High-Coverage Security Testing for Windows Kernel Drivers

In Windows kernel drivers, different function paths will be called according to the DeviceIoControlCode parameter in DeviceIoControl request. In order to achieve high-coverage security testing of these function paths, a new testing method using symbolic testing is proposed in this paper. With the automatic detection of Dispatch routine, symbolic testing is used to analyse the Dispatch function, walk through all supported function paths and get all DeviceIoControlCodes and check constraints. More specific test cases are generated with the guide of the codes and constraints. To compare the coverage of function paths, drivers of six famous security software are tested. Traditional testing method performs an average of 35% coverage, while ours performs 90%. Our tool discovers a previously-undiscovered priviledge escalation vulnerability of BitDefender2012 and some denial-of-service vulnerabilities, which prove the validity of our method.