This uses some hacky scripting combined with the [angr](http://angr.horse) binary analysis framework to discover valid IOCTLs for Windows drivers. First it finds the drivers dispatch table using some educated guesswork, then it symbolically executes from the disptach tables entry point. While it's executing it saves all the potential values for the general purpose registers and upon completion uses some basic heuristics to discover potential IOCTL codes.
