Skip to content

Commit 6a8d91d

Browse files
committed
Issue 1: Add Mount Manager IOCTL
1 parent 38a81ab commit 6a8d91d

File tree

1 file changed

+12
-5
lines changed

1 file changed

+12
-5
lines changed

plugins/WinIoCtlDecoder.py

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,9 @@ def winio_decode(ioctl_code):
115115
'FILE_DEVICE_BIOMETRIC', # 0x00000044
116116
'FILE_DEVICE_PMI', # 0x00000045
117117
]
118+
device_names2 = [
119+
{'name': 'MOUNTMGRCONTROLTYPE', 'code': 0x0000006d},
120+
]
118121

119122
device = (ioctl_code >> 16) & 0xffff
120123
access = (ioctl_code >> 14) & 3
@@ -123,6 +126,10 @@ def winio_decode(ioctl_code):
123126

124127
if device >= len(device_names):
125128
device_name = device_name_unknown
129+
for dev in device_names2:
130+
if device == dev['code']:
131+
device_name = dev['name']
132+
break
126133
else:
127134
device_name = device_names[device]
128135
print 'winio_decode(0x%08X)' % (ioctl_code)
@@ -136,11 +143,11 @@ def winio_decode(ioctl_code):
136143
class WinIoCtlPlugin(idaapi.plugin_t):
137144
"""Class for IDA Pro plugin."""
138145
flags = idaapi.PLUGIN_UNL
139-
comment = ("Decodes Windows Device I/O control code into " +
140-
"DeviceType, FunctionCode, AccessType and MethodType.")
141-
help = ""
142-
wanted_name = "Windows IOCTL code decoder"
143-
wanted_hotkey = "Ctrl-Alt-D"
146+
comment = ('Decodes Windows Device I/O control code into ' +
147+
'DeviceType, FunctionCode, AccessType and MethodType.')
148+
help = ''
149+
wanted_name = 'Windows IOCTL code decoder'
150+
wanted_hotkey = 'Ctrl-Alt-D'
144151

145152
def init(self):
146153
return idaapi.PLUGIN_OK

0 commit comments

Comments
 (0)