├── screenshots ├── bruteforce_example.PNG └── translate_example.PNG ├── DriverEnumerate ├── stdafx.cpp ├── targetver.h ├── stdafx.h ├── DriverEnumerate.vcxproj.filters ├── ReadMe.txt ├── DriverEnumerate.h ├── DriverEnumerate.vcxproj └── DriverEnumerate.cpp ├── .gitignore ├── code_bruteforcer.py ├── README.md ├── basic_fuzzer.py ├── translate.py └── LICENSE /screenshots/bruteforce_example.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sam-b/win-driver-tools/HEAD/screenshots/bruteforce_example.PNG -------------------------------------------------------------------------------- /screenshots/translate_example.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sam-b/win-driver-tools/HEAD/screenshots/translate_example.PNG -------------------------------------------------------------------------------- /DriverEnumerate/stdafx.cpp: -------------------------------------------------------------------------------- 1 | // stdafx.cpp : source file that includes just the standard includes 2 | // DriverEnumerate.pch will be the pre-compiled header 3 | // stdafx.obj will contain the pre-compiled type information 4 | 5 | #include "stdafx.h" 6 | 7 | // TODO: reference any additional headers you need in STDAFX.H 8 | // and not in this file 9 | -------------------------------------------------------------------------------- /DriverEnumerate/targetver.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | // Including SDKDDKVer.h defines the highest available Windows platform. 4 | 5 | // If you wish to build your application for a previous Windows platform, include WinSDKVer.h and 6 | // set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. 7 | 8 | #include 9 | -------------------------------------------------------------------------------- /DriverEnumerate/stdafx.h: -------------------------------------------------------------------------------- 1 | // stdafx.h : include file for standard system include files, 2 | // or project specific include files that are used frequently, but 3 | // are changed infrequently 4 | // 5 | 6 | #pragma once 7 | 8 | #include "targetver.h" 9 | 10 | #include 11 | #include 12 | 13 | 14 | 15 | // TODO: reference additional headers your program requires here 16 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Byte-compiled / optimized / DLL files 2 | __pycache__/ 3 | *.py[cod] 4 | 5 | # C extensions 6 | *.so 7 | 8 | # Distribution / packaging 9 | .Python 10 | env/ 11 | build/ 12 | develop-eggs/ 13 | dist/ 14 | downloads/ 15 | eggs/ 16 | .eggs/ 17 | lib/ 18 | lib64/ 19 | parts/ 20 | sdist/ 21 | var/ 22 | *.egg-info/ 23 | .installed.cfg 24 | *.egg 25 | 26 | # PyInstaller 27 | # Usually these files are written by a python script from a template 28 | # before PyInstaller builds the exe, so as to inject date/other infos into it. 29 | *.manifest 30 | *.spec 31 | 32 | # Installer logs 33 | pip-log.txt 34 | pip-delete-this-directory.txt 35 | 36 | # Unit test / coverage reports 37 | htmlcov/ 38 | .tox/ 39 | .coverage 40 | .coverage.* 41 | .cache 42 | nosetests.xml 43 | coverage.xml 44 | *,cover 45 | 46 | # Translations 47 | *.mo 48 | *.pot 49 | 50 | # Django stuff: 51 | *.log 52 | 53 | # Sphinx documentation 54 | docs/_build/ 55 | 56 | # PyBuilder 57 | target/ 58 | -------------------------------------------------------------------------------- /code_bruteforcer.py: -------------------------------------------------------------------------------- 1 | """ 2 | Bruteforces valid ioctl codes and provides definitions for them when setup with valid config to send them to a driver. 3 | """ 4 | 5 | import sys 6 | import time 7 | try: 8 | import win32file 9 | except: 10 | print "win32file library needed :(" 11 | sys.exit(1) 12 | from translate import c_define_from_ioctl 13 | from translate import ctl_code 14 | max_device_code = 57 15 | max_access_code = 3 16 | max_method_code = 3 17 | max_function_code = 0x1000 18 | 19 | if __name__ == "__main__": 20 | hDevice = win32file.CreateFile('\\\\.\\HackSysExtremeVulnerableDriver', win32file.GENERIC_READ | win32file.GENERIC_WRITE, win32file.FILE_SHARE_READ | win32file.FILE_SHARE_WRITE ,None, win32file.OPEN_EXISTING, win32file.FILE_ATTRIBUTE_NORMAL | win32file.FILE_FLAG_OVERLAPPED, 0) 21 | for d in range(1,max_device_code + 1): 22 | for f in range(0,max_function_code + 1): 23 | for m in range(0,max_method_code + 1): 24 | for a in range(0,max_access_code + 1): 25 | ioctl = ctl_code(d,f,m,a) 26 | try: 27 | data = win32file.DeviceIoControl( 28 | hDevice, 29 | ioctl, 30 | '', 31 | 0, 32 | None 33 | ) 34 | print "Found ioctl: " + hex(ioctl) + " , C define:" 35 | print c_define_from_ioctl(ioctl) 36 | except Exception as e: 37 | if e[0] == 998: 38 | print "Found ioctl triggered invalid memory access: " + hex(ioctl) + " , C define:" 39 | print c_define_from_ioctl(ioctl) 40 | pass -------------------------------------------------------------------------------- /DriverEnumerate/DriverEnumerate.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | Header Files 23 | 24 | 25 | Header Files 26 | 27 | 28 | Header Files 29 | 30 | 31 | 32 | 33 | Source Files 34 | 35 | 36 | Source Files 37 | 38 | 39 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ioctl-tools 2 | A couple of little tools I've made for working with Windows Drivers 3 | 4 | ## translate.py 5 | Translate an ioctl code in hex to its equivalent c define: 6 | python translate.py (c | code) hex_code 7 | Example: 8 | >python translate.py c 0x22e00b 9 | DeviceCode = FILE_DEVICE_UNKNOWN 10 | Device Source = VENDOR 11 | FunctionCode = 0x802 12 | MethodCode = METHOD_NEITHER 13 | AccessCode = FILE_READ_DATA | FILE_WRITE_DATA 14 | C Define: 15 | #define NAME CTL_CODE(FILE_DEVICE_UNKNOWN,0x802,METHOD_NEITHER,FILE_READ_DATA | FILE_WRITE_DATA) 16 | Translate the definition dword values in hex to a hex ioctl code: 17 | python translate.py (d | dwords) DeviceCode FunctionCode MethodCode AccessCode 18 | Example: 19 | >python translate.py d 0x22 0x802 0x3 0x3 20 | 0x22e00b 21 | Translate the Macro C constants inputs to an ioctl code: 22 | python translate.py (s | string) DeviceCode FunctionCode MethodCode AccessCode 23 | Example: 24 | >python translate.py s FILE_DEVICE_UNKNOWN 0x802 METHOD_NEITHER "FILE_READ_DATA | FILE_WRITE_DATA" 25 | Outputs: 0x22e00b 26 | ![translate screenshot](screenshots/translate_example.PNG) 27 | ## code_bruteforcer.py 28 | Bruteforces valid ioctl codes and provides definitions for them when setup with valid config to send them to a driver. 29 | Correct settings will need to be added as arguments to the CreateFile call. 30 | ![bruteforce screenshot](screenshots/bruteforce_example.PNG) 31 | ## basic_fuzzer.py 32 | Fuzzes a given IOCTL for a given device path by sending random input and output buffers, half the time the sizes passed with buffers will be valid and half the time not. 33 | Usage: python basic_fuzzer.py DRIVER_PATH_INCLUDING_ESCAPES IOCTL_CODE_IN_HEX 34 | Logs all sent DeviceIOControls to fuzz.log -------------------------------------------------------------------------------- /DriverEnumerate/ReadMe.txt: -------------------------------------------------------------------------------- 1 | ======================================================================== 2 | CONSOLE APPLICATION : DriverEnumerate Project Overview 3 | ======================================================================== 4 | 5 | AppWizard has created this DriverEnumerate application for you. 6 | 7 | This file contains a summary of what you will find in each of the files that 8 | make up your DriverEnumerate application. 9 | 10 | 11 | DriverEnumerate.vcxproj 12 | This is the main project file for VC++ projects generated using an Application Wizard. 13 | It contains information about the version of Visual C++ that generated the file, and 14 | information about the platforms, configurations, and project features selected with the 15 | Application Wizard. 16 | 17 | DriverEnumerate.vcxproj.filters 18 | This is the filters file for VC++ projects generated using an Application Wizard. 19 | It contains information about the association between the files in your project 20 | and the filters. This association is used in the IDE to show grouping of files with 21 | similar extensions under a specific node (for e.g. ".cpp" files are associated with the 22 | "Source Files" filter). 23 | 24 | DriverEnumerate.cpp 25 | This is the main application source file. 26 | 27 | ///////////////////////////////////////////////////////////////////////////// 28 | Other standard files: 29 | 30 | StdAfx.h, StdAfx.cpp 31 | These files are used to build a precompiled header (PCH) file 32 | named DriverEnumerate.pch and a precompiled types file named StdAfx.obj. 33 | 34 | ///////////////////////////////////////////////////////////////////////////// 35 | Other notes: 36 | 37 | AppWizard uses "TODO:" comments to indicate parts of the source code you 38 | should add to or customize. 39 | 40 | ///////////////////////////////////////////////////////////////////////////// 41 | -------------------------------------------------------------------------------- /basic_fuzzer.py: -------------------------------------------------------------------------------- 1 | """ 2 | Super basic fuzzer for a single IOCTL at a time. 3 | """ 4 | 5 | import sys 6 | import time 7 | import random 8 | from ctypes import * 9 | kernel32 = windll.kernel32 10 | 11 | GENERIC_READ = 0x80000000 12 | GENERIC_WRITE = 0x40000000 13 | OPEN_EXISTING = 0x3 14 | FILE_SHARE_READ = 0x1 15 | FILE_SHARE_WRITE =0x2 16 | FILE_ATTRIBUTE_NORMAL = 0x00000080 17 | FILE_FLAG_OVERLAPPED = 0x40000000 18 | 19 | if __name__ == "__main__": 20 | if len(sys.argv) < 3: 21 | print "Usage: python basic_fuzzer.py DRIVER_PATH_INCLUDING_ESCAPES IOCTL_CODE_IN_HEX" 22 | ioctl = int(sys.argv[2],16) 23 | while True: 24 | try: 25 | with open('fuzz.log','a+') as log: 26 | hDevice = kernel32.CreateFileW(sys.argv[1].decode("mbcs"), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE ,None, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, None) 27 | if hDevice == -1: 28 | print "Could not open device" 29 | sys.exit(1) 30 | in_size = random.randint(0,2 ** 10) 31 | if random.random() < 0.5: 32 | in_buff = ''.join(chr(random.randint(0,255)) for _ in range(in_size)) 33 | else: 34 | in_buff = ''.join(chr(random.randint(0,255)) for _ in range(random.randint(0,2 ** 16))) 35 | log.write("in_buff = " + in_buff) 36 | out_size = random.randint(0,2 ** 10) 37 | if random.random() < 0.5: 38 | out_buff = ''.join(chr(random.randint(0,255)) for _ in range(out_size)) 39 | else: 40 | out_buff = ''.join(chr(random.randint(0,255)) for _ in range(random.randint(0,2 ** 16))) 41 | log.write("out_buff = " + out_buff) 42 | out_length = c_ulong(out_size) 43 | log.write("kernel32.DeviceIoControl(hDevice," + str(ioctl) + ",in_buff," + str(in_size) + ",out_buff," + str(out_size) + "," + str(out_length) + ", None)") 44 | print "Executing kernel32.DeviceIoControl(hDevice," + str(ioctl) + ",in_buff," + str(in_size) + ",out_buff," + str(out_size) + "," + str(out_length) + ", None)" 45 | data = kernel32.DeviceIoControl( 46 | hDevice, 47 | ioctl, 48 | cast(in_buff, c_char_p), 49 | in_size, 50 | byref(cast(out_buff, c_char_p)), 51 | out_size, 52 | byref(out_length), 53 | None 54 | ) 55 | except Exception as e: 56 | print e -------------------------------------------------------------------------------- /DriverEnumerate/DriverEnumerate.h: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | void ListDrivers(void); 4 | void ExamineDriver(TCHAR* name); 5 | void BruteforceCodes(TCHAR *name); 6 | void ConvertCode(unsigned int code); 7 | 8 | #define MAX_FUNCTION_CODE 0x1000 9 | #define ARRAY_SIZE 1024 10 | #define DEVICE_TYPE_COUNT 57 11 | TCHAR* device_types[DEVICE_TYPE_COUNT] = { 12 | _T("FILE_DEVICE_BEEP"), 13 | _T("FILE_DEVICE_CD_ROM"), 14 | _T("FILE_DEVICE_CD_ROM_FILE_SYSTEM"), 15 | _T("FILE_DEVICE_CONTROLLER"), 16 | _T("FILE_DEVICE_DATALINK"), 17 | _T("FILE_DEVICE_DFS"), 18 | _T("FILE_DEVICE_DISK"), 19 | _T("FILE_DEVICE_DISK_FILE_SYSTEM"), 20 | _T("FILE_DEVICE_FILE_SYSTEM"), 21 | _T("FILE_DEVICE_INPORT_PORT"), 22 | _T("FILE_DEVICE_KEYBOARD"), 23 | _T("FILE_DEVICE_MAILSLOT"), 24 | _T("FILE_DEVICE_MIDI_IN"), 25 | _T("FILE_DEVICE_MIDI_OUT"), 26 | _T("FILE_DEVICE_MOUSE"), 27 | _T("FILE_DEVICE_MULTI_UNC_PROVIDER"), 28 | _T("FILE_DEVICE_NAMED_PIPE"), 29 | _T("FILE_DEVICE_NETWORK"), 30 | _T("FILE_DEVICE_NETWORK_BROWSER"), 31 | _T("FILE_DEVICE_NETWORK_FILE_SYSTEM"), 32 | _T("FILE_DEVICE_NULL"), 33 | _T("FILE_DEVICE_PARALLEL_PORT"), 34 | _T("FILE_DEVICE_PHYSICAL_NETCARD"), 35 | _T("FILE_DEVICE_PRINTER"), 36 | _T("FILE_DEVICE_SCANNER"), 37 | _T("FILE_DEVICE_SERIAL_MOUSE_PORT"), 38 | _T("FILE_DEVICE_SERIAL_PORT"), 39 | _T("FILE_DEVICE_SCREEN"), 40 | _T("FILE_DEVICE_SOUND"), 41 | _T("FILE_DEVICE_STREAMS"), 42 | _T("FILE_DEVICE_TAPE"), 43 | _T("FILE_DEVICE_TAPE_FILE_SYSTEM"), 44 | _T("FILE_DEVICE_TRANSPORT"), 45 | _T("FILE_DEVICE_UNKNOWN"), 46 | _T("FILE_DEVICE_VIDEO"), 47 | _T("FILE_DEVICE_VIRTUAL_DISK"), 48 | _T("FILE_DEVICE_WAVE_IN"), 49 | _T("FILE_DEVICE_WAVE_OUT"), 50 | _T("FILE_DEVICE_8042_PORT"), 51 | _T("FILE_DEVICE_NETWORK_REDIRECTOR"), 52 | _T("FILE_DEVICE_BATTERY"), 53 | _T("FILE_DEVICE_BUS_EXTENDER"), 54 | _T("FILE_DEVICE_MODEM"), 55 | _T("FILE_DEVICE_VDM"), 56 | _T("FILE_DEVICE_MASS_STORAGE"), 57 | _T("FILE_DEVICE_SMB"), 58 | _T("FILE_DEVICE_KS"), 59 | _T("FILE_DEVICE_CHANGER"), 60 | _T("FILE_DEVICE_SMARTCARD"), 61 | _T("FILE_DEVICE_ACPI"), 62 | _T("FILE_DEVICE_DVD"), 63 | _T("FILE_DEVICE_FULLSCREEN_VIDEO"), 64 | _T("FILE_DEVICE_DFS_FILE_SYSTEM"), 65 | _T("FILE_DEVICE_DFS_VOLUME"), 66 | _T("FILE_DEVICE_SERENUM"), 67 | _T("FILE_DEVICE_TERMSRV"), 68 | _T("FILE_DEVICE_KSEC") 69 | }; 70 | #define METHOD_COUNT 4 71 | TCHAR * methods[METHOD_COUNT] = { 72 | _T("METHOD_BUFFERED"), 73 | _T("METHOD_IN_DIRECT"), 74 | _T("METHOD_OUT_DIRECT"), 75 | _T("METHOD_NEITHER") 76 | }; 77 | #define ACCESS_COUNT 4 78 | TCHAR * access[ACCESS_COUNT] = { 79 | _T("FILE_ANY_ACCESS"), 80 | _T("FILE_READ_DATA"), 81 | _T("FILE_WRITE_DATA"), 82 | _T("FILE_READ_DATA | FILE_WRITE_DATA") 83 | }; -------------------------------------------------------------------------------- /DriverEnumerate/DriverEnumerate.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | 14 | {CFB34610-C7A3-42AD-B698-F91043CF1111} 15 | Win32Proj 16 | DriverEnumerate 17 | 18 | 19 | 20 | Application 21 | true 22 | v120 23 | Unicode 24 | 25 | 26 | Application 27 | false 28 | v120 29 | true 30 | Unicode 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | true 44 | 45 | 46 | false 47 | 48 | 49 | 50 | Use 51 | Level3 52 | Disabled 53 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 54 | true 55 | 56 | 57 | Console 58 | true 59 | 60 | 61 | 62 | 63 | Level3 64 | Use 65 | MaxSpeed 66 | true 67 | true 68 | WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 69 | true 70 | 71 | 72 | Console 73 | true 74 | true 75 | true 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | Create 90 | Create 91 | 92 | 93 | 94 | 95 | 96 | -------------------------------------------------------------------------------- /translate.py: -------------------------------------------------------------------------------- 1 | import sys 2 | 3 | help = """ 4 | python translate.py $mode 5 | Translate an ioctl code in hex to its equivalent c define: 6 | python translate.py (c | code) hex_code 7 | Example: 8 | >python translate.py c 0x22e00b 9 | DeviceCode = FILE_DEVICE_UNKNOWN 10 | Device Source = VENDOR 11 | FunctionCode = 0x802 12 | MethodCode = METHOD_NEITHER 13 | AccessCode = FILE_READ_DATA | FILE_WRITE_DATA 14 | C Define: 15 | #define NAME CTL_CODE(FILE_DEVICE_UNKNOWN,0x802,METHOD_NEITHER,FILE_READ_DATA | FILE_WRITE_DATA) 16 | Translate the definition dword values in hex to a hex ioctl code: 17 | python translate.py (d | dwords) DeviceCode FunctionCode MethodCode AccessCode 18 | Example: 19 | >python translate.py d 0x22 0x802 0x3 0x3 20 | 0x22e00b 21 | Translate the Macro C constants inputs to an ioctl code: 22 | python translate.py (s | string) DeviceCode FunctionCode MethodCode AccessCode 23 | Example: 24 | >python translate.py s FILE_DEVICE_UNKNOWN 0x802 METHOD_NEITHER "FILE_READ_DATA | FILE_WRITE_DATA" 25 | Outputs: 0x22e00b 26 | """ 27 | 28 | device_types = [ 29 | 'FILE_DEVICE_BEEP', 30 | 'FILE_DEVICE_CD_ROM', 31 | 'FILE_DEVICE_CD_ROM_FILE_SYSTEM', 32 | 'FILE_DEVICE_CONTROLLER', 33 | 'FILE_DEVICE_DATALINK', 34 | 'FILE_DEVICE_DFS', 35 | 'FILE_DEVICE_DISK', 36 | 'FILE_DEVICE_DISK_FILE_SYSTEM', 37 | 'FILE_DEVICE_FILE_SYSTEM', 38 | 'FILE_DEVICE_INPORT_PORT', 39 | 'FILE_DEVICE_KEYBOARD', 40 | 'FILE_DEVICE_MAILSLOT', 41 | 'FILE_DEVICE_MIDI_IN', 42 | 'FILE_DEVICE_MIDI_OUT', 43 | 'FILE_DEVICE_MOUSE', 44 | 'FILE_DEVICE_MULTI_UNC_PROVIDER', 45 | 'FILE_DEVICE_NAMED_PIPE', 46 | 'FILE_DEVICE_NETWORK', 47 | 'FILE_DEVICE_NETWORK_BROWSER', 48 | 'FILE_DEVICE_NETWORK_FILE_SYSTEM', 49 | 'FILE_DEVICE_NULL', 50 | 'FILE_DEVICE_PARALLEL_PORT', 51 | 'FILE_DEVICE_PHYSICAL_NETCARD', 52 | 'FILE_DEVICE_PRINTER', 53 | 'FILE_DEVICE_SCANNER', 54 | 'FILE_DEVICE_SERIAL_MOUSE_PORT', 55 | 'FILE_DEVICE_SERIAL_PORT', 56 | 'FILE_DEVICE_SCREEN', 57 | 'FILE_DEVICE_SOUND', 58 | 'FILE_DEVICE_STREAMS', 59 | 'FILE_DEVICE_TAPE', 60 | 'FILE_DEVICE_TAPE_FILE_SYSTEM', 61 | 'FILE_DEVICE_TRANSPORT', 62 | 'FILE_DEVICE_UNKNOWN', 63 | 'FILE_DEVICE_VIDEO', 64 | 'FILE_DEVICE_VIRTUAL_DISK', 65 | 'FILE_DEVICE_WAVE_IN', 66 | 'FILE_DEVICE_WAVE_OUT', 67 | 'FILE_DEVICE_8042_PORT', 68 | 'FILE_DEVICE_NETWORK_REDIRECTOR', 69 | 'FILE_DEVICE_BATTERY', 70 | 'FILE_DEVICE_BUS_EXTENDER', 71 | 'FILE_DEVICE_MODEM', 72 | 'FILE_DEVICE_VDM', 73 | 'FILE_DEVICE_MASS_STORAGE', 74 | 'FILE_DEVICE_SMB', 75 | 'FILE_DEVICE_KS', 76 | 'FILE_DEVICE_CHANGER', 77 | 'FILE_DEVICE_SMARTCARD', 78 | 'FILE_DEVICE_ACPI', 79 | 'FILE_DEVICE_DVD', 80 | 'FILE_DEVICE_FULLSCREEN_VIDEO', 81 | 'FILE_DEVICE_DFS_FILE_SYSTEM', 82 | 'FILE_DEVICE_DFS_VOLUME', 83 | 'FILE_DEVICE_SERENUM', 84 | 'FILE_DEVICE_TERMSRV', 85 | 'FILE_DEVICE_KSEC' 86 | ] 87 | methods = [ 88 | 'METHOD_BUFFERED', 89 | 'METHOD_IN_DIRECT', 90 | 'METHOD_OUT_DIRECT', 91 | 'METHOD_NEITHER' 92 | ] 93 | access = [ 94 | 'FILE_ANY_ACCESS', 95 | 'FILE_READ_DATA', 96 | 'FILE_WRITE_DATA', 97 | 'FILE_READ_DATA | FILE_WRITE_DATA' 98 | ] 99 | 100 | #CTL_CODE(t,f,m,a) (((t)<<16)|((a)<<14)|((f)<<2)|(m)) 101 | def ctl_code(device_type, function, method, access): 102 | return (device_type << 16) | (access << 14) | function << 2 | method 103 | 104 | def device_source(ioctl): 105 | if ((ioctl & 0x3FFC) >> 2) < 0x800: 106 | return "MS" 107 | return "VENDOR" 108 | 109 | def device_from_ioctl(ioctl): 110 | try: 111 | return device_types[((ioctl & 0xffff0000) >> 16) - 1] 112 | except: 113 | return "Unknown DeviceType" 114 | 115 | def method_from_ioctl(ioctl): 116 | try: 117 | return methods[(ioctl & 3)] 118 | except: 119 | return "Invalid MethodType" 120 | 121 | def access_from_ioctl(ioctl): 122 | try: 123 | return access[((ioctl & 0xC000) >> 14)] 124 | except: 125 | return "Invalid AccessType" 126 | 127 | def function_from_ioctl(ioctl): 128 | return hex(((ioctl & 0x3FFC) >> 2)) 129 | 130 | def c_define_from_ioctl(ioctl): 131 | method = method_from_ioctl(ioctl) 132 | device = device_from_ioctl(ioctl) 133 | access = access_from_ioctl(ioctl) 134 | function = function_from_ioctl(ioctl) 135 | return "#define NAME CTL_CODE(" + device + "," + function + "," + method + "," + access + ")" 136 | 137 | if __name__ == "__main__": 138 | if len(sys.argv) < 2: 139 | print help 140 | sys.exit(1) 141 | mode = sys.argv[1] 142 | if mode == "c" or mode == "code": 143 | if len(sys.argv) < 3: 144 | print help 145 | sys.exit(1) 146 | ioctl = int(sys.argv[2],16) 147 | method = method_from_ioctl(ioctl) 148 | device = device_from_ioctl(ioctl) 149 | access = access_from_ioctl(ioctl) 150 | function = function_from_ioctl(ioctl) 151 | print "DeviceCode = ", device 152 | print "Device Source = ", device_source(ioctl) 153 | print "FunctionCode = ", function 154 | print "MethodCode = ", method 155 | print "AccessCode = ", access 156 | print "C Define:" 157 | print "#define NAME CTL_CODE(" + device + "," + function + "," + method + "," + access + ")" 158 | elif mode == "d" or mode == "dwords": 159 | if len(sys.argv) < 6: 160 | print help 161 | sys.exit(1) 162 | print hex(ctl_code(int(sys.argv[2],16),int(sys.argv[3],16),int(sys.argv[4],16),int(sys.argv[5],16))) 163 | elif mode == "s" or mode == "strings": 164 | if len(sys.argv) < 6: 165 | print help 166 | sys.exit(1) 167 | device_code = device_types.index(sys.argv[2]) + 1 168 | method_code = methods.index(sys.argv[4]) 169 | access_code = access.index(sys.argv[5]) 170 | print hex(ctl_code(device_code,int(sys.argv[3],16),method_code, access_code)) 171 | else: 172 | print help -------------------------------------------------------------------------------- /DriverEnumerate/DriverEnumerate.cpp: -------------------------------------------------------------------------------- 1 | #include "stdafx.h" 2 | 3 | #include 4 | #include 5 | #include 6 | #include "DriverEnumerate.h" 7 | // To ensure correct resolution of symbols, add Psapi.lib to TARGETLIBS 8 | // and compile with -DPSAPI_VERSION=1 9 | 10 | int _tmain(int argc, _TCHAR* argv[]) 11 | { 12 | 13 | if (argc < 2){ 14 | _tprintf(TEXT("Usage: ./DriverEnumerate.exe\n")); 15 | _tprintf(TEXT("\t-l = list drivers\n")); 16 | _tprintf(TEXT("\t-e $driver_name = examine driver details.\n")); 17 | _tprintf(TEXT("\t-c $code = convert IOCTL code to definition.\n")); 18 | _tprintf(TEXT("\t-b $driver_name = bruteforce IOCTLS for a driver.\n")); 19 | return 1; 20 | } 21 | 22 | TCHAR* command = argv[1]; 23 | if (_tcscmp(command,TEXT("-l")) == 0){ 24 | printf("Listing drivers.\n"); 25 | ListDrivers(); 26 | } else if (_tcscmp(command, TEXT("-e")) == 0) { 27 | if (argc < 3) { 28 | printf("Must specify a valid driver name to examine.\n"); 29 | } 30 | printf("Examining driver %s\n", argv[2]); 31 | ExamineDriver(argv[2]); 32 | } else if (_tcscmp(command, TEXT("-b")) == 0) { 33 | if (argc < 3){ 34 | printf("Must specify a valid driver name to examine.\n"); 35 | } 36 | printf("Examining driver %s\n", argv[2]); 37 | BruteforceCodes(argv[2]); 38 | } else if (_tcscmp(command, TEXT("-c")) == 0) { 39 | if (argc < 3){ 40 | printf("Must specify a valid driver name to examine.\n"); 41 | } 42 | _tprintf(TEXT("Converting: %s\n"), argv[2]); 43 | long code_int = _tcstol(argv[2], NULL, 16); 44 | ConvertCode(code_int); 45 | } else { 46 | printf("Invalid command.\n"); 47 | return 1; 48 | } 49 | 50 | return 0; 51 | } 52 | 53 | void ListDrivers(void){ 54 | LPVOID drivers[ARRAY_SIZE]; 55 | DWORD cbNeeded; 56 | int cDrivers, i; 57 | 58 | if (EnumDeviceDrivers(drivers, sizeof(drivers), &cbNeeded) && cbNeeded < sizeof(drivers)) 59 | { 60 | TCHAR szDriver[ARRAY_SIZE]; 61 | 62 | cDrivers = cbNeeded / sizeof(drivers[0]); 63 | 64 | _tprintf(TEXT("There are %d drivers:\n"), cDrivers); 65 | for (i = 0; i < cDrivers; i++) 66 | { 67 | if (GetDeviceDriverBaseName(drivers[i], szDriver, sizeof(szDriver) / sizeof(szDriver[0]))) 68 | { 69 | _tprintf(TEXT("%d: %s\n"), i, szDriver); 70 | } 71 | } 72 | } 73 | else 74 | { 75 | _tprintf(TEXT("EnumDeviceDrivers failed; array size needed is %d\n"), cbNeeded / sizeof(LPVOID)); 76 | } 77 | } 78 | 79 | void GetDriverPath(TCHAR *driverName, TCHAR* path){ 80 | LPVOID drivers[ARRAY_SIZE]; 81 | DWORD cbNeeded; 82 | int cDrivers, i; 83 | 84 | if (EnumDeviceDrivers(drivers, sizeof(drivers), &cbNeeded) && cbNeeded < sizeof(drivers)) 85 | { 86 | TCHAR szDriver[ARRAY_SIZE]; 87 | 88 | cDrivers = cbNeeded / sizeof(drivers[0]); 89 | 90 | for (i = 0; i < cDrivers; i++) 91 | { 92 | if (GetDeviceDriverBaseName(drivers[i], szDriver, sizeof(szDriver) / sizeof(szDriver[0]))) 93 | { 94 | if (_tcscmp(szDriver, driverName) == 0){ 95 | break; 96 | } 97 | } 98 | } 99 | TCHAR driverPath[ARRAY_SIZE]; 100 | if (GetDeviceDriverFileName(drivers[i], driverPath, sizeof(driverPath) / sizeof(driverPath[0]))){ 101 | _tcscpy_s(path, ARRAY_SIZE, driverPath); 102 | } 103 | } 104 | else 105 | { 106 | _tprintf(TEXT("EnumDeviceDrivers failed; array size needed is %d\n"), cbNeeded / sizeof(LPVOID)); 107 | } 108 | } 109 | 110 | void ExamineDriver(TCHAR *name){ 111 | TCHAR path[ARRAY_SIZE]; 112 | GetDriverPath(name,path); 113 | _tprintf(TEXT("Driver path is %s.\n"), path); 114 | } 115 | 116 | TCHAR * MethodFromIOCTL(unsigned int code){ 117 | unsigned int index = code & 3; 118 | if (index >= METHOD_COUNT){ 119 | _tprintf(_T("Invalid code - cannot calculate method.")); 120 | } 121 | return methods[index]; 122 | } 123 | 124 | TCHAR * AccessFromIOCTL(unsigned int code){ 125 | unsigned int index = ((code & 0xC000) >> 14); 126 | if (index >= ACCESS_COUNT){ 127 | _tprintf(_T("Invalid code - cannot calculate access.")); 128 | } 129 | return access[index]; 130 | } 131 | 132 | TCHAR * DeviceFromIOCTL(unsigned int code){ 133 | unsigned int index = ((code & 0xffff0000) >> 16) - 1; 134 | if (index >= DEVICE_TYPE_COUNT){ 135 | _tprintf(_T("Invalid code - cannot calculate method.")); 136 | } 137 | return device_types[index]; 138 | } 139 | 140 | unsigned int FunctionFromIOCTL(unsigned int code){ 141 | return (code & 0x3FFC) >> 2; 142 | } 143 | 144 | void ConvertCode(unsigned int code){ 145 | TCHAR* method = MethodFromIOCTL(code); 146 | TCHAR* access = AccessFromIOCTL(code); 147 | TCHAR* device_type = DeviceFromIOCTL(code); 148 | unsigned int function = FunctionFromIOCTL(code); 149 | _tprintf(_T("Method: %s\n"), method); 150 | _tprintf(_T("Access: %s\n"), access); 151 | _tprintf(_T("Device Type: %s\n"), device_type); 152 | _tprintf(_T("Funcion: 0x%x\n"), function); 153 | _tprintf(_T("#define NAME CTL_CODE(%s,0x%x,%s,%s)\n"),device_type,function,method,access); 154 | } 155 | 156 | void BruteforceCodes(TCHAR* name){ 157 | _tprintf(TEXT("Bruteforcing driver IOCTLS for %s.\n"), name); 158 | TCHAR path[ARRAY_SIZE]; 159 | GetDriverPath(name, path); 160 | _tprintf(TEXT("Driver path is %s.\n"), path); 161 | HANDLE hDevice = CreateFile(_T("\\\\.\\HackSysExtremeVulnerableDriver"), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, 0); 162 | if (hDevice == NULL){ 163 | _tprintf(_T("Could not open device handle.\n")); 164 | return; 165 | } 166 | _tprintf(TEXT("Device HANDLE opened, starting bruteforce.\n")); 167 | unsigned int ioctl; 168 | for (int d = 0; d < DEVICE_TYPE_COUNT; d++){ 169 | for (int f = 0; f < MAX_FUNCTION_CODE; f++){ 170 | for (int m = 0; m < METHOD_COUNT; m++){ 171 | for (int a = 0; a < ACCESS_COUNT; a++){ 172 | ioctl = CTL_CODE(d, f, m, a); 173 | __try { 174 | bool success = DeviceIoControl( 175 | hDevice, 176 | ioctl, 177 | NULL, 178 | 0, 179 | NULL, 180 | 0, 181 | NULL, 182 | NULL 183 | ); 184 | if (!success){ 185 | printf("Found\n"); 186 | } 187 | } 188 | __except (EXCEPTION_EXECUTE_HANDLER) { 189 | printf("IOCTL: 0x%x caused an exception!\n", ioctl); 190 | ConvertCode(ioctl); 191 | } 192 | //printf("%s\n", success ? "true" : "false"); 193 | } 194 | } 195 | } 196 | } 197 | } -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Mozilla Public License, version 2.0 2 | 3 | 1. Definitions 4 | 5 | 1.1. "Contributor" 6 | 7 | means each individual or legal entity that creates, contributes to the 8 | creation of, or owns Covered Software. 9 | 10 | 1.2. "Contributor Version" 11 | 12 | means the combination of the Contributions of others (if any) used by a 13 | Contributor and that particular Contributor's Contribution. 14 | 15 | 1.3. "Contribution" 16 | 17 | means Covered Software of a particular Contributor. 18 | 19 | 1.4. "Covered Software" 20 | 21 | means Source Code Form to which the initial Contributor has attached the 22 | notice in Exhibit A, the Executable Form of such Source Code Form, and 23 | Modifications of such Source Code Form, in each case including portions 24 | thereof. 25 | 26 | 1.5. "Incompatible With Secondary Licenses" 27 | means 28 | 29 | a. that the initial Contributor has attached the notice described in 30 | Exhibit B to the Covered Software; or 31 | 32 | b. that the Covered Software was made available under the terms of 33 | version 1.1 or earlier of the License, but not also under the terms of 34 | a Secondary License. 35 | 36 | 1.6. "Executable Form" 37 | 38 | means any form of the work other than Source Code Form. 39 | 40 | 1.7. "Larger Work" 41 | 42 | means a work that combines Covered Software with other material, in a 43 | separate file or files, that is not Covered Software. 44 | 45 | 1.8. "License" 46 | 47 | means this document. 48 | 49 | 1.9. "Licensable" 50 | 51 | means having the right to grant, to the maximum extent possible, whether 52 | at the time of the initial grant or subsequently, any and all of the 53 | rights conveyed by this License. 54 | 55 | 1.10. "Modifications" 56 | 57 | means any of the following: 58 | 59 | a. any file in Source Code Form that results from an addition to, 60 | deletion from, or modification of the contents of Covered Software; or 61 | 62 | b. any new file in Source Code Form that contains any Covered Software. 63 | 64 | 1.11. "Patent Claims" of a Contributor 65 | 66 | means any patent claim(s), including without limitation, method, 67 | process, and apparatus claims, in any patent Licensable by such 68 | Contributor that would be infringed, but for the grant of the License, 69 | by the making, using, selling, offering for sale, having made, import, 70 | or transfer of either its Contributions or its Contributor Version. 71 | 72 | 1.12. "Secondary License" 73 | 74 | means either the GNU General Public License, Version 2.0, the GNU Lesser 75 | General Public License, Version 2.1, the GNU Affero General Public 76 | License, Version 3.0, or any later versions of those licenses. 77 | 78 | 1.13. "Source Code Form" 79 | 80 | means the form of the work preferred for making modifications. 81 | 82 | 1.14. "You" (or "Your") 83 | 84 | means an individual or a legal entity exercising rights under this 85 | License. For legal entities, "You" includes any entity that controls, is 86 | controlled by, or is under common control with You. For purposes of this 87 | definition, "control" means (a) the power, direct or indirect, to cause 88 | the direction or management of such entity, whether by contract or 89 | otherwise, or (b) ownership of more than fifty percent (50%) of the 90 | outstanding shares or beneficial ownership of such entity. 91 | 92 | 93 | 2. License Grants and Conditions 94 | 95 | 2.1. Grants 96 | 97 | Each Contributor hereby grants You a world-wide, royalty-free, 98 | non-exclusive license: 99 | 100 | a. under intellectual property rights (other than patent or trademark) 101 | Licensable by such Contributor to use, reproduce, make available, 102 | modify, display, perform, distribute, and otherwise exploit its 103 | Contributions, either on an unmodified basis, with Modifications, or 104 | as part of a Larger Work; and 105 | 106 | b. under Patent Claims of such Contributor to make, use, sell, offer for 107 | sale, have made, import, and otherwise transfer either its 108 | Contributions or its Contributor Version. 109 | 110 | 2.2. Effective Date 111 | 112 | The licenses granted in Section 2.1 with respect to any Contribution 113 | become effective for each Contribution on the date the Contributor first 114 | distributes such Contribution. 115 | 116 | 2.3. Limitations on Grant Scope 117 | 118 | The licenses granted in this Section 2 are the only rights granted under 119 | this License. No additional rights or licenses will be implied from the 120 | distribution or licensing of Covered Software under this License. 121 | Notwithstanding Section 2.1(b) above, no patent license is granted by a 122 | Contributor: 123 | 124 | a. for any code that a Contributor has removed from Covered Software; or 125 | 126 | b. for infringements caused by: (i) Your and any other third party's 127 | modifications of Covered Software, or (ii) the combination of its 128 | Contributions with other software (except as part of its Contributor 129 | Version); or 130 | 131 | c. under Patent Claims infringed by Covered Software in the absence of 132 | its Contributions. 133 | 134 | This License does not grant any rights in the trademarks, service marks, 135 | or logos of any Contributor (except as may be necessary to comply with 136 | the notice requirements in Section 3.4). 137 | 138 | 2.4. Subsequent Licenses 139 | 140 | No Contributor makes additional grants as a result of Your choice to 141 | distribute the Covered Software under a subsequent version of this 142 | License (see Section 10.2) or under the terms of a Secondary License (if 143 | permitted under the terms of Section 3.3). 144 | 145 | 2.5. Representation 146 | 147 | Each Contributor represents that the Contributor believes its 148 | Contributions are its original creation(s) or it has sufficient rights to 149 | grant the rights to its Contributions conveyed by this License. 150 | 151 | 2.6. Fair Use 152 | 153 | This License is not intended to limit any rights You have under 154 | applicable copyright doctrines of fair use, fair dealing, or other 155 | equivalents. 156 | 157 | 2.7. Conditions 158 | 159 | Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in 160 | Section 2.1. 161 | 162 | 163 | 3. Responsibilities 164 | 165 | 3.1. Distribution of Source Form 166 | 167 | All distribution of Covered Software in Source Code Form, including any 168 | Modifications that You create or to which You contribute, must be under 169 | the terms of this License. You must inform recipients that the Source 170 | Code Form of the Covered Software is governed by the terms of this 171 | License, and how they can obtain a copy of this License. You may not 172 | attempt to alter or restrict the recipients' rights in the Source Code 173 | Form. 174 | 175 | 3.2. Distribution of Executable Form 176 | 177 | If You distribute Covered Software in Executable Form then: 178 | 179 | a. such Covered Software must also be made available in Source Code Form, 180 | as described in Section 3.1, and You must inform recipients of the 181 | Executable Form how they can obtain a copy of such Source Code Form by 182 | reasonable means in a timely manner, at a charge no more than the cost 183 | of distribution to the recipient; and 184 | 185 | b. You may distribute such Executable Form under the terms of this 186 | License, or sublicense it under different terms, provided that the 187 | license for the Executable Form does not attempt to limit or alter the 188 | recipients' rights in the Source Code Form under this License. 189 | 190 | 3.3. Distribution of a Larger Work 191 | 192 | You may create and distribute a Larger Work under terms of Your choice, 193 | provided that You also comply with the requirements of this License for 194 | the Covered Software. If the Larger Work is a combination of Covered 195 | Software with a work governed by one or more Secondary Licenses, and the 196 | Covered Software is not Incompatible With Secondary Licenses, this 197 | License permits You to additionally distribute such Covered Software 198 | under the terms of such Secondary License(s), so that the recipient of 199 | the Larger Work may, at their option, further distribute the Covered 200 | Software under the terms of either this License or such Secondary 201 | License(s). 202 | 203 | 3.4. Notices 204 | 205 | You may not remove or alter the substance of any license notices 206 | (including copyright notices, patent notices, disclaimers of warranty, or 207 | limitations of liability) contained within the Source Code Form of the 208 | Covered Software, except that You may alter any license notices to the 209 | extent required to remedy known factual inaccuracies. 210 | 211 | 3.5. Application of Additional Terms 212 | 213 | You may choose to offer, and to charge a fee for, warranty, support, 214 | indemnity or liability obligations to one or more recipients of Covered 215 | Software. However, You may do so only on Your own behalf, and not on 216 | behalf of any Contributor. You must make it absolutely clear that any 217 | such warranty, support, indemnity, or liability obligation is offered by 218 | You alone, and You hereby agree to indemnify every Contributor for any 219 | liability incurred by such Contributor as a result of warranty, support, 220 | indemnity or liability terms You offer. You may include additional 221 | disclaimers of warranty and limitations of liability specific to any 222 | jurisdiction. 223 | 224 | 4. Inability to Comply Due to Statute or Regulation 225 | 226 | If it is impossible for You to comply with any of the terms of this License 227 | with respect to some or all of the Covered Software due to statute, 228 | judicial order, or regulation then You must: (a) comply with the terms of 229 | this License to the maximum extent possible; and (b) describe the 230 | limitations and the code they affect. Such description must be placed in a 231 | text file included with all distributions of the Covered Software under 232 | this License. Except to the extent prohibited by statute or regulation, 233 | such description must be sufficiently detailed for a recipient of ordinary 234 | skill to be able to understand it. 235 | 236 | 5. Termination 237 | 238 | 5.1. The rights granted under this License will terminate automatically if You 239 | fail to comply with any of its terms. However, if You become compliant, 240 | then the rights granted under this License from a particular Contributor 241 | are reinstated (a) provisionally, unless and until such Contributor 242 | explicitly and finally terminates Your grants, and (b) on an ongoing 243 | basis, if such Contributor fails to notify You of the non-compliance by 244 | some reasonable means prior to 60 days after You have come back into 245 | compliance. Moreover, Your grants from a particular Contributor are 246 | reinstated on an ongoing basis if such Contributor notifies You of the 247 | non-compliance by some reasonable means, this is the first time You have 248 | received notice of non-compliance with this License from such 249 | Contributor, and You become compliant prior to 30 days after Your receipt 250 | of the notice. 251 | 252 | 5.2. If You initiate litigation against any entity by asserting a patent 253 | infringement claim (excluding declaratory judgment actions, 254 | counter-claims, and cross-claims) alleging that a Contributor Version 255 | directly or indirectly infringes any patent, then the rights granted to 256 | You by any and all Contributors for the Covered Software under Section 257 | 2.1 of this License shall terminate. 258 | 259 | 5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user 260 | license agreements (excluding distributors and resellers) which have been 261 | validly granted by You or Your distributors under this License prior to 262 | termination shall survive termination. 263 | 264 | 6. Disclaimer of Warranty 265 | 266 | Covered Software is provided under this License on an "as is" basis, 267 | without warranty of any kind, either expressed, implied, or statutory, 268 | including, without limitation, warranties that the Covered Software is free 269 | of defects, merchantable, fit for a particular purpose or non-infringing. 270 | The entire risk as to the quality and performance of the Covered Software 271 | is with You. Should any Covered Software prove defective in any respect, 272 | You (not any Contributor) assume the cost of any necessary servicing, 273 | repair, or correction. This disclaimer of warranty constitutes an essential 274 | part of this License. No use of any Covered Software is authorized under 275 | this License except under this disclaimer. 276 | 277 | 7. Limitation of Liability 278 | 279 | Under no circumstances and under no legal theory, whether tort (including 280 | negligence), contract, or otherwise, shall any Contributor, or anyone who 281 | distributes Covered Software as permitted above, be liable to You for any 282 | direct, indirect, special, incidental, or consequential damages of any 283 | character including, without limitation, damages for lost profits, loss of 284 | goodwill, work stoppage, computer failure or malfunction, or any and all 285 | other commercial damages or losses, even if such party shall have been 286 | informed of the possibility of such damages. This limitation of liability 287 | shall not apply to liability for death or personal injury resulting from 288 | such party's negligence to the extent applicable law prohibits such 289 | limitation. Some jurisdictions do not allow the exclusion or limitation of 290 | incidental or consequential damages, so this exclusion and limitation may 291 | not apply to You. 292 | 293 | 8. Litigation 294 | 295 | Any litigation relating to this License may be brought only in the courts 296 | of a jurisdiction where the defendant maintains its principal place of 297 | business and such litigation shall be governed by laws of that 298 | jurisdiction, without reference to its conflict-of-law provisions. Nothing 299 | in this Section shall prevent a party's ability to bring cross-claims or 300 | counter-claims. 301 | 302 | 9. Miscellaneous 303 | 304 | This License represents the complete agreement concerning the subject 305 | matter hereof. If any provision of this License is held to be 306 | unenforceable, such provision shall be reformed only to the extent 307 | necessary to make it enforceable. Any law or regulation which provides that 308 | the language of a contract shall be construed against the drafter shall not 309 | be used to construe this License against a Contributor. 310 | 311 | 312 | 10. Versions of the License 313 | 314 | 10.1. New Versions 315 | 316 | Mozilla Foundation is the license steward. Except as provided in Section 317 | 10.3, no one other than the license steward has the right to modify or 318 | publish new versions of this License. Each version will be given a 319 | distinguishing version number. 320 | 321 | 10.2. Effect of New Versions 322 | 323 | You may distribute the Covered Software under the terms of the version 324 | of the License under which You originally received the Covered Software, 325 | or under the terms of any subsequent version published by the license 326 | steward. 327 | 328 | 10.3. Modified Versions 329 | 330 | If you create software not governed by this License, and you want to 331 | create a new license for such software, you may create and use a 332 | modified version of this License if you rename the license and remove 333 | any references to the name of the license steward (except to note that 334 | such modified license differs from this License). 335 | 336 | 10.4. Distributing Source Code Form that is Incompatible With Secondary 337 | Licenses If You choose to distribute Source Code Form that is 338 | Incompatible With Secondary Licenses under the terms of this version of 339 | the License, the notice described in Exhibit B of this License must be 340 | attached. 341 | 342 | Exhibit A - Source Code Form License Notice 343 | 344 | This Source Code Form is subject to the 345 | terms of the Mozilla Public License, v. 346 | 2.0. If a copy of the MPL was not 347 | distributed with this file, You can 348 | obtain one at 349 | http://mozilla.org/MPL/2.0/. 350 | 351 | If it is not possible or desirable to put the notice in a particular file, 352 | then You may include the notice in a location (such as a LICENSE file in a 353 | relevant directory) where a recipient would be likely to look for such a 354 | notice. 355 | 356 | You may add additional accurate notices of copyright ownership. 357 | 358 | Exhibit B - "Incompatible With Secondary Licenses" Notice 359 | 360 | This Source Code Form is "Incompatible 361 | With Secondary Licenses", as defined by 362 | the Mozilla Public License, v. 2.0. 363 | 364 | --------------------------------------------------------------------------------