From 62c4588f2b7978e690694e4dce94c984f1709e3d Mon Sep 17 00:00:00 2001
From: switch <switch@switch.re>
Date: Wed, 17 Jan 2024 16:42:36 +0100
Subject: [PATCH 1/2] fixed device name and ioctl / device exclusion and
 inclusion

---
 ioctl_hunter/frida/script.ts | 10 +++++-----
 ioctl_hunter/lib/hooking.py  | 34 +++++++++++++---------------------
 2 files changed, 18 insertions(+), 26 deletions(-)

diff --git a/ioctl_hunter/frida/script.ts b/ioctl_hunter/frida/script.ts
index 91ff297..94a2417 100644
--- a/ioctl_hunter/frida/script.ts
+++ b/ioctl_hunter/frida/script.ts
@@ -60,8 +60,8 @@ var open_handles = {}
 //
 
 rpc.exports = {
-    exclude_ioctl: function (ioctl) {
-        excluded_ioctl.push(+ioctl);
+    excludeioctl: function (ioctl) {
+        excluded_ioctl.push(ioctl);
         return excluded_ioctl;
     },
     sethookenabled: function (bool) {
@@ -98,13 +98,13 @@ function getPathByHandle(handle) {
     var ret = Func_NtQueryObject(handle, 1, ptr, 1024, ptr2)
 
     if (x32) {
-        var path = Memory.readUtf16String(ptr.add(8))   // 32 bits binaries
+        var path = Memory.readUtf16String(Memory.readPointer(ptr.add(8)))   // 32 bits binaries
     }
     else {
-        var path = Memory.readUtf16String(ptr.add(16))  // 64 bits binaries
+        var path = Memory.readUtf16String(Memory.readPointer(ptr.add(16)))  // 64 bits binaries
     }
 
-    return path
+    return path.replaceAll("\\", "\\\\")
 }
 
 //
diff --git a/ioctl_hunter/lib/hooking.py b/ioctl_hunter/lib/hooking.py
index 20b65b0..6058e8d 100644
--- a/ioctl_hunter/lib/hooking.py
+++ b/ioctl_hunter/lib/hooking.py
@@ -23,33 +23,25 @@ def check_drivers_filters(ioctl_dict):
                 ioctl_dict["handle_path"] != "N/A"
                 and driver.lower() in ioctl_dict["handle_path"].lower()
             ):
-                return False
+                return True
+        return False
 
-    ret = False
-    if State.results.excluded_drivers:
+    elif State.results.excluded_drivers:
         for driver in State.results.excluded_drivers:
             if (
                 ioctl_dict["handle_path"] != "N/A"
                 and driver.lower() in ioctl_dict["handle_path"].lower()
             ):
-                ret = True
-                break
+                return False
 
-    return ret
+    return True
 
 
 def check_ioctls_filters(ioctl_dict):
-    if (
-        State.results.included_ioctls
-        and ioctl_dict["ioctl"] in State.results.included_ioctls
-    ):
-        return False
-    if (
-        State.results.excluded_ioctls
-        and ioctl_dict["ioctl"] in State.results.excluded_ioctls
-    ):
-        return True
-    return False
+    if State.results.included_ioctls:
+        return ioctl_dict["ioctl"] in State.results.included_ioctls
+    elif State.results.excluded_ioctls:
+        return ioctl_dict["ioctl"] not in State.results.excluded_ioctls
 
 
 def process_device_ioctl_queue():
@@ -86,10 +78,10 @@ def process_device_ioctl_queue():
             logger.error(open_handles)
             ioctl_dict["handle_path"] = "N/A"
 
-        if check_drivers_filters(ioctl_dict):
+        if not check_drivers_filters(ioctl_dict):
             continue
 
-        if check_ioctls_filters(ioctl_dict):
+        if not check_ioctls_filters(ioctl_dict):
             continue
 
         device, access, function, method = get_ioctl_code_details(ioctl_dict["ioctl"])
@@ -160,7 +152,7 @@ def start_hooking(exe_path=None, pid=None, args=None, x32=False, all_symbols=Fal
         State.script.exports.setHookEnabled(State.hook_enabled)
 
     for ioctl in State.results.excluded_ioctls:
-        State.script.exports.exclude_ioctl(ioctl)
+        State.script.exports.excludeioctl(ioctl)
 
     logger.info("Start hunting juicy IOCTLs")
     while State.running and psutil.pid_exists(pid):
@@ -176,4 +168,4 @@ def start_hooking(exe_path=None, pid=None, args=None, x32=False, all_symbols=Fal
         print_final_recap()
     except:
         pass
-    return True
+    return True
\ No newline at end of file

From 5f7fab3b2a0a505c1515c0ef49e437155b89e8df Mon Sep 17 00:00:00 2001
From: switch <switch@switch.re>
Date: Wed, 17 Jan 2024 16:52:16 +0100
Subject: [PATCH 2/2] forget when no exclusion is supplied

---
 ioctl_hunter/lib/hooking.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ioctl_hunter/lib/hooking.py b/ioctl_hunter/lib/hooking.py
index 6058e8d..cb362de 100644
--- a/ioctl_hunter/lib/hooking.py
+++ b/ioctl_hunter/lib/hooking.py
@@ -42,6 +42,8 @@ def check_ioctls_filters(ioctl_dict):
         return ioctl_dict["ioctl"] in State.results.included_ioctls
     elif State.results.excluded_ioctls:
         return ioctl_dict["ioctl"] not in State.results.excluded_ioctls
+    else:
+        return True
 
 
 def process_device_ioctl_queue():