+1, posListIoctls->maxBufferLength/4, 
					       fuzzData, j+1, sizeof(FuzzConstants)/4);
					printf("Input buffer: %d (0x%x) bytes \n", 
					                     posListIoctls->maxBufferLength,
						                 posListIoctls->maxBufferLength);
				}
				
				status = DeviceIoControl(deviceHandle, 
										 posListIoctls->IOCTL, 
										 &bufInput, 
										 posListIoctls->maxBufferLength,
										 &bufOutput, 
										 posListIoctls->maxBufferLength, 
										 &nbBytes, 
										 NULL);
										 
				if(!quietflg) {
					if(status == 0)
						printf("Error %d: %s\n\n", GetLastError(), 
						                 errorCode2String(GetLastError()));
					printf("-------------------------------------------------------------------\n\n");
				}
				
				Sleep(SLEEP_TIME);
			}
		}
		
		printf("Filling the whole buffer with predetermined DWORDs\n");
		while(cont) {
			// Choose a random length for the buffer
			randomLength = getrand(posListIoctls->minBufferLength, 
			                       posListIoctls->maxBufferLength);
			
			// Fill the whole buffer with data from FuzzConstants
			memset(bufInput, 0x00, MAX_BUFSIZE);
			for(i=0; i<randomLength; i=i+4) {
				fuzzData = FuzzConstants[getrand(0, (sizeof(FuzzConstants)/4)-1)];
													
				// Choose a random element into FuzzConstants
				bufInput[i]   = fuzzData & 0x000000ff;
				bufInput[i+1] = (fuzzData & 0x0000ff00) >> 8;
				bufInput[i+2] = (fuzzData & 0x00ff0000) >> 16;
				bufInput[i+3] = (fuzzData & 0xff000000) >> 24;
			}
			
			if(!quietflg) {
				Hexdump(bufInput, randomLength);
				printf("Filling the whole buffer with predetermined DWORDs\n");
				printf("Input buffer: %d (0x%x) bytes \n", randomLength,
														   randomLength);
			}

			status = DeviceIoControl(deviceHandle, 
									 posListIoctls->IOCTL, 
									 &bufInput, 
									 randomLength,
									 &bufOutput, 
									 randomLength, 
									 &nbBytes, 
									 NULL);
									 
			if(!quietflg) {
				if(status == 0)
					printf("Error %d: %s\n\n", GetLastError(), errorCode2String(GetLastError()));
				printf("-------------------------------------------------------------------\n\n");
			}
									 
			Sleep(SLEEP_TIME);	
		}