Post #4423213

If we look at the driver permissions, it turns out it actually is a vulnerable driver, as anybody can tickle any of the ioctls. So if anybody already had this driver on their system (which might be named DCRCVDrv.sys), then it is indeed a driver that introduces a vulnerability. The term "BYOVD" is complete nonsense, as if an attacker is bringing their own driver, it doesn't need to be vulnerable. It's a BYOD attack. Vaguely interesting is that with this driver, Ghidra actually did a better job of decompiling the vulnerable code than IDA did. IDA: Take the ioctl, subtract 0x220540, then subtract 4, then subtract 4, then subtract 4, then subtract 4, then subtract 0x34, and then if you're left with 0x3C, run the function. Ghidra: If the ioctl is 0x2205c0, run the function.