From GitHub - netskopeoss/ioctlhammer :

IOCTL-Hammer is a lightweight fuzzing harness focused on targeted, parameter-centric testing of Windows driver IOCTL interfaces. It lowers the barrier to kernel driver testing by systematically stressing the four user-mode buffer descriptors used with DeviceIoControl, instead of relying on heavyweight coverage-guided tooling.

Core idea: manipulate the DeviceIoControl API (input buffer, output buffer, lpBytesReturned, and buffer contents/sizes) to exercise boundary conditions that commonly produce high-impact issues in kernel drivers (BSOD, DoS, privilege escalation). Available in Python (lightweight, modular) and Go (CLI tool with native Win32 support). Licensed under BSD-3-Clause.

Presented at Black Hat Europe 2025 Arsenal.

List of Sessions