DriverSentinel 是一款使用 Go 开发的安全工具，通过将 Windows 系统上的驱动程序与 LOLDrivers.io 数据库进行比对，检测恶意和易受攻击的驱动程序。
功能特性 • 系统要求 • 安装 • 使用方法 • 工作原理
.zip 文件driversentinel.exegit clone https://github.com/bI8d0/DriverSentinel.git
cd DriverSentinel
go run .\build.go
driversentinel.exe [options]
| 选项 | 描述 |
|---|---|
-common | 扫描常见的 Windows 驱动程序位置（需要管理员权限） |
-path <path> | 扫描指定目录 |
-r | 递归模式（扫描子目录） |
driversentinel.exe -common
自动扫描：
C:\Windows\System32\driversC:\Windows\SysWOW64\driversC:\Windows\System32\DriverStore\FileRepositorydriversentinel.exe -path C:\MyFolder
driversentinel.exe -path C:\MyFolder -r
driversentinel.exe -path C:\ -r
启动时，DriverSentinel：
构建优化的索引以实现快速搜索：
对于找到的每个 .sys 文件：
显示详细信息：
=== DriverSentinel - Vulnerable Driver Scanner by bI8d0 ===
[repository] Local copy is up to date
[repository] Loaded 1337 drivers
Total drivers loaded: 1337
[scanner] Indices built: 5432 hashes, 5432 filenames
[scanner] Valid extension: .sys
[scanner] Starting scan of: C:\Windows\System32\drivers
[scanner] Scanning (523 files): C:\Windows\System32\drivers\some_driver.sys
⚠ DETECTED: C:\Windows\System32\drivers\vulnerable.sys (Type: both, Category: malicious)
[scanner] Scan completed in 2.34s
[scanner] Files scanned: 523
[scanner] Vulnerabilities found: 1
⚠ ALERT: Found 1 vulnerable driver(s)
================================================================================
[1] VULNERABLE FILE DETECTED
--------------------------------------------------------------------------------
Path: C:\Windows\System32\drivers\vulnerable.sys
SHA256: abc123def456...
Match Type: both
Driver ID: vulnerable-driver-id
Category: malicious
Vulnerable Driver Details:
Original: vulnerable.sys
Company: Malicious Corp
Product: Malicious Product
Version: 1.0.0
Description: Known vulnerable driver
HVCI: False
Exploitation Commands:
─── Command 1 ───
Use Case: Privilege Escalation
Privileges: Administrator
OS: Windows 10/11
Description: Known exploit method
Command: sc.exe create vuln binPath= ...
Resources: https://example.com/advisory
================================================================================
⚡ REMEDIATION GUIDE (Requires Administrator)
================================================================================
Generic commands to remove detected vulnerable drivers:
1. Stop the driver/service (if running):
sc.exe stop <service_name>
2. Disable the driver/service:
sc.exe config <service_name> start= disabled
3. Delete the service:
sc.exe delete <service_name>
4. Backup and delete the file:
move "C:\Path\To\driver.sys" "C:\Path\To\driver.sys.malz"
5. Or delete directly (use with caution):
del /F "C:\Path\To\driver.sys"
⚠ WARNING:
- Removing system drivers may cause system instability or prevent boot.
- Always create a System Restore Point before taking action.
- Replace <service_name> with the actual service name (use 'sc.exe query' to find it).
- Use the full path from the detection results above.
================================================================================
# Clone the repository
git clone https://github.com/bI8d0/DriverSentinel.git
cd DriverSentinel
# Install dependencies
go mod download
# Build
go run .\build.go
# Run
.\build\driversentinel.exe -common
go build -ldflags="-s -w" -o build/driversentinel.exe
DriverSentinel 根据驱动程序类别应用不同的标准：
category: "malicious"）category: "vulnerable driver"）| 匹配类型 | 描述 |
|---|---|
filename | 仅文件名匹配 |
sha256 | 仅哈希匹配（重命名后的文件） |
both | 文件名和哈希均匹配（完全匹配） |
本项目采用 MIT 许可证。有关详细信息，请参阅 LICENSE 文件。
本工具仅用于教育和防御性安全目的。
请勿将其用于恶意或非法活动。
作者不对滥用本工具的行为负责。
用 ❤️ 和 Go 制作
如果您觉得它有用，请考虑给它一个 ⭐！