2

IOCTL Handlers

Kento Oki edited this page 2020-10-23 20:15:44 +09:00

Since around ioctl functions and its functionalities are packed, to reverse engineering is not easy than average.
but I can still easily find the function that registered at DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] since the IOCTL handler must have an IoCompleteRequest or like IofCompleteRequest that exported by ntoskrnl.
(Btw IoCompleteRequest is just a wrapper of IofCompleteRequest)

As mhyprot imports IofCompleteRequest then go xrefs, and we will see there are many ioctl handlers.
Concretely, I found two big subroutine in packed segment.

I've added it to this repo as binary since it's too big.

• sub_FFFFF800188CD000
  • -> Pseudocode
• sub_FFFFF800188CD6E0
  • -> Pseudocode

I will keep update if I found more another subroutine.