
DriverSentinel è uno strumento di sicurezza sviluppato in Go che rileva driver dannosi e vulnerabili sui sistemi Windows confrontandoli con il database LOLDrivers.io.
DriverSentinel è uno strumento di sicurezza sviluppato in Go che rileva driver dannosi e vulnerabili sui sistemi Windows confrontandoli con il database LOLDrivers.io.
Caratteristiche • Installazione • Utilizzo • Come Funziona
.zipdriversentinel.exe da un terminale con privilegi di amministratoregit clone https://github.com/bI8d0/DriverSentinel.git
cd DriverSentinel
go run .\build.go
driversentinel.exe [options]
| Opzione | Descrizione |
|---|---|
-common | Scansiona le posizioni comuni dei driver di Windows (richiede Admin) |
-path <path> | Scansiona una directory specifica |
-r | Modalità ricorsiva (scansiona le sottodirectory) |
driversentinel.exe -common
Scansiona automaticamente:
C:\Windows\System32\driversC:\Windows\SysWOW64\driversC:\Windows\System32\DriverStore\FileRepositorydriversentinel.exe -path C:\MyFolder
driversentinel.exe -path C:\MyFolder -r
driversentinel.exe -path C:\ -r
All'avvio, DriverSentinel:
Costruisce indici ottimizzati per una ricerca rapida:
Per ogni file .sys trovato:
Mostra informazioni dettagliate:
=== DriverSentinel - Vulnerable Driver Scanner by bI8d0 ===
[repository] Local copy is up to date
[repository] Loaded 1337 drivers
Total drivers loaded: 1337
[scanner] Indices built: 5432 hashes, 5432 filenames
[scanner] Valid extension: .sys
[scanner] Starting scan of: C:\Windows\System32\drivers
[scanner] Scanning (523 files): C:\Windows\System32\drivers\some_driver.sys
⚠ DETECTED: C:\Windows\System32\drivers\vulnerable.sys (Type: both, Category: malicious)
[scanner] Scan completed in 2.34s
[scanner] Files scanned: 523
[scanner] Vulnerabilities found: 1
⚠ ALERT: Found 1 vulnerable driver(s)
================================================================================
[1] VULNERABLE FILE DETECTED
--------------------------------------------------------------------------------
Path: C:\Windows\System32\drivers\vulnerable.sys
SHA256: abc123def456...
Match Type: both
Driver ID: vulnerable-driver-id
Category: malicious
Vulnerable Driver Details:
Original: vulnerable.sys
Company: Malicious Corp
Product: Malicious Product
Version: 1.0.0
Description: Known vulnerable driver
HVCI: False
Exploitation Commands:
─── Command 1 ───
Use Case: Privilege Escalation
Privileges: Administrator
OS: Windows 10/11
Description: Known exploit method
Command: sc.exe create vuln binPath= ...
Resources: https://example.com/advisory
================================================================================
⚡ REMEDIATION GUIDE (Requires Administrator)
================================================================================
Generic commands to remove detected vulnerable drivers:
1. Stop the driver/service (if running):
sc.exe stop <service_name>
2. Disable the driver/service:
sc.exe config <service_name> start= disabled
3. Delete the service:
sc.exe delete <service_name>
4. Backup and delete the file:
move "C:\Path\To\driver.sys" "C:\Path\To\driver.sys.malz"
5. Or delete directly (use with caution):
del /F "C:\Path\To\driver.sys"
⚠ WARNING:
- Removing system drivers may cause system instability or prevent boot.
- Always create a System Restore Point before taking action.
- Replace <service_name> with the actual service name (use 'sc.exe query' to find it).
- Use the full path from the detection results above.
================================================================================
# Clone the repository
git clone https://github.com/bI8d0/DriverSentinel.git
cd DriverSentinel
# Install dependencies
go mod download
# Build
go run .\build.go
# Run
.\build\driversentinel.exe -common
go build -ldflags="-s -w" -o build/driversentinel.exe
DriverSentinel applica criteri diversi in base alla categoria del driver:
category: "malicious")