k.mohit46

IOCTL-hammer is a lightweight fuzzing harness designed for efficient and targeted security auditing of Windows driver IOCTL interfaces. This tool addresses the high barrier to entry for kernel driver testing by providing a simple, accessible framework that focuses on the most common vulnerability patterns: buffer mismanagement. Rather than relying on complex, coverage-guided instrumentation, ioctl-hammer adopts a parameter-centric methodology, systematically manipulating the four core user-mode buffer descriptors sent via DeviceIoControl.

The fuzzer executes a structured, predefined suite of test cases designed to stress boundary conditions, null parameter handling, and size discrepancies. Despite its simplicity, this focused approach has proven highly effective in real-world testing against proprietary Windows drivers, successfully uncovering multiple zero-day vulnerabilities including a kernel-to-user heap overflow, Denial of Service vulnerabilities and Direct BSODs. IOCTL-hammer is designed for security engineers and researchers to quickly perform initial vulnerability assessments on IOCTLs, find low-hanging fruit, and validate findings without requiring extensive setup or kernel debugging expertise for initial discovery.

Insights from Audience

1. Our audience were mostly qurious on the ways to add custom structures(payloads) that the product would be accepting to the fuzzer for breaking the entry barriers and for further exploitation 
2. Audience found the tool very helpful for performing quick security audits for the software that runs on windows platform and uses IOCTLs for communication with the kernel.

https://blackhat.com/eu-25/arsenal/schedule/index.html?track[]=exploitation-and-ethical-hacking#ioctl-hammer---parameter-centric-ioctl-fuzzer-for-windows-drivers-48502