Windows IOCTL Census maps 27K drivers' kernel attack surface

Michael J. Bommarito II has published the Windows IOCTL Census, a corpus-scale database that maps the I/O control (IOCTL) dispatch surface of 27,087 signed Windows drivers. Unlike traditional scanners that rely on symbolic execution and often fail on 32-bit binaries, this approach uses a deterministic, architecture-neutral lift of intermediate representation. It achieves 80% coverage across both x86 and x64 architectures, recovering the 32-bit half that previous tools abort on. The census decodes 3.1 million control codes from the drivers, along with 8.18 million functions and 15.95 million call edges, forming the largest public map of kernel interaction points.

On the 64-bit lane, the dataset adds handler reachability analysis, taint tracking, and full call graphs. To aid triage, an LLM ranks reachable handlers by severity. The entire dataset is released publicly with tens of millions of rows, accessible at a companion site. This gives security researchers a structured map to identify unverified buffer-length checks or missing access controls—common root causes for kernel write vulnerabilities. The work addresses a critical gap between scanner tools that detect known-bad drivers and the need for a comprehensive baseline of the entire driver control-code surface.