partial fix #15

DriverBuddyReloaded.py

@@ -214,8 +214,8 @@ def find_all_ioctls():
             if idc.print_insn_mnem(instr) in ['cmp', 'sub', 'mov'] and idc.get_operand_type(instr, 1) == 5:
                 value = get_operand_value(instr)
                 digits = utils.check_digits(value)
-                # value has 10 digits and is not a known NTSTATUS value
-                if digits == 10 and value not in NTSTATUS.ntstatus_values:
+                # value has more than 2 digits (lower false positives) and is not a known NTSTATUS value
+                if digits > 2 and value not in NTSTATUS.ntstatus_values:
                     ioctls.append((instr, value))
                     ioctl_tracker.add_ioctl(instr, value)
     return ioctls
@@ -260,7 +260,8 @@ def get_position_and_translate():
 
     value = get_operand_value(pos)
     digits = utils.check_digits(value)
-    if digits == 10 and value not in NTSTATUS.ntstatus_values:
+    # value has more than 2 digits (lower false positives) and is not a known NTSTATUS value
+    if digits > 2 and value not in NTSTATUS.ntstatus_values:
         ioctl_tracker.add_ioctl(pos, value)
         define = ioctl_decoder.get_define(value)
         make_comment(pos, define)