AwesomeREA.org

Tool

Driver Buddy Reloaded

IDA Pro Python plugin for triaging Windows kernel drivers, building on NCC Group's original DriverBuddy. Its auto-analysis identifies the driver model (WDM, KMDF, UMDF, WDF, Mini-Filter, Stream Minidriver, AVStream or PortCls), locates the device-control dispatch routines, labels IRP, IO_STACK_LOCATION and WDF structures and calls, and discovers and decodes IOCTL codes through Hex-Rays ctree, switch-table and immediate-operand scans. It also reports device names, symbolic links and device ACLs, pool tags, flagged APIs and opcodes, name-based call chains and heuristic vulnerability leads with per-IOCTL risk scores, in an IDA findings window, a JSON file and an HTML report.

Requirements & limits

  • Latest release at review: 2.5.1, published 2026-07-08 as a zip; the reviewed main commit of 2026-10-19 is four commits later, adding an IOCTL-recovery fix for issue #41 with a new regression fixture, DriverEntry typing for the MajorFunction annotator and the licence change noted below. The README says it runs on IDA 7.6+, 8.x and 9.0+ with Python 3, with API differences handled by ida_compat.py, and ida-plugin.json lists Windows, Linux and macOS hosts. IDA 9.0+ installs it with hcli plugin install; 7.6 and 8.x need the script and its package folder copied to the top level of the plugins directory.
  • Analysts load their own Windows kernel driver (.sys) in IDA. The Hex-Rays decompiler is optional but drives the strongest IOCTL scan, with switch-table and immediate-operand scans as fallbacks, and the experimental DispatchDeviceControl search works only for x64 drivers. Each run writes findings.json, report.html, pooltags.txt and an analysis log next to the IDB, and optional stages are toggled in config.py.
  • tests/test_dbr.py is a pure-Python regression suite that needs no IDA; run_cross_version.ps1 runs the pipeline under IDA 7.6 SP1, 8.4 and Free 9.3, and run_golden.ps1 compares findings on reference drivers with committed golden JSON captured with the IDA 8.4 decompiler. The README reports that decompiler-based scanning raised IOCTL recovery from 7/28 to 28/28 on HEVD and from 4/17 to 17/17 on ALSysIO64 with no false positives. There is no CI, and these results are project-reported.
  • tests/drivers bundles IDA databases (.i64) and golden findings for eight reference drivers as regression fixtures: ALSysIO64, HEVD, IObitUnlocker, MODAPI, WinRing0x64, amp, beep and zam64 .sys. Those drivers keep their own vendors' terms.
  • LICENSE was replaced on 2026-07-10 with the PolyForm Noncommercial License 1.0.0, which permits only noncommercial purposes, while release 2.5.1 and earlier carry GPL-3.0 and ida-plugin.json still declares GPL-3.0. IDA Pro and Hex-Rays keep their own terms. The README calls its findings heuristic lead generators for manual review rather than confirmed vulnerabilities. Nothing was installed or run, and the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.MD GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  2. CHANGELOG.md GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  3. ida-plugin.json GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  4. DriverBuddyReloaded/config.py GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  5. DriverBuddyReloaded/ida_compat.py GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  6. tests/test_dbr.py GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  7. tests/run_cross_version.ps1 GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  8. tests/run_golden.ps1 GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  9. tests/drivers GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  10. LICENSE GitHub · VoidSec/DriverBuddyReloaded · Revision 72bf7c8
  11. https://github.com/VoidSec/DriverBuddyReloaded/commit/8a94d75179de6aafa348ec89b4efc66bfa3efce9
  12. LICENSE GitHub · VoidSec/DriverBuddyReloaded · Revision f983af7
  13. https://github.com/VoidSec/DriverBuddyReloaded/releases/tag/2.5.1

More in Native binaries

All 120 entries in Native binaries