Best tools for white-box static and dynamic analysis of drivers to find bugs?

NTDEV
1

Hey folks,

Was wondering what tools do you guys use to find bugs in the source code (static) or dynamically find bugs in your drivers? Any recommendations?

Currently we only use visual studio's driver static verifier for source code problems and driver verifier for runtime problems, but was wondering if there are better options to find bugs in our drivers (static or dynamic)? Some of our drivers are KMDF and some older ones are WDM.

2

The very latest Windows version, coupled with very recent MSVC and WDK support kernel address sanitizer (KASAN), that should catch memory errors to the extent that the user-mode equivalent ASAN does in MSVC/GCC/Clang. There's some information on setting it up here: Kernel Address Sanitizer - Windows drivers | Microsoft Learn though I haven't personally tried it yet.

1 Like