{ "added_at": "2026-11-02", "additional_evidence_urls": [ "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/CHANGELOG.md", "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/ida-plugin.json", "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/DriverBuddyReloaded/config.py", "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/DriverBuddyReloaded/ida_compat.py", "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/tests/test_dbr.py", "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/tests/run_cross_version.ps1", "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/tests/run_golden.ps1", "https://github.com/VoidSec/DriverBuddyReloaded/tree/72bf7c862de01f389fa38651d9adc0f1042cbcba/tests/drivers", "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/LICENSE", "https://github.com/VoidSec/DriverBuddyReloaded/commit/8a94d75179de6aafa348ec89b4efc66bfa3efce9", "https://github.com/VoidSec/DriverBuddyReloaded/blob/f983af7be5e00421881c6223b6638880a242f9ba/LICENSE", "https://github.com/VoidSec/DriverBuddyReloaded/releases/tag/2.5.1" ], "category": "native-analysis", "description_en": "IDA Pro Python plugin for triaging Windows kernel drivers, building on NCC Group's original DriverBuddy. Its auto-analysis identifies the driver model (WDM, KMDF, UMDF, WDF, Mini-Filter, Stream Minidriver, AVStream or PortCls), locates the device-control dispatch routines, labels IRP, IO_STACK_LOCATION and WDF structures and calls, and discovers and decodes IOCTL codes through Hex-Rays ctree, switch-table and immediate-operand scans. It also reports device names, symbolic links and device ACLs, pool tags, flagged APIs and opcodes, name-based call chains and heuristic vulnerability leads with per-IOCTL risk scores, in an IDA findings window, a JSON file and an HTML report.", "description_zh": "用于分诊 Windows 内核驱动的 IDA Pro Python 插件，在 NCC Group 最初的 DriverBuddy 基础上发展而来。其自动分析可识别驱动模型（WDM、KMDF、UMDF、WDF、Mini-Filter、Stream Minidriver、AVStream 或 PortCls），定位设备控制派遣例程，标注 IRP、IO_STACK_LOCATION 和 WDF 结构及调用，并通过 Hex-Rays ctree、switch 跳转表和立即数操作数三种扫描发现并解码 IOCTL 码。它还会报告设备名、符号链接与设备 ACL、池标记、被标记的 API 和指令、基于名称的调用链，以及带逐个 IOCTL 风险评分的启发式漏洞线索，结果显示在 IDA 结果窗口中，并写入 JSON 文件和 HTML 报告。", "entry_url": "https://awesomerea.org/resources/driver-buddy-reloaded/", "entry_url_zh": "https://awesomerea.org/zh/resources/driver-buddy-reloaded/", "evidence_url": "https://github.com/VoidSec/DriverBuddyReloaded/blob/72bf7c862de01f389fa38651d9adc0f1042cbcba/README.MD", "group": "tools", "id": "driver-buddy-reloaded", "json_url": "https://awesomerea.org/resources/driver-buddy-reloaded/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/driver-buddy-reloaded/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/driver-buddy-reloaded/index.md", "name": "Driver Buddy Reloaded", "name_zh": "Driver Buddy Reloaded Windows 内核驱动分析插件", "record_type": "resource", "relationship": "foundation", "requirements": [ "Latest release at review: 2.5.1, published 2026-07-08 as a zip; the reviewed main commit of 2026-10-19 is four commits later, adding an IOCTL-recovery fix for issue #41 with a new regression fixture, DriverEntry typing for the MajorFunction annotator and the licence change noted below. The README says it runs on IDA 7.6+, 8.x and 9.0+ with Python 3, with API differences handled by ida_compat.py, and ida-plugin.json lists Windows, Linux and macOS hosts. IDA 9.0+ installs it with hcli plugin install; 7.6 and 8.x need the script and its package folder copied to the top level of the plugins directory.", "Analysts load their own Windows kernel driver (.sys) in IDA. The Hex-Rays decompiler is optional but drives the strongest IOCTL scan, with switch-table and immediate-operand scans as fallbacks, and the experimental DispatchDeviceControl search works only for x64 drivers. Each run writes findings.json, report.html, pooltags.txt and an analysis log next to the IDB, and optional stages are toggled in config.py.", "tests/test_dbr.py is a pure-Python regression suite that needs no IDA; run_cross_version.ps1 runs the pipeline under IDA 7.6 SP1, 8.4 and Free 9.3, and run_golden.ps1 compares findings on reference drivers with committed golden JSON captured with the IDA 8.4 decompiler. The README reports that decompiler-based scanning raised IOCTL recovery from 7/28 to 28/28 on HEVD and from 4/17 to 17/17 on ALSysIO64 with no false positives. There is no CI, and these results are project-reported.", "tests/drivers bundles IDA databases (.i64) and golden findings for eight reference drivers as regression fixtures: ALSysIO64, HEVD, IObitUnlocker, MODAPI, WinRing0x64, amp, beep and zam64 .sys. Those drivers keep their own vendors' terms.", "LICENSE was replaced on 2026-07-10 with the PolyForm Noncommercial License 1.0.0, which permits only noncommercial purposes, while release 2.5.1 and earlier carry GPL-3.0 and ida-plugin.json still declares GPL-3.0. IDA Pro and Hex-Rays keep their own terms. The README calls its findings heuristic lead generators for manual review rather than confirmed vulnerabilities." ], "requirements_zh": [ "审阅时最新版本为 2.5.1，于 2026-07-08 以 zip 包发布；所审阅的 main 分支提交（2026-10-19）比它晚四个提交，加入了针对 issue #41 的 IOCTL 恢复修复及新的回归测试样例、为 MajorFunction 标注功能补全 DriverEntry 类型，以及下文提到的许可证变更。README 称插件可在使用 Python 3 的 IDA 7.6+、8.x 和 9.0+ 上运行，版本间的 API 差异由 ida_compat.py 处理；ida-plugin.json 列出 Windows、Linux 和 macOS 宿主。IDA 9.0+ 可通过 hcli plugin install 安装；7.6 和 8.x 需将脚本及其包目录复制到 plugins 目录的顶层。", "分析者在 IDA 中加载自备的 Windows 内核驱动（.sys）。Hex-Rays 反编译器为可选项，但最有效的 IOCTL 扫描依赖它，switch 跳转表和立即数操作数扫描作为后备；实验性的 DispatchDeviceControl 搜索仅适用于 x64 驱动。每次运行都会在 IDB 所在目录写入 findings.json、report.html、pooltags.txt 和分析日志，可选分析阶段在 config.py 中开关。", "tests/test_dbr.py 是无需 IDA 的纯 Python 回归测试；run_cross_version.ps1 在 IDA 7.6 SP1、8.4 和 Free 9.3 下运行完整流程，run_golden.ps1 则将参考驱动上的分析结果与用 IDA 8.4 反编译器生成并提交的基准 JSON 比较。README 称基于反编译器的扫描使 HEVD 的 IOCTL 恢复数从 7/28 提高到 28/28，ALSysIO64 从 4/17 提高到 17/17，且无误报。仓库没有 CI，上述结果均为项目自报。", "tests/drivers 附带八个参考驱动的 IDA 数据库（.i64）及基准结果，作为回归测试样例：ALSysIO64、HEVD、IObitUnlocker、MODAPI、WinRing0x64、amp、beep 和 zam64 .sys。这些驱动仍受其各自厂商条款约束。", "LICENSE 已于 2026-07-10 改为 PolyForm Noncommercial License 1.0.0，仅允许非商业用途；而 2.5.1 及更早版本采用 GPL-3.0，ida-plugin.json 也仍声明 GPL-3.0。IDA Pro 和 Hex-Rays 仍受各自条款约束。README 称其结果是供人工复核的启发式线索，而非已确认的漏洞。" ], "targets": [ "binary" ], "url": "https://github.com/VoidSec/DriverBuddyReloaded", "verification": "source-reviewed", "verified_at": "2026-10-20" }