A Windows driver exposes its kernel through I/O control (IOCTL) codes, and a single unchecked length on the buffer behind one turns an unprivileged call into a kernel write. The research community has strong scanners for this surface and a curated list of known-bad drivers, but no map of the surface itself. We build that map. The Windows IOCTL Census is a queryable database of the control-code dispatch surface of 27,087 signed Windows drivers, recovered by one deterministic, architecture-neutral pass with no symbolic execution. Reading a lifted intermediate representation instead of running a symbolic engine lets it recover a dispatch surface for 80% of the corpus across x86 and x64, including the 32-bit half existing scanners abort on. On the 64-bit lane it adds handler reachability, taint, and the call graph. An LLM ranks the reachable handlers for triage. We release the census as a public dataset of tens of millions of rows: 27,087 binaries, 3.1M decoded control codes, 8.18M functions, and 15.95M call edges.

翻译：Windows 驱动程序通过I/O控制（IOCTL）代码暴露其内核，而一段未受检查的缓冲区长度即可将非特权调用转化为内核写入漏洞。研究社区已具备针对该接口的强力扫描工具及已知恶意驱动程序的精选列表，但始终缺乏接口本身的完整图谱。我们构建了该图谱。Windows IOCTL 普查是一个可查询的数据库，涵盖27,087个已签名Windows驱动程序的代码分派接口，通过一种确定性且架构无关的扫描方法（无需符号执行）提取获得。通过读取提升后的中间表示而非运行符号引擎，本方法能在x86和x64架构上恢复80%语料库的分派接口，包括现有扫描工具因错误而放弃的32位程序片段。在64位环境下，本方法进一步提供处理程序可达性、污染分析及调用图。语言模型（LLM）对可达处理程序进行优先级排序。我们将此普查结果作为公共数据集发布，包含数千万条记录：27,087个二进制文件、310万个解码控制代码、818万个函数及1595万个调用边。