This exploitation writeup shows the double fetch vulnerability of the HEVD. First, we check out the IrpDeviceIoctlHandler to locate the desired code block, which calls DoubleFetchIoctlHandler.

We need to find the right IOCTL code, so we trace the execution flow needed and understand what IOCTL code is needed to reach the code block.

The first code block in the screenshot subtracts ecx (the register holding our defined IOCTL code) by 0x222023. Following the next code blocks, we see that the result of that operation is further subtracted by 4, four times (as eax get the value 4 assigned) until the remaining value is compared with the value 4 again.

In order to reach the Double Fetch code block, we need to

PoC Exploit